The security channel's password is stored along with the computer account on all domain controllers. For Windows 2000 or Windows XP, the default computer account password change period is every 30 days. If, for some reason, the computer account's password and the LSA secret are not synchronized, the Netlogon service logs one or both of the following errors messages:
Failed to authenticate with \\DOMAINDC, a Windows NT domain controller for domain DOMAIN.
The session setup from the computer %1 failed to authenticate. The name of the account referenced in the security database is %2. The following error occurred: %n%3
- Using the Netdom.exe command-line tool
- Using the Nltest.exe command-line tool
Note The Netdom.exe and Nltest.exe tools are located on the Windows Server CD-ROM in the Support\Tools folder. To install these tools, run Setup.exe or extract the files from the Support.cab file.
- Using the Active Directory Users and Computers Microsoft Management Console (MMC)
- Using a Microsoft Visual Basic script
Netdom.exeFor each member, there is a discrete communication channel (the security channel) with a domain controller. The security channel is used by the Netlogon service on the member and on the domain controller to communicate. Netdom makes it possible to reset the security channel of the member. You can reset the member security channel by using the following command:
Suppose you have a domain member named DOMAINMEMBER in a domain called MYDOMAIN. You can reset the member security channel by using the following command:
Nltest.exeNltest.exe can be used to test the trust relationship between a computer running Windows 2000 or Windows XP that is a member of a domain and a domain controller on which its machine account resides.
Usage: nltest [/OPTIONS]
/SC_QUERY:DomainName - Query security channel for domain on ServerName
/SC_VERIFY:DomainName - Verifies the security channel in the specified domain for a local or remote workstation, server, or domain controller.
Flags: 30 HAS_IP HAS_TIMESERV
Trusted DC Name \\server.windows2000.com
Trusted DC Connection Status Status = 0 0x0 NERR_Success
The command completed successfully
Active Directory Users and Computers (DSA)With Windows 2000 or Windows XP, you can also reset the machine account from within the graphical user interface (GUI). In the Active Directory Users and Computers MMC (DSA), you can right-click the computer object in the Computers or appropriate container and then click Reset Account. This resets the machine account. Resetting the password for domain controllers using this method is not allowed. Resetting a computer account breaks that computer's connection to the domain and requires it to rejoin the domain.
Note This will prevent an established computer from connecting to the domain and should only be used for a computer that has just been rebuilt.
Microsoft Visual Basic ScriptYou can use a script to reset the machine account. You need to connect to the computer account using the IADsUser interface. You can then use the SetPassword method to set the password to an initial value. The initial password of a computer is always "computername$".
The following sample scripts may not work in all environments and should be tested before implementation. The first example is for Windows NT 4.0 computer accounts and the second is for Windows 2000 or Windows XP computer accounts.
Set objComputer = GetObject("WinNT://WINDOWS2000/computername$")
Set objComputer = GetObject("LDAP://CN=computername,DC=WINDOWS2000,DC=COM")
Artikel-id: 216393 - Laatst bijgewerkt: 12 jun. 2007 - Revisie: 1