Authentication Failure

Hello Everyone,

I am having a serious problems since last 20 days on my network i have windows 2000 adv server domain controller with DNS and exchange 2000 on the same, some users can log on to domain without any problem some users cannot log onto domain the message is something like this "Windows cannot find domain or cannot log onto domain" everytime i have to remove the computer from domain and rejoin it again its really painfull and time consuming and as soon as the user shutoff the system again the same problem occurs can anyone advise me. Ur urgent action in this regard is highly appreciated
NOte : I have tried this solution given by microsoft but all in vain
Windows XP
In Microsoft Windows XP and later versions, machine account password settings can also be configured by using Group Policy Editor (Gpedit.msc). To configure these settings, follow these steps:
1.      Click Start, click Run, type Gpedit.msc, and then press ENTER.
2.      Expand Local Computer Policy, expand Windows Settings, expand Security Settings, expand Local Policies, expand Security Settings, expand Local Policies, and then expand Security Options.
3.      Configure the following settings:
•      Domain Member: Disable machine account password changes (DisablePasswordChange)
•      Domain Member: Maximum machine account password age (MaximumPasswordAge)
•      Domain Controller: Refuse machine account password changes (RefusePasswordChange)

I had problem with my PDC Emulator and i restored the image from Acronis since then this problems starts and i am having tough time these days pls can someone help me out
Who is Participating?

Improve company productivity with a Business Account.Sign Up

oBdAConnect With a Mentor Commented:
Check here:
How to Change the Recovery Console Administrator Password on a Domain Controller
Is/was this your only DC, or do you have another one?
Rick HobbsRETIREDCommented:
Are you running in mixed mode?
senddiamondsAuthor Commented:
No we have Additional Domain Controller its also giving me the same problems, yeah we are running servers in mixed mode. I have restored my Global Catalog with acronis image since then this problems started
You are in rather deep trouble here. You can NOT use imaging software to backup domain controllers, at least not if you have more than one.
What you're experiencing currently is a USN rollback, and your DCs now don't replicate anymore.
The only way to recover from this in Windows 2000 is to uninstall Exchange (demoting the machine with Exchange on it will break Exchange), demote the machine you restored, clean out the metadata, then repromote the machine again.

How to detect and recover from a USN rollback in Windows 2000 Server

How to remove data in Active Directory after an unsuccessful domain controller demotion

Exchange Server 2003 and Domain Controllers - A Summary

senddiamondsAuthor Commented:
I am sorry to say that but we dont have Active Directory Restore Password can u help me in this do let me know, i highly appreciate ur answer and it did help me out but the problem is i dont have ads restore password
senddiamondsAuthor Commented:
is their a way to copy active directory users and password into a text file or access database and add it to a new domain
With the ADMT; but since the ADMT requires a trust between the two domains, you're likely to run into problems if you don't get your current domain fixed.
There shouldn't be a need to rebuild your domain, though; you "only" need to fix the broken DC.

Active Directory Migration Tool v3.0
senddiamondsAuthor Commented:
My existing domain controller is PIII 700 Mhz and their is no connection between my existing Glocal catalog and Additional Domain Controller i cant see my global catalogue from my ADC and other scenario is DNS is working fine on Glocal Catalogue and authentication of users are working fine on my ADC i am really worried company have purchased new Xeon Servers 3.8 Ghz and we are planning to implement 2003 and pls tell me friend is it possible to take emails from my exisiting Exchange server which is intalled on my primary domain controller which is also a global catalogue and its installed on D drive and ADS is on C drive, please i am very much confused with this scenario the ADS schema in Glocal catalogue is different and on ADC is different

Thanks in advance
send diamonds
You can move the Exchange server, but that's a question for the Exchange TA.
The first thing you need to do is to fix your AD as described in the article. You won't be able to do a clean migration to the new hardware if your AD is broken.
There's one more article that might be helpful; you'll probably have to seize the roles the primary DC held when you demote it, as I doubt that a proper move is possible.
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

If you can't uninstall Exchange to depromote the primary DC, the only other option that could work (absolutely no guarantee here!), if the other DC isn't running any other major services, is the following:
Backup your current Exchange database.
Depromote your second DC (you'll probably have to use /forceremoval) and shut it down. If the depromote doesn't work, reinstall the OS.
Restore the primary DC's image again. Clean out your AD from the second DC (which you depromoted) using the article above, seize any FSMO roles the secondary DC might have held.
Restore Exchange.
Fix any errors resulting from changed passwords, added/deleted accounts, changed group membership, and whatever else happened after the first restore.
Promote the second DC again.

At this point, it might be worth it to open a support call with Microsoft.
senddiamondsAuthor Commented:
thanks for your answer and ur help god bless u i will rty and lety you know
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.