For Win2k8 SP2 machine acting as PDC with "The security database on this server does not have a computer account..."

Question

I've the following simple configuration: 4 MS Windows Server 2008 SP2 virtual machines, one of them is the PDC of a small Domain Forest, one is secondary DC in the forest and two are members of the Domain. Initially there was well working DNS, but from some point in the past (around 2 months) the secondary DC has stopped to resolve correctly the domain names.

My suspects here are, this happened because some Windows Update has updated AD Services and from that point no synchronization between the PDC and the SDC could happen, also there is no direct (per DNS) connection between the DF and this secondary DC... But this is not the main problem.

The main Problem is, that one of the Domain Members has started to issue the error “The security database on the server does not have a computer account for this workstation trust relationship” upon logon (again around 2 months ago). Initially I've resolved this by disjoining and the rejoining the Workstation, but as this error came more than once, I've tried then the solution mentioned here.

Obviously I've did something wrong, then after that my PDC started to issue the same error upon the login... Since the PDC don't have a local administration account, my only access to the machine is via DSRM (starting the PDC in DSRM and using the DSRM Administrator account, allows me to log on the server).

But in DSRM the PDC acts as normal Workstation and there is no access to the AD DS (dcdiag, setspn and netdom does not work, telling me the AD DS is down Edit:- LDAP Error (49/52e) Login Failed or LDAP Error 81(0x51) - Server down).

Note, my Domain Administrator Account is still valid and works (when I disjoin and rejoin Workstations), I can't use it on the PDC only. My SDC has DNS malfunctions, so I'm unable to fix the AD DS Database from the SDC, because I didn't find out how to use the DS tools with IP-addresses instead of FQDNs...

The suggessted handling here also does not help much - I can't use any of the AD DS tools.

Looking in the Event Viewer pointed me to a duplicated HOST-entry in the AD DS configuration (Error 11) so now here is my question:

How can I regain the Domain-Level control over the PDC? Besides the obvious solution to scrap the current OS Installation and then reinstall the Server, how else can I regain the control over the machine?

Answer 1

I've found on the Microsoft's TechNet pages this article - modifying the Logon behavior of the DSRM Local Administration Account did the job to allow me to login on the server while AD DS executes. From that point it was easy for me to track down the duplicates (using setspn -x -F) and to remove them from the PDC's AD DS configuration (using setspn -D SPN PDC_Server).

Back to the logon screen, the Domain Administration Account was allowed to login again. Removing the modification of the registry, regarding the Login-rights of the DSRM Local Administration Account, is optional task though strongly recomended by Microsoft.

That's all - I'm now able to actively search a solution for my secondary problem with the out-of-sync SDC.