[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Urgent problem! - "kerberos subsystem encountered a PAC verification failure"

Posted on 2011-04-29
30
Medium Priority
?
2,060 Views
Last Modified: 2012-06-21
Hi there
I have 2 critically important Desktop PCs that er currently unable to get to network drives or print or perform any functions which require AD validation.
Dont know the cause but the error repeatedly in the event log is the one above.
Also get the following when trying to map a drive:

"No network provider accepted the given network path"

I've tried removing the PCs from the domain but now i can't rejoin. It says;
"the network location cannot be reached"

I can still map a drive to non-AD servers which is weird.

Any other ideas? I really need to get these 2 machines working again asap.
thanks


Windows XP Pro SP3 connecting to Windows 2003 AD
0
Comment
Question by:stack888
  • 14
  • 12
  • 2
  • +1
30 Comments
 
LVL 6

Expert Comment

by:linraf
ID: 35494567
Does this happen with all users on the machine?
Can the same users login properly on another machine?
0
 
LVL 4

Expert Comment

by:kdgoodknecht
ID: 35494664
Have you verified DNS functioning properly on your domain controlers and that you are using only the AD DNS servers?
0
 
LVL 6

Expert Comment

by:linraf
ID: 35494686
I had similar type problems with users that I had adjusted some of the account settings for kerberos on the Active Directory User properties. For a version of besx, I had to adjust a setting (besx later resolved in an update), but my first windows 7 machines I joined with those users show kerberos errors and would not access the server.

So, check the settings on the user in active directory account tab.  On a working user, all of my checkboxes are unchecked for account options.


0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 2

Author Comment

by:stack888
ID: 35494739
its not user account related - i had tried other user accounts but the problem is with the machines themselves. The same user account works fine on any other machines. We have other XP machines that do not have this problem. I thought it may be  a windows update but i can't see the same update installing on both machines at a time near to when the problem began.

DNS is working fine and all other machines are able to use dns.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35494792
DNs as someone stated and aklso check that the Server, Workstation, and Netlogon services are started and automatic on the stations.
0
 
LVL 4

Expert Comment

by:kdgoodknecht
ID: 35494830
Check the time on the workstations you cannot rejoin, and it is not a question of whether they are able to use DNS, it is required that only the DNS server that has the AD domain zone be used, no routers of ISP DNS allowed.
0
 
LVL 2

Author Comment

by:stack888
ID: 35494887
server, workstation are all automatic and running. Netlogon isnt used on windows xp. I did try enabling it and starting it but that makes no difference.

DNS is running fine as is the only DNS in the network.

I just tried removing microsoft client and repairing tcpip but still same problems.

0
 
LVL 2

Author Comment

by:stack888
ID: 35494893
also ran a netdiag winsock test and that passed with no errors
0
 
LVL 6

Expert Comment

by:linraf
ID: 35494959
Check all domain controllers for those 3 services started as well as KDC service.

Do the machines have mutiple nics or a single nic?
0
 
LVL 2

Author Comment

by:stack888
ID: 35495023
just confirmed - there are 2 DCs and all three services are automatic and started. Kerberos is also automatic and started on both servers.

Both servers and workstations have single NICs.
0
 
LVL 2

Author Comment

by:stack888
ID: 35495037
If I go to Network Places on the 2 affected xp machines, I can see shares that exist on some other servers, but none that are on the 2 DCs. Basically the DCs are invisible to these windows xp desktops right now.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495110
0
 
LVL 2

Author Comment

by:stack888
ID: 35495162
thanks for the link. I tried that but the sc query returns expected results and the same as the other working xp PCs.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495169
Can you ping the servers by name?
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495180
Try turning off firewalls (for testing only) on the workstation (3rd party and windows firewalls)
0
 
LVL 2

Author Comment

by:stack888
ID: 35495217
yep, firewall and anti virus both turned off already on the workstation but no difference.
This is a real puzzler!
I really appreciate the help.
This message of 'no network provider accepted the given network path' really puzzles me - this is when i try to go to a share in the domain or map a drive

Lets see what else i can try....
0
 
LVL 2

Author Comment

by:stack888
ID: 35495224
yes, ping works fine - i can ping the short name and the fqdn of both DCs and both work.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495240
Did you change workstation name after unjoining domain before rejoining domain?
0
 
LVL 2

Author Comment

by:stack888
ID: 35495255
i did change the workstation name and on that workstation i am unable to rejoin the domain.
It just doesnt see the domain anymore.
So I currently have the 2 xp desktops with the issue, one of them is still in the domain but cant print or get to network folders etc and the other one is now in a separate workgroup and can't do anything useful at all.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495626
If you try to access the share by ip, do you get the same message?
0
 
LVL 6

Expert Comment

by:linraf
ID: 35495641
Check on the network connection for file and print sharing enabled.
Try a restore point.
0
 
LVL 2

Author Comment

by:stack888
ID: 35495690
yes, i can access a share by IP but on the machine that is now in a workgroup, i can't rejoin the domain using ip address so that one has me totallt stuck.
I tried a system restore on both machines from various dates but they both fail saying restore is incomplete and no changes have been made. I tried the restore from with safe mode but still same error and upon reading about ms system restore, it appears its very unstable at the best of times.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35499340
Did you check on network connection for file print sharing.
Try adding dns suffix to network connection manually.
Try adding fqdn to host file.
Try joining using full domain name.
0
 
LVL 4

Expert Comment

by:CERTExpert
ID: 35500079
Do u see 'Microsoft Windows Network' in the providers when go into Network Connections -> Advanced -> Advanced Settings -> Provider Order. Also see if there is a third party provider. If yes, remove it. Move the Microsoft Windows Network to the top.
0
 
LVL 2

Author Comment

by:stack888
ID: 35501394
linraf, tried those things, no luck so far.

certexpert, under advanced there is only Firewall so no providers to order.
Listed undder General is all the usual stuff:
Client for MS Networks
File and Printer Sharing
QOS Packet
Broadcom Advnced
Internet Protocol TCPIP
0
 
LVL 4

Expert Comment

by:CERTExpert
ID: 35503745
Read this KB http://support.microsoft.com/kb/894564.

and I'm talking about this section:

The Provider Order tab lists the network providers for this computer. You can use the arrow buttons to change the order in which these providers are accessed. You can arrange the order in which the computer accesses information about the network. Providers and other connections are accessed in the order in which the providers and the connections are listed.

Also try to join the machine from safe mode with networking.
0
 
LVL 2

Author Comment

by:stack888
ID: 35505707
i tried joining the network from safe mode with networking - same error.
Will take a look at provider order tab, thanks.
0
 
LVL 6

Expert Comment

by:linraf
ID: 35507617
On xp machine please go to:
Control panel
Administrative tools
local security policy
local policies
security options
please tel me the entries/settings that start with Network security:
0
 
LVL 2

Accepted Solution

by:
stack888 earned 0 total points
ID: 35710493
i ended up rebuilding the PCs in question after swapping out with new ones i purchased.
Quite the bizarre problem and sure hope it doesnt happen again.
Thanks everyone for your suggestions.
0
 
LVL 2

Author Closing Comment

by:stack888
ID: 35735982
couldnt resolve the problem and had to rebuild machine.
0

Featured Post

Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
Mailbox Corruption is a nightmare every Exchange DBA wishes he never has. Recovering from it can be super-hectic if not entirely futile. And though techniques like the New-MailboxRepairRequest cmdlet have been designed to help with fixing minor corr…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question