This rather imposing message is found if you try to force replication between to Active Directory Domain Controllers when one of the controllers machine account password is out of sync with the password as stored on the other domain controller.
I have seen this a number of times on Virtual PC or Virtual Server Active Directory deployments with more than one DC in the virtual environment.
So, how do you fix it:
- On the DC that is broken (the one that when using replmon reports the error above) set the Kerberos Key Distribution Center Service to manual and stop the service.
- From a command prompt on the broken DC enter the following:
netdom resetpwd /s:name_of_working_DC /ud:domain\user /pd:*
where domain\user is an administrator of the domain in the domain_name\user_name format. You will be prompted to enter your password. - Upon pressing Enter, if the command fails then restart the broken DC and repeat the above command (this restart clears the Kerberos ticket cache and so clears the broken credential attempts that it has stored).
- Upon successful completion of the command in step 2 restart the broken DC. You must do this even if done already in step 3.
- Check that replication is working, and if so restart the Kerberos Key Distribution Center Service and set the service back to automatic.
This is a summary of Microsoft Knowledgebase Article 325850, with some more specific detail mentioned.
Labels: 2003, 2007, active directory, error, exchange, kerberos, virtual pc, virtual server
permalink posted by Brian Reid : 4:06 PM
0 comments 
Archive
March 2005
July 2005
February 2006
May 2006
November 2006
March 2007
May 2007
June 2007
August 2007
April 2008
May 2008
June 2008
September 2008
October 2008
November 2008
January 2009
February 2009
March 2009
April 2009
May 2009
June 2009
July 2009