I am trying to figure out why my Server 2 which is a domain controller is getting an error saying "Access Denied" when I am trying to access group policy management. I have checked and it is giving some kind of Kerberos error. I am unsure how to fix the Access is denied error. Active directory seems to be working. When I do an NLTEST it says that it is seeing itself as the DC it is getting information from.

Here is where it gets weird. After going into some of the errors I found that I cannot access anything when I try to access the Server1 which is my Fully Qualified Domain server or primary Domain controller. When I try to go to file shares on the PDC from the BDC it states I don't have access. When I go the opposite direction things work out correctly. Now when I checked the event logs it states it has been to long since replication has happened to the Server2 from Server1. As far as I can tell Server2 has not access to get to Server1. I am stumped. OH AND TO MAKE THINGS WORSE the group policy set on Server2 will not allow for registry editing.

As started before I think this is a Kerberos thing but I can't figure out how to reset or even sync the Kerberos passwords with this access is denied problem. And this whole mess started when one of our servers time clock messed up do to a bad CMOS battery. So the Server1 time is set correctly and so is Server2 but still getting an issue.

I am getting this error -> The Kerberos client received a KRB_AP_ERR_MODIFIED error I have done some research and I don't have any way of getting around that. Can anyone help me or give me some guidance as I have not mucked around with FQDNs and 2 DCs at the same time. And it makes it more a pain I can't edit the registry or the fact that it is looking to itself as a domain for references. Can any one help me with my replication issue?


Kerberos depends on time being in sync. Are you sure the time & date are both correct? I've seen problems where hours & minutes are correct, but people overlook the date part which is not correct.

From comptuer1 invoke

w32tm.exe /stripchart /computer:computer2 /samples:1 /dataonly

It will report the clock difference between the two machines.
Sounds as if you have a GPO to disable registry mods? What else is in this GPO? Anything to restrict file sharing? If you a some kind of lockdown GPO, remove it and see if that is causing the problem.
What are the results of "dcdiag" from each server? Edit original post to show the results.

|improve this answer|||||
  • I have done that and it says it can't connect to the PDC to check the time it says Error 5: Access is denied. – JukEboX Nov 4 '15 at 22:28
  • Can you login to the server that had the battery die? If not, reboot and check clock from the BIOS. Do a manual verification of of both the time and the date. – Clayton Nov 4 '15 at 22:30
  • Yes. All clocks are now set the same. – JukEboX Nov 4 '15 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.