Fix NETLOGON error :The session setup from the computer <computername> failed to authenticate
we are gettign these error on a regular basis:, however when i try to find this specific computer (Windows XP client), its not available in our domain (maybe this computer was deleted sometime back). please help me to resolve this error happening.
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5805
User: N/A
Computer: <domain controller>
Description:
The session setup from the computer <computername> failed to authenticate. The following error occurred:
Access is denied.
**************************
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5723
Computer: <domain controller>
Description:
The session setup from computer <computername> failed because the security database does not contain a trust account <computername> referenced by the specified computer.
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5805
User: N/A
Computer: <domain controller>
Description:
The session setup from the computer <computername> failed to authenticate. The following error occurred:
Access is denied.
**************************
Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5723
Computer: <domain controller>
Description:
The session setup from computer <computername> failed because the security database does not contain a trust account <computername> referenced by the specified computer.
Lukasz Chmielewski
Rename some computer to the problematic one and rejoin / remove from domain again. There are some corrupt records indicating that it was not removed properly.
I have had this issue on every domain controller I have had my hands on, and I have stopped worrying about them. This an other Netlogon messages appears in the event-log often and I suspect it has to do with computers in the network that has temporary problems regarding: date/time, trust-account-information stored locally or simply a computer not joined to the domain.
The 5723 event can mean a computer deleted from active directory.
The 5805 event indicates that a computer has not ben joined properly or there is an error with the account.
These events usual happens at computer startup.
But do you not know what pc this is? it says just <computername> or does it say an actual name?
Usual steps to get rid of these errors:
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
- use ipconfig /flushdns on computer.
- remove computer from active directory and rejoin to domain.
The 5723 event can mean a computer deleted from active directory.
The 5805 event indicates that a computer has not ben joined properly or there is an error with the account.
These events usual happens at computer startup.
But do you not know what pc this is? it says just <computername> or does it say an actual name?
Usual steps to get rid of these errors:
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
- use ipconfig /flushdns on computer.
- remove computer from active directory and rejoin to domain.
ASKER
@ Roads_Roads: well i tried it now. but now its gives me another error (Event ID:5722)
"The session setup from the computer <computername> failed to authenticate. The name(s) of the account(s) referenced in the security database is <computername>$. The following error occurred:
Access is denied. "
later, i reset the computer and now i deleted the pc. however still im getting the same error (Event ID:5722)
"The session setup from the computer <computername> failed to authenticate. The name(s) of the account(s) referenced in the security database is <computername>$. The following error occurred:
Access is denied. "
later, i reset the computer and now i deleted the pc. however still im getting the same error (Event ID:5722)
ASKER
zulumike: yes it gives the computername.. i just replaced the computername of a generic one (<computername>)
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
There is no firewall enabled. also FYI.. there is no pc with thecomputername displayed in the log. now, but it could have deleted sometime back.
- use ipconfig /flushdns on computer.
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.
- remove computer from active directory and rejoin to domain
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.
- It may be the windows firewall (either at the computer or the domaincontroller) that causes this. Try disabling.
There is no firewall enabled. also FYI.. there is no pc with thecomputername displayed in the log. now, but it could have deleted sometime back.
- use ipconfig /flushdns on computer.
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.
- remove computer from active directory and rejoin to domain
No computer with the said name, in the Active Directory. maybe it was there sometime back and got deleted.
OK.
It seems to me you have good control over your network, but I will give some more comments anyhow (just in case):
The message indicates that there IS a computer that has that name which tries to connect with the domain controller. Could it be via a VPN or something?
you could also check your dns and see if the name appears there and check the related ip-adress. you could also try to delete the records which includes the name.
You could also check dhcp leases to see if you find it there.
It seems to me you have good control over your network, but I will give some more comments anyhow (just in case):
The message indicates that there IS a computer that has that name which tries to connect with the domain controller. Could it be via a VPN or something?
you could also check your dns and see if the name appears there and check the related ip-adress. you could also try to delete the records which includes the name.
You could also check dhcp leases to see if you find it there.
ASKER
@zulumike: There is no dns entry with said computername.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
solved the problem