Many workstations losing trust with domain

[TraineeGeek]

Hi,

this week we've had workstations losing their trust with the domain, some multiple times a day. I looked in the Event Viewer on our 3 domain controllers and there were lots of errors reported by the win2003 server, replication errors.

Event Type: Warning

Event Source: NtFrs

Event Category: None

Event ID: 13508

Date: 18/07/2015

Time: 14:23:17

User: N/A

Computer: DC

Description:

The File Replication Service is having trouble enabling replication from PDC to DC for c:\windows\sysvol\domain using the DNS name pdc.domain.town.sch.uk. FRS will keep retrying.

Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name PDC.domain.town.sch.uk from this computer.

[2] FRS is not running on name.domain.town.sch.uk.

[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Data:

0000: 21 07 00 00 !...

ALSO

Event Type: Error

Event Source: NTDS Replication

Event Category: Replication

Event ID: 1864

Date: 20/07/2015

Time: 15:40:35

User: NT AUTHORITY\ANONYMOUS LOGON

Computer: DC

Description:

This is the replication status for the following directory partition on the local domain controller.

 

Directory partition:

DC=ForestDnsZones,DC=domain,DC=town,DC=sch,DC=uk

 

The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals.

 

More than 24 hours:

2

More than a week:

2

More than one month:

2

More than two months:

2

More than a tombstone lifetime:

0

Tombstone lifetime (days):

180

Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.

 

To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe.

You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency ".

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

 

 

 

It was always my intention to demote our Win2003 server today so that is what I did. I tried to run dcpromo but it errored with a logon failure, so I ran dcpromo /forceremove then removed entries in AD Comp & User and AD Sites & Services. Removed the NS from DNS then ran dcdiag.exe everything passed except for:-

 

Starting test: SystemLog

A warning event occurred. EventID: 0x000003F6

Time Generated: 07/21/2015 11:17:22

Event String:

Name resolution for the name domain.town.sch.uk timed out af

ter none of the configured DNS servers responded.

A warning event occurred. EventID: 0x00001695

Time Generated: 07/21/2015 11:17:46

Event String:

Dynamic registration or deletion of one or more DNS records associat

ed with DNS domain 'domain.town.sch.uk.' failed. These records are used

by other computers to locate this server as a domain controller (if the specifi

ed domain is an Active Directory domain) or as an LDAP server (if the specified

domain is an application partition).

......................... PDC failed test SystemLog

 

I'm wondering why we've got workstations randomly losing their trusts?

Is AD healthy apart from the above error?

 

Just got another losing trust

 

The session setup from computer 'WIN7PWPSNB99' failed because the se

curity database does not contain a trust account 'WIN7PWPSNB99$' referenced by t

he specified computer.

 

Many thanks

TG

Edited July 21, 2015 by TraineeGeek

[3s-gtech]

Start by scouring DNS and AD for old entries. Your clients may be trying to use the old DC. Then start with ADSIEdit, start in the Default naming context and have a poke around. Then check the Configuration nodes for any errant entries.

[featured_spectre]

We had this after we renamed a lot of machines due to moving rooms etc. We ended up taking them off the domain, clearing the DNS and ADUC, then re-added them.

[ITGURU]

We had this after we renamed a lot of machines due to moving rooms etc. We ended up taking them off the domain, clearing the DNS and ADUC, then re-added them.

 

When we rename machines, we change the name and put back on a workgroup. The Network ID wizard is then run to add back to the domain. Never had any problems doing it this way.

[featured_spectre]

Normally I'd do this, but the person that actually renamed them didn't do that, so I've said in the future they should.

[ITGURU]

Normally I'd do this, but the person that actually renamed them didn't do that, so I've said in the future they should.

 

Also then means they'll show up in your new computers OU rather than being renamed in their existing OU, which you may want to move elsewhere to pick up different policies.

[TraineeGeek]

Thanks, lots of sound advice. I need to change the way I do some things.