We have a bunch of Windows 7 and Windows Vista clients that belong to domain
contoso.com. The clients are registered in DNS to
client.contoso.com. We have changed the DNS suffix via GPO from
contoso.com. This worked fine for most of the clients -
servicePrincipalNames got updated automagically including the computer objects
However some of the clients keep failing to update the attribute, which results in the following error messages:
Log Name: System
Event ID: 5789
Attempt to update DNS Host Name of the computer object in Active Directory failed. The updated value was 'someClient.contoso.com'. The following error occured: The requested resource is in use.
So far the only solution to this problem was removing the client from the domain and put it back in, which is kind of brute force method to solve this. The AD objects seems to have to correct permissions to update the mentioned attribute.
Set-ADComputer -Identity someClient -DNSHostName someClient.contoso.com
Set-ADComputer : While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync At line:1 char:1 + Set-ADComputer someClient -DNSHostName someClient.contoso.com + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (someClient:ADComputer) [Set-ADComputer], ADException + FullyQualifiedErrorId : While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync,Micros oft.ActiveDirectory.Management.Commands.SetADComputer
DistinguishedName : [...] DNSHostName : someClient.client.contoso.com Enabled : True Name : someClient ObjectClass : computer ObjectGUID : fdddd6ec-44f3-5b63-xxxx-55229cexxxxx SamAccountName : comeClient$ SID : S-1-5-21-1815460242-1203374957-4236298635-xxxxxx UserPrincipalName :
Things I have tried so far:
- Running gpupdate /force several times... rebooting of course
- Verified the client receives the correct DNS suffix settings from the GPO
- Verified the built-in object
Validated write to DNS host Nameand the
Validated write to Service principal Namepermissions
Any ideas on how to solve this, without having to rejoin the computers?