NT4 Backup Domain Controller Trust Failure

Posted on 1999-01-01
Last Modified: 2013-12-28
We built 40 NT4 (SP4) backup domain controllers and then downed them for 30 plus days, when we tried to bring them back up into the domain they were built in they would not come back up as working backup domain controllers, complaining that the trust was broken.

Is there a period after which they will be unable to join the domain and more importantly is there a way to bypass this problem and get them back up and running correctly in the domain.
Question by:eetris

Accepted Solution

livni earned 150 total points
ID: 1796712

After a Windows NT backup domain controller (BDC) has been offline for some time, it may fall out of synchronization with the primary domain controller (PDC). When you attempt to bring the BDC back online, you may get the following errors in the BDC's Event Viewer:

   Event ID: 3210
   Source: Netlogon
   Type: Error
   Description: Failed to authenticate with <computer name>, a Windows NT
   domain controller for domain <domain name>.
   Data word: c0000022

   Event ID: 7023
   Source: Service Control Manager
   Type: Error
   Description: Netlogon service terminated with the following error
   message: Access Denied.

This is very likely to occur if a BDC is restored from a backup that is more than a few days old or if the BDC is offline for more than a few days.


Domain controllers maintain a password-protected channel between each other. When a BDC is brought into a domain, the PDC gives the BDC the current password to use when connecting to the PDC for authentication, account database replication, and other system activities. This password changes automatically on a regular basis. If the BDC is offline when the password changes, or if a BDC is restored from a backup that has an old password, the BDC will not be able to authenticate with the PDC, and Netlogon will fail.


In the simplest case, all that has happened is that the domain password has changed. To reslove the problem, do the following:

1.Start the BDC, and open Server Manager

2.Select the BDC's name, and select Synchronize with Primary Domain Controller.

If this procedure is successful, you will get a message that the LSA Database has been updated and Netlogon will start automatically. No other action is necessary.

However, if synchronizing with the PDC does not work on the first attempt, try carrying out the same command again. Often, a second attempt will succeed. However, if the BDC will not synchronize and Netlogon fails to start after three attempts, you should create a new machine account for the BDC. These instructions are taken from a related article, Q137987:

1.Using Server Manager, create a new computer name.

2.Synchronize entire domain (check another BDC's event viewer to see if it synchronized).

3.At the problem BDC, use the Network tool in Control Panel to change the name to the new name created in Step 1.

4.Shut down the BDC, restart, and log on to Windows NT. Note any error messages. You must logon to the domain the BDC belongs to, not a trusted domain.

5.Using Server Manager, synchronize the entire domain.

6.From the PDC, delete the old computer name(use Server Manager).

7.Synchronize the entire domain, using Server Manager.

8.Make sure the old BDC name has been deleted in Server Manager before proceeding.

9.After the old BDC name is gone from Server Manager, re-create it.

10.Synchronize the entire domain, using Server Manager.

11.At the problem BDC, change computer name to the old name created in step 9, using the Network tool in Control Panel.

12.Shut down the BDC, restart, and log on to the domain. Note any error messages.

13.Synchronize entire domain.

At this point the BDC should be synchronized with the PDC, netlogon should be running, and the accounts database should be up to date.

Related Articles:

For additional information on authentication issues specific to NWLink, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q126752
   TITLE     : DCs Fail to Synchronize or Validate Users Over NWLINK

For additional information on authentication issues when trying to net view, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q137987
   TITLE     : NET VIEW May Cause Semaphore Time Out and Event ID 3210

For additional information on authentication from the PDC's point of view, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q142869
   TITLE     : Event ID 3210 & 3722 Appear When Synchronizing Entire

Expert Comment

ID: 1796713
The default is for the PDC to change the trust password every seven days.

Author Comment

ID: 1796714
Thanks lots for your very timely reply!!

Apparently we also found out today (this was my first day back to try your proposed solution which in retrospect seems so obvious=) there is also a dos based reskit utility for resetting the password called netdom.exe, whether this is effective or not remains to be seen.

Finally (Carmine - thanks for replying also) we were aware of the 7 day reset, just not the disabling feature, which in itself is pretty awful, and somewhat worrying when first encountered, especially with 40 boxes all showing the same sympton <shudder>.

Tris Long


Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Update 11/3/2014 - Although the below article will get you to relocate the WINSXS folder, Microsoft has finally released a utility to reduce the size of the WINSXS folder. For some reason, it's not that straightforward. It only works on Windows 2008…
If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

943 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now