Kerberos event id 7 + netlogon event id 5719 errors, domain workstation unable to log on

Hi all,

Recently I've had several workstations come up with these event error logs (in chronological order):

Event Type:      Error
Event Source:      NETLOGON
Event Category:      None
Event ID:      5719
Date:            5/14/2009
Time:            11:19:50 AM
User:            N/A
Computer:      ABBOTT-MAIN
Description:
No Domain Controller is available for domain ABBOTT due to the following:
The RPC server is unavailable. .
Make sure that the computer is connected to the network and try again. If the problem persists, please contact your domain administrator.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 17 00 02 c0               ...    

Event Type:      Error
Event Source:      Kerberos
Event Category:      None
Event ID:      7
Date:            5/14/2009
Time:            11:47:06 AM
User:            N/A
Computer:      ABBOTT-MAIN
Description:
The kerberos subsystem encountered a PAC verification failure.  This indicates that the PAC from the client ABBOTT-MAIN$ in realm ABBOTT.LOCAL had a PAC which failed to verify or was modified.  Contact your system administrator.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 5e 00 00 c0               ^..  


I've read a few other topics and have tried re-syncing w32time to make sure all the clocks match, but I'm out of ideas at this point. The one workstation can't even log in, but if I check the system logs off of the domain (where it's able to log on) I don't see any errors when its trying to log on. On other workstations that are already logged in (and I don't dare log them out) i see those two errors in the system log. Also, I don't happen to see anything awry on the SBS 2003 server system logs either.

Any help would be greatly appreciated!

--Hans
dyndragon91Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
PlusITConnect With a Mentor Commented:
for the workstations that are failing to login to the domain:

- join the wks back into a workgroup
- delete the AD computer account manually from the AD
- wait 10 to 15 minutes
- rejoin the computer, if the problem restarts let me know.  
0
 
dyndragon91Author Commented:
I am concerned about doing this. Do I need to re-add the computer via the /connectcomputer/ wizard to retain all the SBS features and scripts? I don't think I do, but I just wanted to double check.
0
 
PlusITConnect With a Mentor Commented:
Hey,

yes you do retain those as they are linked to the user account not the computer account.  After rejoining into the domain logging in with the domain user will even have preserved the profile.  I have seen similar problems like yours and rejoining the domain after manually deleting the computer account (NOT the user account!) mostly fixes these kind of issues.  Just make sure you wait long enough after manually deleting the computer account.  I wouldn't use connect computer though just do it from the properties screen of My Computer

Good luck!
0
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

 
dyndragon91Author Commented:
I will give this a shot and report back. I'm not at this site for a day or two.
0
 
dyndragon91Author Commented:
Odd thing. Now I plug in the workstation that couldn't log in before and it works with no problems. ????! I'm dreading rootcausing this. What might cause these issues?
0
 
PlusITConnect With a Mentor Commented:
check DNS settings, are you still using WINS?  Inconsitency between WINS and DNS information can cause this also.  I suggest you don't use WINS anymore and completely rely on DNS.

again there's a lot that could be going on still, from general physical network trouble to kerberos tickiting failing.  I would have a look at WINS / DNS first.  The first solution i gave always works when your PC can't logon to the domain, but when it sometimes can i'm thinking further like Wins, kerberos or plain old date and time being set wrong.

Did you acctually double check after testing with w32time your computer and bios time was set correctly before logging in ?
0
 
dyndragon91Author Commented:
This is a one PDC domain, so even if I was using WINS and DNS, there's only one domain server to resolve to and it's set to be a static IP address. In any case, I'm not using WINS as far as I know.

I did actually double check to make sure the bios time was set correctly. I know that you can get auth failures if the time is off, so that was the first thing I checked. I'm starting to think that one of the network switches might be on the fritz.

Still investigating...thanks for the tips.

0
 
PlusITConnect With a Mentor Commented:
to make sure your client is not using WINS do an ipconfig /all on the client and check for WINS entries.
0
 
dyndragon91Author Commented:
Good troubleshooting steps and it worked.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.