Skip to main content

What is the error message when a disable computer tries to log in?

In our test environment, we determined that the user was able to log on and access network recourses. We discovered that the computer was not able to authenticate itself and therefore was not able to take advantage of active directory. For example, we were not able to to update the computer portion of group policy

Another problem is that if the user did not have a cached profile on the client, the user will recieve the following error at login:

The trust relationship between this workstation and the primary domain failed.

Once logged in with a user account that had cached credentials (or a local account) an examination of the System log revealed

Level: Error

Source: NETLOGON

Event ID: 5721

Description:

The Session setup in Windows NT or Windows 2000 Domain Controller %\\Server\domain% for the domain %domain% failed because the Domain Controller did not have an account %Client% needed to set up the session by this computer %Client%.

ADDITIONAL DATA

If this computer is a member of or a Domain Controller in the specified domain, the aforementioned account is a copmuter account for this computer in the specified domain. Otherwise, the account is an interdomain trust account with the specified domain.

Level: Warning

Source: Time-Service

Event ID: 130

Description:

NtpClient was unable to set a domain peer to use as a time source because of failure in establishing a trust relationship between this copmuter and the '%domain%' domain in order to securely sycronize time. NtpClient will try again in 15 minutes and double the reattempted interval therafter. The error was: then trust relationship between this workstation and the primary domain failed. (0x800706FD)

Level: Error

Source: GroupPolicy

Event ID: 1129

Description:

The processing fo Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connect to the domain controller and Group Policy has succesfully processed. if you do not see a secure message for several hours, then contact your administrator.

Comments

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.