AD Fun after user enforced shutdown

Jools PB 96 Reputation points
2020-07-29T18:15:21.4+00:00

Hi All,

I've got a problem with a server at a charity I volunteer at, where it appears one on the DCs at one of their remote site was shut down on the button.

The following day, the server involved started complaining about a target account being incorrect when a user was trying to access a share. I went through the logs and found the credentials that the servers use to communicate was skewed. The cure, it turned out was "netdom resetpwd" run on the server from a remote DC. All of a sudden, DNS pops up and things seem to be working again.

Following morning, I get a call from one of the other offices complaining that they can't access shares on the server in their building. So, log in, same error. Go to the first server that broke (server 2016) run netdom reset and it fails with:

The machine account password for the local machine could not be reset.

The target account name is incorrect.

The command failed to complete successfully.

So, go to another DC - same, another - same, finally, last DC in the organisation succeeds, and all the errors in the log on the 2nd server disappear and DNS comes back up.

So, try to access the shares on the second server from the others in the organisation and get the same error about target accounts. Go to the server that succeeded in the netdom passwrd reset and that one opens all the shares on the second server. So, somewhere along the line, AD seems to got out of sync.

I've tried syncing and on all the servers, it return sync completed with no errors, but they don't seem to getting along. There are no errors logged in event viewer which seems odd and aside from the share access, everything appears to be fine.

Could someone please point in the best direction for getting these boxes talking to each other again. There are three dcs which work fine (sharewise) together but won't talk to the other two, and the other two which work fine with each other but won't talk to the other 3.

If you want log or dcdiag outputs, please let me know the parameters and I'll post the result.

Thanks,

Jools

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,154 questions
0 comments
Accepted answer
  1. Jools PB 96 Reputation points
    2020-07-31T16:06:11.683+00:00

    I appear to have had a bit of a result (hopefully).

    Having begun picking through the logs to sort out individual errors, the one that was bugging was the target name error. Hunting it down, I came across a technet article on server 2003 that used the IP of the server in the netdom resetpwd command instead of the computer name. Waited for the building to empty and ran the command on one of the remote servers and bingo, password successfully reset.

    So, I now only have an SChannel problem to sort and it looks like it may be a fix.

    So, once again, thanks for your help. You kept me going when I was just running round in circles getting frustrated. Top marks for you.

    Best of luck to you,

    Jools

11 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jools PB 96 Reputation points
    2020-07-30T20:21:00.727+00:00

    Thanks again for your help and apologies for getting back so late, but I've been run off my feet all day.

    Added the DNS server settings and ran the commands on shown, but it still doesn't appear to be syncing properly. On the plus side, the users have been able to get to their files.

    I'll pick through the logs tomorrow looking for any errors and will post back what I find, and can't sort myself.

    Thanks again,

    Jools

    0 comments
  2. Dave Patrick 426.4K Reputation points MVP
    2020-07-30T20:27:13.9+00:00

    You're going to need to go through the event logs on each and fix those problems as well. If the replication has not worked longer than tombstone period then you'll likely need to demote, reboot, promo them again, but I'd make sure the network ports are flowing, the 1908 and KCC errors are corrected before doing this.

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments
  3. Vicky Wang 2,646 Reputation points
    2020-08-06T07:51:08.703+00:00

    Hi,
    I am glad to hear that your issue was successfully resolved.
    If there is anything else we can do for you, please feel free to post in the forum.
    Have a nice day!

    0 comments