help

[Guest]

Subject: problems with SAM
From: "JJ" <[email protected]> Sent: 3/9/2004
9:42:57 AM




Hello

I have some problems with my servers, There are 2 Servers:
1 PDC and 1 BDC, and the BDC's event viewer displays next:

IN BDC::::::

*Application Log:
EventID=1000
Windows cannot determine the user or computer name. Return
value (1326).


*System Log:

Event ID: 16650 every 2 min.
The account-identifier allocator failed to initialize
properly. The record data contains the NT error code that
caused the failure. Windows 2000 will retry the
initialization until it succeeds; until that time, account
creation will be denied on this Domain Controller. Please
look for other SAM event logs that may indicate the exact
reason for the failure.
Event ID = 56
The Domain Controller \\pdc.domain.com (xxx.x1x.xx.x) in
domain.com returned an incorrectly signed time stamp. If
this DC is from the machine's parent domain then the trust
link between the domains may be broken and must be fixed.
If the DC is from this machine's own domain, then the
machine password for this machine is incorrect and should
be corrected.

Event ID= 11
The NTP server \\PDCServer.domain.com didn't respond

IN PDC:

*Directory Services

EventID = 1265 SOURCE= NTDS KCC TYPE=WARNING

i dont know what to do... I think that maybe is DNS
Configuration Problem, but im not sure about it.

HELP ME PLEASE,

THANKS,

JJ
..

 

[Alan Sterling [MSFT]]

Hi,

Looks like you have numerous issues. Make sure the time on the machines
match. You may want to check the connectivity between both DCs.
Resolution:

1. SPNs were not registered correctly for itself or on the FSMO for the
domain. Used dsstore -macobj userdomain\computername$ > spns.txt to pipe
the
SPNs to a text file. Looked at a healthy DC and compared against DC with
errors. Added the missing SPNs using ADSI edit.

a. Open ADSI edit. Expand Domain NC

Expand dc=domain....

Expand ou=Domain Controllers

Right-click on the DC w/problems and selet properties

Select which property to view set to Both

Select a property to view set to servicePrincipalName

Add missing SPNs. Do this on both the FSMO and the DC with problems.

2. netdom resetpwd /server:servername /userd:domain\administrator
/passworddassword

3. netdom reset computername /domain:domainNetbiosName


Good Luck,

Alan Sterling---MCSE
Windows 2000 Directory Services

This posting is provided "AS IS" with no warranties, and confers no rights.
"Use of included script samples are subject to the terms
specified at
http://www.microsoft.com/info/cpyright.htm"