Article ID: 288167
NoticeThis article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/win2000)is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy
When you use the Active Directory Sites and Services snap-in to manually replicate data between Windows 2000 domain controllers, you may receive one of the following error messages:
The Target Principal Name is incorrect
In addition, the following event ID messages may be logged in the system log:
Access is denied
Event Source: Netlogon
Event Category: None Event ID: 3210
User: N/A Event Description:
Failed to authenticate with \\DOMAINDC, a Windows NT domain controller fordomain DOMAIN.
Event Source: Netlogon
Event ID: 5722
Event Category: None User: N/A Event Description:
The session setup from the computer 1 failed to authenticate. The name of the account referenced in the security database is 2. The following error occurred: n3
To resolve this issue, first determine which domain controller is the current primary domain controller (PDC) Emulator operations master role holder. To do this, use either of the following methods:
234790On domain controllers that are experiencing this issue, disable the Kerberos Key Distribution Center service (KDC). To do so:
(https://support.microsoft.com/kb/234790/EN-US/ )How to Find FSMO Role Holders
netdom resetpwd /server:server_name /userd:domain_name\administrator /passwordd:administrator_passwordWhere server_name is the name of the server that is the PDC Emulator operations master role holder.
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
260575After you reset the secure channel, restart the domain controllers. Even if you attempt to reset the secure channel using the Netdom utility, and the command does not complete successfully, proceed with the restart process.
(https://support.microsoft.com/kb/260575/EN-US/ )How to Use Netdom.exe to Reset Machine Account Passwords
If only the PDC Emulator operations master role holder is running, the KDC forces the other domain controllers to resynchronize with this computer, instead of issuing themselves a new Kerberos ticket.
After the computers have finished restarting, start the Services program, restart the KDC service, and then attempt replication again.
If there are multiple domain controllers in the domain, the error message that you receive when this issue occurs varies depending on which way replication is being attempted, and if one of the domain controllers that is involved is also the PDC Emulator operations master role holder.
In some cases, when you use the net view \\computername to attempt to connect to the domain controller that has the PDC Emulator operations master role from another domain controller, you may receive an "Access denied" error message. However, if you use the Internet protocol (IP) address, the command may succeed.
When this problem occurs, numerous errors may be reported in the event logs. These errors vary depending on any of the following conditions:
Event ID: 3034
Description: The redirector was unable to initialize security context or query context attributes.
Article ID: 288167 - Last Review: June 19, 2014 - Revision: 5.0