Event ID 1054 Windows Cannot Obtain the Domain Controller - TS session goes inactive

I have an Windows 2003 X64 SP2 DC that occasioanlly throws this event. I have been chasing it for quite sometime.
I have eliminated most of the things people often associate with this error. It passes DC Diag clean. There is no problem with DNS. What I have discovered recently is that it is in fact related to  a terminal services session becoming/going inactive. (Without giving too much detail I have various debugging enabled and have been running netmon captures.)

However the RDP session is encrypted to it is difficult to actually determine exactly what is causing the error.
It is harmless but annoying.  Has anybody tracked 1054 down to this cause, any ideas as what might
be happening?  I know this error has been linked to various network errors as well, but I am reasonably
confident that it is not these as I would see some sort of error in the network captures.
LVL 1
neiljavaAsked:
Who is Participating?
 
neiljavaConnect With a Mentor Author Commented:
Whew- , Ok I think I might have finally tracked this down. It looks like the cause is an attempt by the TS client (a x64 Vista machine in this case) to get a Kerberos Ticket request as follows:

Kerberos: TGS Request Realm: THETESTPLACE.INTERNAL Sname: TermServLicensing
(My domain is THETESTPLACE.INTERNAL)

The Sname TermServLicensing, a.k.a Server Principal does not exist. So this causes the error.
Should a SPN of this name exist, I do not know the answer to that one.

In any case at a server level it was cured by selecting a certificate in the TS configuration on the RDP-tcp connection. I do not know why the connection had lost its certicate in any case selecting
the available certificate seems to have cured the problem. The TS client no longer makes a Kerberos
Ticket Request.

0
 
Netman66Commented:
What make/model server is this?  What NIC(s) are installed?
0
 
neiljavaAuthor Commented:
I have been round the various suggestions that it is Gigabit relayed issue and have a AMD patch
for realted network issues.

Network Card(s):           1 NIC(s) Installed.
                           [01]: Broadcom NetXtreme 57xx Gigabit Controller
                                 Connection Name: Local Area Connection
                                 DHCP Enabled:    No
                                 IP address(es)
                                 [01]: 192.168.0.8


Host Name:                 DRC
OS Name:                   Microsoft(R) Windows(R) Server 2003 Standard x64 Edition
OS Version:                5.2.3790 Service Pack 2 Build 3790
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Primary Domain Controller
OS Build Type:             Multiprocessor Free
Original Install Date:     05/09/2007, 03:15:19
System Up Time:            4 Days, 4 Hours, 7 Minutes, 57 Seconds
System Manufacturer:       Dell Inc
System Model:              OptiPlex 740
System Type:               x64-based PC
Processor(s):              2 Processor(s) Installed.
                           [01]: AMD64 Family 15 Model 67 Stepping 2 AuthenticAMD ~2605 Mhz
                           [02]: AMD64 Family 15 Model 67 Stepping 2 AuthenticAMD ~2606 Mhz
Total Physical Memory:     8,126 MB
Available Physical Memory: 6,183 MB
Page File: Max Size:       9,744 MB
Page File: Available:      8,426 MB
Page File: In Use:         1,318 MB
Page File Location(s):     C:\pagefile.sys
Domain:                    thetestplace.internal
Logon Server:              \\DRC
Hotfix(s):                 123 Hotfix(s) Installed.
                           [01]: File 1
                           [02]: File 1
                           [03]: File 1
                           [04]: File 1
                           [05]: File 1
                           [06]: File 1
                           [07]: File 1
                           [08]: File 1
                           [09]: File 1
                           [10]: File 1
                           [11]: File 1
                           [12]: File 1
                           [13]: File 1
                           [14]: File 1
                           [15]: File 1
                           [16]: File 1
                           [17]: File 1
                           [18]: File 1
                           [19]: File 1
                           [20]: File 1
                           [21]: File 1
                           [22]: File 1
                           [23]: File 1
                           [24]: File 1
                           [25]: File 1
                           [26]: File 1
                           [27]: File 1
                           [28]: File 1
                           [29]: File 1
                           [30]: File 1
                           [31]: File 1
                           [32]: File 1
                           [33]: File 1
                           [34]: File 1
                           [35]: File 1
                           [36]: File 1
                           [37]: File 1
                           [38]: File 1
                           [39]: File 1
                           [40]: File 1
                           [41]: File 1
                           [42]: File 1
                           [43]: File 1
                           [44]: File 1
                           [45]: File 1
                           [46]: File 1
                           [47]: File 1
                           [48]: File 1
                           [49]: File 1
                           [50]: File 1
                           [51]: File 1
                           [52]: File 1
                           [53]: File 1
                           [54]: File 1
                           [55]: File 1
                           [56]: File 1
                           [57]: File 1
                           [58]: File 1
                           [59]: Q147222
                           [60]: SP1 - SP
                           [61]: IDNMitigationAPIs - Update
                           [62]: NLSDownlevelMapping - Update
                           [63]: KB925398_WMP64
                           [64]: KB938127-IE7 - Update
                           [65]: KB942615-IE7 - Update
                           [66]: KB947864-IE7 - Update
                           [67]: KB956390-IE7 - Update
                           [68]: KB914961 - Service Pack
                           [69]: KB921503 - Update
                           [70]: KB924667-v2 - Update
                           [71]: KB925902 - Update
                           [72]: KB926122 - Update
                           [73]: KB927891 - Update
                           [74]: KB929123 - Update
                           [75]: KB930178 - Update
                           [76]: KB932168 - Update
                           [77]: KB932596 - Update
                           [78]: KB933360 - Update
                           [79]: KB933729 - Update
                           [80]: KB935839 - Update
                           [81]: KB935840 - Update
                           [82]: KB935966 - Update
                           [83]: KB936021 - Update
                           [84]: KB936782 - Update
                           [85]: KB937143 - Update
                           [86]: KB938127 - Update
                           [87]: KB938464 - Update
                           [88]: KB939653 - Update
                           [89]: KB941202 - Update
                           [90]: KB941568 - Update
                           [91]: KB941569 - Update
                           [92]: KB941644 - Update
                           [93]: KB941672 - Update
                           [94]: KB941693 - Update
                           [95]: KB942615 - Update
                           [96]: KB942763 - Update
                           [97]: KB942840 - Update
                           [98]: KB943055 - Update
                           [99]: KB943460 - Update
                           [100]: KB943484 - Update
                           [101]: KB943485 - Update
                           [102]: KB944653 - Update
                           [103]: KB945553 - Update
                           [104]: KB946026 - Update
                           [105]: KB948496 - Update
                           [106]: KB948590 - Update
                           [107]: KB948881 - Update
                           [108]: KB949014 - Update
                           [109]: KB950762 - Update
                           [110]: KB950974 - Update
                           [111]: KB951066 - Update
                           [112]: KB951072-v2 - Update
                           [113]: KB951698 - Update
                           [114]: KB951746 - Update
                           [115]: KB951748 - Update
                           [116]: KB952954 - Update
                           [117]: KB954211 - Update
                           [118]: KB956391 - Update
                           [119]: KB956803 - Update
                           [120]: KB956841 - Update
                           [121]: KB957095 - Update
                           [122]: KB958644 - Update
                           [123]: XpsEPSC
0
Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

 
neiljavaAuthor Commented:
I should have added that now that I have figured out that it is caused by the TS session  I reckon I can reasonably discount NIC issues since if there are no active TS sessions I do not get the error.
0
 
Netman66Commented:
You're running this on a workstation rather than a server, so there are other things that may come into play such as low level devices like the TPM.

Regardless, try disabling Media Sense on the NIC if it's running GB.

http://support.microsoft.com/kb/326152

http://support.microsoft.com/kb/239924
0
 
Netman66Commented:
That would do it, yes.

Was the server renamed after TS was installed?
0
 
neiljavaAuthor Commented:
No it has been the same name since the original install 05/09/2007 according to the system.
I do not know if TermServLicensing  as an SPN existed prior to 2003 server but it certainly does not
exist on any of my 2003 or 2008 servers.
Damn odd and has been bugging me for months that error
0
 
neiljavaAuthor Commented:
BTW thanks for the pointers on the NIC, but I had chased that particular route previously. It was when it became clear that it was a TS issue and that I could reproduce it by leaving a TS connection to go inactive.
Prior to that, I had nothing at all that had even hinted that it was caused by a TS connection.  Once I had that information Netmon 3.2 helped. When I had tried to trace this error previously the NIC did seem where everything pointed, but you would expect to see some sort of TCP checksum error of some sort in Netmon or Wireshark if the nic was to blame. The other thing was that there was basically no other connectivity problem. In the end it was just the event id error was misleading, if it had said SPN not found or some such thing it might have given some sort of lead. Of course the error was really a client TS not finding an SPN not the server which made it a kind of double whammy misleading message.
0
 
Netman66Commented:
Agreed.  The error messages in 2003 are not as descriptive as they are in 2008.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.