Resetting Domain Member Secure Channel

• Microsoft Windows NT Workstation version 4.0
• Microsoft Windows NT Server version 4.0

SYMPTOMS

The domain member Netlogon service may log error 3210 or 5721, but the Netlogon service logs error 5722 in the system event log of the domain controller.

You may also receive the following logon message when you attempt to log on to your Windows NT domain from a computer running Windows NT Workstation or Windows NT Server that is a member of the domain:

   The system cannot log you on to this domain because the system's
   computer account in its primary domain is missing or the password on
   that account is incorrect.

• The name of the domain member was recently changed.
• The Emergency Repair Disk was used, but it contained old information.
• The domain member computer account was removed.

RESOLUTION

CAUTION: The solution included in this article has not been extensively tested in large installations. Microsoft cannot guarantee that modification of domains as recommended herein will accomplish the objective described in this article under all circumstances and in all configurations.

For each member, there is a discrete communication channel (that is, the secure channel) with a domain controller. The secure channel is used by the Netlogon service on the member and on the domain controller to communicate. The NETDOM command line utility makes it possible to reset the secure channel of the member.

Suppose you have a domain member named DOMAINMEMBER. You can reset the member secure channel by using the following command:

   NETDOM MEMBER \\DOMAINMEMBER /JOINDOMAIN

The output received from the command should be similar to the following:

   Searching PDC for domain DOMAIN ...
   Found PDC \\DOMAINPDC
   Querying domain information on PDC \\DOMAINPDC ...
   Querying domain information on computer \\DOMAINMEMBER ...
   Computer \\DOMAINMEMBER is already a member of domain DOMAIN.
   Verifying secure channel on \\DOMAINMEMBER ...
   Verifying the computer account on the PDC \\DOMAINPDC ...
   Resetting secure channel ...
   Changing computer account on PDC \\DOMAINPDC ...
   Stopping service NETLOGON on \\DOMAINMEMBER .... stopped.
   Starting service NETLOGON on \\DOMAINMEMBER .... started.
   Querying user groups of \\DOMAINMEMBER ...
   Adding DOMAIN domain groups on \\DOMAINMEMBER ...

   The computer \\DOMAINMEMBER joined the domain DOMAIN successfully.

   Logoff/Logon \\DOMAINMEMBER to take modifications into effect.

MORE INFORMATION

Assume you have the following configuration:

   Domain = DOMAIN
   DC     = DOMAINDC (domain controller)
   MEMBER = DOMAINMEMBER

Each member maintains such an LSA secret, which is used by the Netlogon service to establish a secure channel. If, for some reason, the computer account's password and the LSA secret are not synchronized, the Netlogon service logs the following error:

   NETLOGON Event ID 3210:

   Failed to authenticate with \\DOMAINDC, a Windows NT domain controller
   for domain DOMAIN.

   NETLOGON Event ID 5721:

   The session setup to the Windows NT Domain Controller <Unknown> for the
   domain DOMAIN failed because the Windows NT Domain Controller does not
   have an account for the computer DOMAINMEMBER.

   NETLOGON Event 5722

   The session setup from the computer DOMAINMEMBER failed to authenticate.
   The name of the account referenced in the security database is
   DOMAINMEMBER$. The following error occurred: Access is denied.

For more information about secure channels, see the following articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q131366
   TITLE     : Event Error 5712 with Status Access Denied

   ARTICLE-ID: Q142869
   TITLE     : Event ID 3210 and 5722 Appear When Synchronizing Entire
               Domain

   ARTICLE-ID: Q149664
   TITLE     : Verifying Domain Netlogon Synchronization

   ARTICLE-ID: Q158148
   TITLE     : Domain Secure Channel Utility -- Nltest.exe