Secure channel communication between trust broken...

[shawn]

I'm unable to establish trust commnication (i.e. secure channel) between my
W2K3 AD domain and my NT 4.0SP1 domain (external trust).

Trust direction: Trusting: AD_DOMAIN, Trusted NT_DOMAIN domain

This trust had been working for 6 month as I was in progress of migrating
users/resources over to the AD domain. Then one day...several weeks ago, I
was attempting a user migration and determined that trust appeared to not be
in place anymore.

Since then I have removed the trust complete (both direction) and
reestablished the trust. The trust is created and it appears that the
AD_DOMAIN$ and NT_DOMAIN$ trust accounts are created. However, if I try to
verify trusts using W2K3 GUI it fails with error saying I need to remove and
readd trust (which I have done many many times during my dianostics).

To this point, it appears to be a secure channel issue, more than likely
with the LSA password possible corrupted or out-of-sync remaining in
registry on one side or the other.

I have been getting the 3210 and 5722 errors in event logs during this
attempts...indicating AccessDenied


A line from NETLOGON.LOG file using DBFlag = 0x2080FFFF was the following:

[CRITICAL] AD_DOMAIN: NT_DOMAIN: NlSessionSetup: new password is bad. Old
password is same as new password.

This possible pointing to the LSA trust password issue.

I have used NETDOM and NLTEST thoroughly with no luck. I can establish the
trust...and get a success with nltest /sc_query:NT_DOMAIN...as soon as I
attempt to verify for try to browse to resources, the secure channel begins
reflecting access denied symptons...very strange???

Does anybody have insight on what to try next?

I'll provide more detail as needed.

Thanks in advance.

Shawn

 

[Chriss3 [MVP]]

Hello,
Have a look at the KB below:

How to Use NLTEST to Force a New Secure Channel
http://support.microsoft.com/default.aspx?scid=kb;en-us;156684

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup

 

[shawn]

Resettng the secure channel with nltest introduces the access denied
issue...I have attempted this many many times...

NLTEST has and still does work on trust direction: Trusting: NT_DOMAIN,
Trusted: AD_DOMAIN

....but it has not and still won't work on trust direction: Trusting:
AD_DOMAIN, Trused NT_DOMAIN


When I execute command "nltest /sc_reset:NT_DOMAIN" on AD PDC, the following
is logged to Netlogon.log

[CRITICAL] AD_DOMAIN: NT_DOMAIN: NlSessionSetup: new password is bad. Old
password is same as new password.


Thanks again...

Shawn

 

[shawn]

Correction...NT domain is SP6a...not SP1

Shawn

 

[shawn]

Diagnostics continued...

Running "dcdiag /test:OutboundSecureChannels /testdomain:NT_DOMAIN" on
AD_DC1 resulted in the following:

-----------------------------------

Starting test: OutboundSecureChannels
Could not Check secure channel from AD_DC1 to NT_DOMAIN: Access is
denied.
[AD_DC1] Does not have UF_INTERDOMAIN_TRUST_ACCOUNT set on
downlevel trust object for [NT_DOMAIN]
[AD_DC1] Does not have downlevel trust object for [NT_DOMAIN]
Could not Check secure channel from AD_DC2 to NT_DOMAIN: Access is
denied.
[AD_DC2] Does not have UF_INTERDOMAIN_TRUST_ACCOUNT set on
downlevel trust object for [NT_DOMAIN]
[AD_DC2] Does not have downlevel trust object for [NT_DOMAIN]
......................... AD_DC1 failed test OutboundSecureChannels

-----------------------------------


While monitoring AD_DC1 with Regmon, I ran "nltest /sc_reset:NT_DOMAIN" on
AD_DC1. The following two (2) keys where flagged with access denied to the
lsass.exe process trying to open keys:

HKLM\System\CurrentControlSet\Control\ComputerName

HKLM\System\CurrentControlSet\Services\Tcpip\Parameters


Not sure if this is THE ISSUEor not...but these keys have SYSTEM at Full
Control (which is what lsass.exe run as, isn't it?)...NLTEST was able to
read these keys with no problem...running command as domain
admin...hmmmmmmmm?




Still unsure of cause of issue...something orphaned in AD??? ...possibly
something in Group Policy??? I will continue to investigate...


Any additional thoughts would be appreciated...

Shawn

 

[shawn]

Anybody have any additional thoughts on this issue?

Thanks in advance.

Shawn

 

[ptwilliams]

So you removed the trust and re-added it? That should resolve and dodgy
passwords good and proper.

How is name resolution configured for both domains?

--

Paul Williams

http://www.msresource.net
http://forums.msresource.net


Anybody have any additional thoughts on this issue?

Thanks in advance.

Shawn