Member Avatar for nuttyprofessor

I was trying to investigate the following error from one of our xp users, after running the netdiag test, i found ou that he was passing everything except:the trust relationship test. (Secure channel for domain was failing)

To combat that I started to use the netdom utility to reset that channel:
netdom reset computer.domain /domain:domainname /Server:dc-name /UserO:Administrator /PasswordO:passwordhere

the problem is first it would just say: access is denied, now it says,
Logon Failure: The target account name is incorrect.

My Domain controller is Windows 2008, client xp. Other clients are running ok.
But because of this error I can't apply group polices, or anything. DNS, IP, all are checked and working fine. I am not running NetBIOS on the domain controller.

If anyone can help me secure this channel with the domain controller it would be great

thanks

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1053
Date: 7/30/2009
Time: 12:35:57 PM
User: NT AUTHORITY\SYSTEM
Computer: gbproberts

Description:
Windows cannot determine the user or computer name. (Access is denied. ). Group Policy processing aborted.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

  • 1 Contributor
  • 1 Reply
  • 479 Views
  • 23 Hours Discussion Span
  • Latest Post Latest Post by nuttyprofessor

Dani AI

Generated

— This is a classic secure-channel / Kerberos symptom (Windows error 1396 / "target account name is incorrect") rather than a pure DNS/IP problem. Common root causes are: the machine account password on the client or a DC is out of sync, an SPN is registered to the wrong object (or duplicated), or replication/tombstone/restore issues on a DC. These conditions will produce Kerberos failures (KRB_AP_ERR_MODIFIED) and the same "target account name is incorrect" text. (learn.microsoft.com)

Checklist to run now (start simple, then move to DC-side checks):

Run secure-channel and Kerberos diagnostics on the client and a DC:

nltest /sc_query:yourdomain
klist                 (to view/purge Kerberos tickets)

If nltest shows a bad secure channel or access denied, the channel or machine password needs repair. (learn.microsoft.com)

Check for SPN or CNAME issues (these cause KRB_AP_ERR_MODIFIED):

setspn -X             (search for duplicate SPNs)
setspn -L targetname  (list SPNs for a specific account)

If the service is being accessed via a CNAME/alias, follow Microsoft guidance (avoid plain CNAMEs for SMB; use netdom computername or create proper SPNs). (learn.microsoft.com)

If the secure channel / machine password is the issue, reset the machine account from a DC (or use a DC-side reset for DCs). Example (run on a DC or via RSAT): 

netdom resetpwd /server:YourDC /userd:Domain\Admin /passwordd:*

If that completes, reboot the client and re-check. If it fails, reset the computer account in ADUC and rejoin the domain, but be cautious with domain controllers — follow MS guidance for DCs and replication first. (learn.microsoft.com)

If those checks are done and the error remains, collect: nltest output, System and Security event logs (look for KRB_AP_ERR_MODIFIED / Event ID 4), and REPADMIN/ DCDIAG output and post them — they point exactly to missing/duplicated SPNs or replication/krbtgt problems. (learn.microsoft.com)

Member Avatar for nuttyprofessor

Any suggestions??

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.