Computer Account has been dissabled in AD

[Jorge]

Hello,
I've been having a problem for the last 2 weeks that I
can't fix yet. I have a single domain with 2 DCs (W2K). I
have workstations with W2K pro, XP Pro and Win98.
The problem is that in a contingent way, computers
running W2K or Xp Pro get rejected from the domain (they
can't access some servers because it says they don't have
privilegies). If we logout and login again, we'll get an
error that can't login because "the computer account has
been dissabled".
I have to login locally to the computer and change the
Computer Account, and then reboot. Or join with the same
name a workgroup, reboot, re-join the domain, and reboot
(in this process, when I join the workgroup it says that
it couldn't delete the old account from the domain).
It doesn't happen with ALL the computers running W2K Pro
or XP Pro, just with 8 or 10 of 100.

Does someone have any clue of what may be causing this
accounts to be dissabled?

If I go to User&Domains MMC, COmputers, and find the
dissabled accounts, even when I re-enabled them it
doesn't work. I have to either rename the computers or
join a workgroup and then join the domain back :-(

I will raelly appreciate any clue to keep investigating
what's going on.
Thank you, JOrge.

 

[Klaas J.M. Langhout [MS]]

Hi Jorge,

I know that AD by default has a password max policy (I believe) that
requires the computer account to periodically change it's own account
password. Also, computer acounts will by default do this password change
periodically.

The below sounds like some computers may not be able to change there
passwords and, it then hits the max password age. If so, you can verify
this by using netdom to reset a password to see if the computer then works.
If so, then, on this computer, the problem where it can't change it's own
password needs to be investigated (but, this will help narrow the problem).

See
http://support.microsoft.com/default.aspx?scid=kb;en-us;260575&Product=win2000
for netdom and more info related to this first step.

Hope that helps, klaas
This posting is provided "AS IS" with no warranties, and confers no rights.