Solved

Netlogon Error - 5722

Posted on 2011-02-23
7
1,391 Views
Last Modified: 2012-08-13
On the Windows 2003 Server (Domain Controller), I saw a few of these errors from the system event logs.

"The session setup from the computer TLAILD108 failed to authenticate. The name of the account referenced in the security database is TLAILD108$. The following error occured: Access is Denied."

EventID.net says:
EventID.Net
The NetLogon service on the PDC logs this error message when the password is not synchronized between the computer and PDC. This is a common problem. When a workstation joins the domain, a trust is created with the PDC along with a secured channel password on both machines.  This password, by default, automatically changes every seven days. If for some reason the process of password change fails, this error will be generated. One may have to reset the machine account password (can be done with the NETDOM utility  - from NT Resource Kit or for Windows 2000 from the Support Tools ). The password change is initiated by the workstation

Honestly, I don't understand this. I need help with this. How do I resolve this error from taking place.

It says to reset the machine account password. How do you do this? How do I know which user's password needs to be reset? The workstation is TLAILD108 and a few users may use this PC to log on to the Domain.

Attached is a screen capture of the error. Netlogon Error - 5722
0
Comment
Question by:ben1211
7 Comments
 
LVL 76

Assisted Solution

by:arnold
arnold earned 333 total points
ID: 34967151
The short example is you have a policy that the computer password expires after 30 days. If the computer was off for 31 days, the credentials it has are no valid.
you can use netdom to reset the computer account on the TLAILD108.
http://support.microsoft.com/kb/260575

rejoining the TLAILD108 system into the domain will correct this problem.  Double check that you do not have a GPO that expires the password in a time where a workstation is off.
0
 
LVL 11

Accepted Solution

by:
yelbaglf earned 167 total points
ID: 34967168
This error occurs when the computer account's password isn't synchronized.  You can reset the secure channel by running this command as domain admin on the problem computer [TLAILD108].

From an elevated cmd prompt:

netdom member \\TLAILD108 /joindomain

Here's the relevant KB:
http://support.microsoft.com/kb/175024
0
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 34967813
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 

Author Comment

by:ben1211
ID: 35069215
arnold, what do you mean by "you can use netdom to reset the computer account on the TLAILD108". I don't understand this.

How do I check if I have a GPO that expires the password when a workstation is off?

Why do I need to run this command? netdom member \\TLAILD108 /joindomain

Why do I need to get that computer to re-join the domain?
0
 
LVL 76

Expert Comment

by:arnold
ID: 35071254
Using GPMC run a group Policy results wizard and look: From the links below along with MS article
http://forums.techarena.in/active-directory/942467.htm
http://support.microsoft.com/default.aspx?scid=kb;en-us;q175468

Computer configuration\windows settings\security settings\local policies\security options\
Look for the "Domain member: maximum machine account password age"
is it set to anything 30,60,90 days? This would also tell you which GPO sets this parameter.
This setting is what forces the workstations,member server to generate a new machine password on the set schedule.  If the system is off the network in excess of the set amount, the machine password the system has will be "expired" and the connection to the DC will not be made.

One option is to run the netdom /resetpassword and since the domain admin credentials are provided the new password will be accepted by the DC.
The joindomain is in a way the same thing. i.e. the system will reregister with the DC and exchange the machine account password.

0
 

Author Comment

by:ben1211
ID: 35079509
arnold...this AD Server is a very basic server. I have not done any changes to the GPO Settings. COuld you direct me as to how do I get to the GPO window and how do i see if the password age has been set for this particular local computer. This is done on the AD Server?
0
 
LVL 76

Assisted Solution

by:arnold
arnold earned 333 total points
ID: 35079548
Download and install GPMC from http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0a6d4c24-8cbd-4b35-9272-dd3cbfc81887&displaylang=en
Once it is install, you can view your domain's GPOs and settings as well as run Group Policy results.
You can install the GPMC on a server or on a workstation.  It is merely a console to accessing the AD information/layout.
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
RDP Trouble shooting 12 100
Is KairosPlanet a fraud? 6 39
JItbit AD intergration 4 45
Microsoft License Verification Process?? 12 34
The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now