Kerberos error - All policies disappeared

[ajbritton]

Last week I was installing a new 2003 server and 30 odd PCs. I had set up a new domain (in an existing forest), created RIS builds and assigned my usual policies to hook it all up. Everything seemed to be working fine, but when I came in this morning, one by one, the PCs lost their group policy settings (firewall, security, software, you name it - it went). The only thing that I could find that might explain it is a Kerberos error in the PCs' system logs. Something to do with the computer account, authentication verification and a PAC ?!? I have rebuilt a few PCs and these appear to be OK so far.

 

Has anyone had anything like this before?

[Geoff]

Exact error and eventid number please.

 

Random stab in the dark suggests clock skew. Is the time set correctly on the server/clients?

[Ric_]

try running netdiag and dcdiag - these give very detailed output about problems.

[ajbritton]

I've rebuilt all the affected PCs, and they now seem to be OK.

 

The exact error was:

Event Type: Error

Event Source: Kerberos

Event Category: None

Event ID: 7

User: N/A

Description: The Kerberos subsystem encountered a PAC verification failure. This indicates that the PAC from the client ICTSUITE-01$ in realm HB-CURRIC.INT had a PAC which failed to verify or was modified. Contact your system administrator.

Data: 0000: c0000192

[Geoff]

Workstation, Netlogon and/or Computer Browser failed to start or started before the DNS client service was running.

 

http://support.microsoft.com/kb/883268/

[ajbritton]

@Geoff: Yup, tried the fix mentioned in the MS article. All the processes mentioned (that were present on the PCs) were already running as shared processes. Until the problem happens again though I can't check the event logs to look for service startup order. Thanks for the suggestions though.

[RobC]

I would be inclined to agree with Geoff that the system time may have something to do with it, as Kerberos tends to throw a fit if the workstation's clock doesn't match it's time record.

[tarquel]

Dunno how my domain keeps going then lol

 

Dont have a time source to speak of, although i think i followed some MS article to use the server's clock as the time source or something

 

Cheers

N.

[Geoff]

everything syncs to the Domain controller(s) usually. You just have to setup the domain controllers to use an external NTP server. Best done in the Domain Controller GPO.

 

If you have any non-Windows boxes on the network (eg, Linux, Mac's etc) you might want to enable the NTP server on your DC's too. Thats in the same GPO as above.

[tarquel]

true - but cant seem to find one lol

 

or access one - the [linux] one in powys doesnt seem to like the 2k3 server trying to sync its time with it. It matters not though

 

Cheers

N.

[MkII]

The LEA have a time server for us to sinc to Nath

[tarquel]

i cud swear that I just wrote that my 2003 server doesnt sync with powys' time server lol

 

 

N.

[Geoff]

Are your settings correct? By default 2k3 domain controllers will attempt to sync to 'time.windows.com' once per week. Make sure you set the protocol to NTP not SNTP.

 

If the GPO settings don't work you can set it manually from the command line thus:

 

net time /setsntp:ntp.whereever.com

 

You can verify it works by issuing:

 

net time

[MkII]

Do you not use the s/w they sent us then Nath? - mine syncs.