Solved

Windows 7, passwords changes error with DC

Posted on 2010-08-24
8
299 Views
Last Modified: 2012-06-21
Hi dear,

We actually encouter a strange problem with our WIndows 7 clients.

We have a 2003 domain, with only one forest, we have added a 2008 R2 domain controller a few days ago, everything works well.

Today, when we try to modify users passwords, we recieve the following message : "The security database on the server does not have a computer account for this workstation trust relationship", it appears only on Windows 7 clients.

I've found some solutions (this one for example, http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23258126.html) but they doesn't work.

Microsoft give us some solution too (http://technet.microsoft.com/en-us/library/ee849847(WS.10).aspx)
but with no resluts too.

Any idea ?

Thanks
0
Comment
Question by:CIAD
  • 4
  • 3
8 Comments
 
LVL 1

Expert Comment

by:saimirka
ID: 33508843
I think the pc has lost its computer account from the dc try removing and rejoining the pc to the domain.
0
 
LVL 9

Expert Comment

by:Chev_PCN
ID: 33508848
The MS article seems to be around joining PCs to a domain, rather than PWD changes.
2 suggestions:
What is your domain functional level? If it's still @ 2000 level then you need to raise it anyway.
Check your policies - your LanMan authentication policy may be having some effect.

LanMan.jpg
0
 
LVL 9

Expert Comment

by:Chev_PCN
ID: 33508866
Check your domain suffix policies, esp in DHCP.
This article indicates that it has solved the problem:
http://social.technet.microsoft.com/Forums/en-US/itprovistasp/thread/31905c1a-5c25-4426-ac8d-677004c21f5d

A more labour-intensive suggestion from other forums is to disjoin the machine from the domain and re-join it again.
0
 

Author Comment

by:CIAD
ID: 33508933
Our domain is 2003 full, no 2000. We have controlled the DHCP and the suffix policies, everything is in order !

When we stop de 2008R2 controller, it works and our Win 7 clients could change their passwords and logon correctly direct after, so it seems that the 2008 DC is the source of the problem.

This event could be linked with our problem ?

"The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate,  Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that  are performed on a cleartext (non-SSL/TLS-encrypted) connection.  Even if no clients are using such binds, configuring the server to reject them will improve the security of this server."

Thanks for our answers
0
[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

 
LVL 9

Accepted Solution

by:
Chev_PCN earned 250 total points
ID: 33508988
Hi CIAD.
Please have a look at my earlier comment regarding NTLM.
On both the server and clients, try changing the setting to:
"Use LM and NTLM - use NTLM v2 session security if negotiated."
0
 

Author Comment

by:CIAD
ID: 33510160
So we try to change Local security settings to "Use LM and NTLM - use NTLM v2 session security if negotiated." on both DC and client but nothing change...

I continue my investigations
0
 

Author Comment

by:CIAD
ID: 33699597
Problem solved, some bad replications between the DCs, everything's work now
0
 

Author Closing Comment

by:CIAD
ID: 33699601
Help us to find problem
0

Featured Post

[Webinar] Disaster Recovery and Cloud Management

Learn from Unigma and CloudBerry industry veterans which providers are best for certain use cases and how to lower cloud costs, how to grow your Managed Services practice in IaaS clouds, and how to utilize public cloud for Disaster Recovery

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

By default the complete memory dump option is disabled in windows . If we want to enable the complete memory dump for a diagnostic purpose, we have a solution for it. here we are using the registry method to enable this.
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

25 Experts available now in Live!

Get 1:1 Help Now