I need some help here. I was experiencing domain issues and I found a DC that had been migrated from one VM host to another was corrupted in the process. I removed the DC from the domain and cleaned up the metadata. After this I ran the AD ran the AD Replication
Status tool and all seemed OK. Later that day I saw that I was getting "The target principal name is incorrect against DC1 (which hold the FSMO role). Note: I only have two DC's DC1 which hold the FSMO and DC2. On DC1 I performed the following steps:
1. net stop kdc and set to disabled.
2. rebooted DC1.
3. After logging back in I ran the netdom resetpwd to reset the system account.
Now I am getting access denied errors (see dcdiag output).
Begin
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = DC2012BDC
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\DC2012BDC
Starting test: Connectivity
......................... DC2012BDC passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\DC2012BDC
Starting test: Advertising
......................... DC2012BDC passed test Advertising
Starting test: FrsEvent
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
......................... DC2012BDC passed test FrsEvent
Starting test: DFSREvent
......................... DC2012BDC passed test DFSREvent
Starting test: SysVolCheck
......................... DC2012BDC passed test SysVolCheck
Starting test: KccEvent
......................... DC2012BDC passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... DC2012BDC passed test
KnowsOfRoleHolders
Starting test: MachineAccount
......................... DC2012BDC passed test MachineAccount
Starting test: NCSecDesc
......................... DC2012BDC passed test NCSecDesc
Starting test: NetLogons
......................... DC2012BDC passed test NetLogons
Starting test: ObjectsReplicated
......................... DC2012BDC passed test ObjectsReplicated
Starting test: Replications
[Replications Check,DC2012BDC] A recent replication attempt
failed:
From DC2012PDC to DC2012BDC
Naming Context: DC=ForestDnsZones,DC=DC2010,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2019-03-17 08:45:06.
The last success occurred at 2019-03-17 07:45:06.
1 failures have occurred since the last success.
[Replications Check,DC2012BDC] A recent replication attempt
failed:
From DC2012PDC to DC2012BDC
Naming Context: DC=DomainDnsZones,DC=DC2010,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2019-03-17 08:45:06.
The last success occurred at 2019-03-17 07:45:06.
1 failures have occurred since the last success.
[Replications Check,DC2012BDC] A recent replication attempt
failed:
From DC2012PDC to DC2012BDC
Naming Context: CN=Schema,CN=Configuration,DC=DC2010,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2019-03-17 08:45:06.
The last success occurred at 2019-03-17 07:45:06.
1 failures have occurred since the last success.
[Replications Check,DC2012BDC] A recent replication attempt
failed:
From DC2012PDC to DC2012BDC
Naming Context: CN=Configuration,DC=DC2010,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2019-03-17 08:45:06.
The last success occurred at 2019-03-17 07:45:06.
1 failures have occurred since the last success.
[Replications Check,DC2012BDC] A recent replication attempt
failed:
From DC2012PDC to DC2012BDC
Naming Context: DC=DC2010,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2019-03-17 08:45:06.
The last success occurred at 2019-03-17 07:45:06.
1 failures have occurred since the last success.
......................... DC2012BDC failed test Replications
Starting test: RidManager
......................... DC2012BDC passed test RidManager
Starting test: Services
......................... DC2012BDC passed test Services
Starting test: SystemLog
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:17:02
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012bdc$. The target name used was ldap/DC2012BDC.DC2010.com. This indicates that the target server failed to decrypt the ticket provided by
the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen
if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name
is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:18:48
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:23:49
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:28:49
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:33:50
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:36:48
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012pdc$. The target name used was E3514235-4B06-11D1-AB04-00C04FC2DCD2/b5566f4c-1272-46c8-ac5f-4a08ee572eac/DC2010.com@DC2010.com. This indicates
that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered
on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are
both configured to use the same password. If the server name is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the
fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:38:51
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:43:29
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012pdc$. The target name used was cifs/DC2012PDC.DC2010.com. This indicates that the target server failed to decrypt the ticket provided by
the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen
if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name
is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:43:52
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:48:53
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:53:35
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012pdc$. The target name used was ldap/DC2012PDC.DC2010.com. This indicates that the target server failed to decrypt the ticket provided by
the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen
if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name
is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:53:53
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012bdc$. The target name used was LDAP/DC2012BDC.DC2010.com/DC2010.com@DC2010.COM. This indicates that the target server failed to decrypt
the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This
error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password.
If the server name is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:53:54
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 08:58:54
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012bdc$. The target name used was ldap/DC2012BDC.DC2010.com/DC2010.com@DC2010.COM. This indicates that the target server failed to decrypt
the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This
error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password.
If the server name is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 08:58:55
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 09:03:55
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 09:06:50
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012bdc$. The target name used was LDAP/DC2012BDC. This indicates that the target server failed to decrypt the ticket provided by the client.
This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target
service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified,
and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 09:08:56
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x000003EE
Time Generated: 03/17/2019 09:10:12
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 03/17/2019 09:13:53
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server DC2012bdc$. The target name used was cifs/DC2012BDC.DC2010.com. This indicates that the target server failed to decrypt the ticket provided by
the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen
if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name
is not fully qualified, and the target domain (DC2010.COM) is different from the client domain (DC2010.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
......................... DC2012BDC failed test SystemLog
Starting test: VerifyReferences
......................... DC2012BDC passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : DC2010
Starting test: CheckSDRefDom
......................... DC2010 passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DC2010 passed test CrossRefValidation
Running enterprise tests on : DC2010.com
Starting test: LocatorCheck
......................... DC2010.com passed test LocatorCheck
Starting test: Intersite
......................... DC2010.com passed test Intersite
END
Please help, I am at my wits end.