Article ID: 153719 - View products that this article applies to.
This article was previously published under Q153719
After a Windows NT backup domain controller (BDC) has been offline for some time, it may fall out of synchronization with the primary domain controller (PDC). When you attempt to bring the BDC back online, you may get the following errors in the BDC's Event Viewer:
Event ID: 3210 Source: Netlogon Type: Error Description: Failed to authenticate with <computer name>, a Windows NT domain controller for domain <domain name>. Data word: c0000022 Event ID: 7023 Source: Service Control Manager Type: Error Description: Netlogon service terminated with the following error message: Access Denied.
This is very likely to occur if a BDC is restored from a backup that is more than a few days old or if the BDC is offline for more than a few days.
Domain controllers maintain a password-protected channel between each other. When a BDC is brought into a domain, the PDC gives the BDC the current password to use when connecting to the PDC for authentication, account database replication, and other system activities. This password changes automatically on a regular basis. If the BDC is offline when the password changes, or if a BDC is restored from a backup that has an old password, the BDC will not be able to authenticate with the PDC, and Netlogon will fail.
In the simplest case, all that has happened is that the domain password has changed. To resolve the behavior, do the following:
However, if synchronizing with the PDC does not work on the first attempt, try carrying out the same command again. Often, a second attempt will succeed. However, if the BDC will not synchronize and Netlogon fails to start after three attempts, you should create a new machine account for the BDC. These instructions are taken from a related article, 137987
For additional information on authentication issues specific to NWLink, please see the following article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/126752/EN-US/ )DCs Fail to Synchronize or Validate Users Over NWLINK
For additional information on authentication issues when trying to net view, please see the following article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/137987/EN-US/ )NET VIEW May Cause Semaphore Time Out and Event ID 3210
For additional information on authentication from the PDC's point of view, please see the following article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/142869/EN-US/ )Event ID 3210 & 3722 Appear When Synchronizing Entire Domain