Solved

Fix NETLOGON error :The session setup from the computer <computername> failed to authenticate

Posted on 2011-03-08
8
5,841 Views
Last Modified: 2012-05-11
we are gettign these error on a regular basis:, however when i try to find this specific computer (Windows XP client), its not available in our domain (maybe this computer was deleted sometime back). please help me to resolve this error happening.

Event Type:   Error
Event Source:          NETLOGON
Event Category:       None
Event ID:       5805
User:            N/A
Computer:     <domain controller>
Description:
The session setup from the computer <computername> failed to authenticate. The following error occurred:
Access is denied.
********************************
Event Type:   Error
Event Source:          NETLOGON
Event Category:       None
Event ID:       5723
Computer:     <domain controller>
Description:
The session setup from computer <computername> failed because the security database does not contain a trust account <computername> referenced by the specified computer.
0
Comment
Question by:TJOSY
  • 4
  • 3
8 Comments
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
Comment Utility
Rename some computer to the problematic one and rejoin / remove from domain again. There are some corrupt records indicating that it was not removed properly.
0
 
LVL 3

Expert Comment

by:zulumike
Comment Utility
I have had this issue on every domain controller I have had my hands on, and I have stopped worrying about them. This an other Netlogon messages appears in the event-log often and I suspect it has to do with computers in the network that has temporary problems regarding: date/time, trust-account-information stored locally or simply a computer not joined to the domain.
The 5723 event can mean a computer deleted from active directory.
The 5805 event indicates that a computer has not ben joined properly or there is an error with the account.
These events usual happens at computer startup.

But do you not know what pc this is? it says just <computername> or does it say an actual name?

Usual steps to get rid of these errors:
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
- use ipconfig /flushdns on computer.
- remove computer from active directory and rejoin to domain.
0
 

Author Comment

by:TJOSY
Comment Utility
@ Roads_Roads: well i tried it now. but now its gives me another error (Event ID:5722)

"The session setup from the computer <computername> failed to authenticate. The name(s) of the account(s) referenced in the security database is <computername>$.  The following error occurred:
Access is denied. "

later, i reset the computer and now i deleted the pc. however still im getting the same error (Event ID:5722)
0
 

Author Comment

by:TJOSY
Comment Utility
zulumike: yes it gives the computername.. i just replaced the computername of a generic one (<computername>)
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
There is no firewall enabled. also FYI.. there is no pc with thecomputername displayed in the log. now, but it could have deleted sometime back.

- use ipconfig /flushdns on computer.
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.

- remove computer from active directory and rejoin to domain
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.

0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 3

Expert Comment

by:zulumike
Comment Utility
OK.
It seems to me you have good control over your network, but I will give some more comments anyhow (just in case):

The message indicates that there IS a computer that has that name which tries to connect with the domain controller. Could it be via a VPN or something?
you could also check your dns and see if the name appears there and check the related ip-adress. you could also try to delete the records which includes the name.
You could also check dhcp leases to see if you find it there.
0
 

Author Comment

by:TJOSY
Comment Utility
@zulumike: There is no dns entry with said computername.
0
 
LVL 3

Accepted Solution

by:
zulumike earned 500 total points
Comment Utility
0
 

Author Closing Comment

by:TJOSY
Comment Utility
solved the problem
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now