2008 R2 DCPromo with strange authentication and workstation issues
Posted on 2011-05-03
I DCPromo'd 4 new domain controllers in the last 2 weeks. I am seeing some intermittent issues and I wanted to see if anyone could help.
We have an empty forest root. "ad.example.com". I obviously ran the R2 schema updates for the forest and domain. We have actually had a 2008 R2 DC in the forest root for 7 months without issue.
We have child domains for each country. For example, "us.ad.example.com". I also promoted 2 DC's in this domain within the past 2 weeks. This domain has the majority of our users. The majority of our users are XP based with about 15-20% Windows 7.
A couple things I have noticed personally and in my group. After my dcpromo on the us.ad.example.com domain, i had an issue where my Windows 7 Desktop had the following issue:
We login to our systems with our regular user accounts. For administration we run as our user-admin accounts.
I clicked "Run as another user" and entered my us.ad.example.com\user-admin account. I got the following error: "The security database on the server does not have a computer account for this workstation trust relationship." This happened with anything I ran as my US\user-admin account. If I used the forest root admin account or my regular user account, they were fine. I only saw this running as US\user-admin. The computer object existed and looked fine.
Today I had a co-worker with the EXACT same issue on Windows 7. His system also stated "The trust relationship between this workstation and the primary domain failed." He ended up rejoining his system to the domain to get it working again. I did nothing and after 30 minutes or so it started working again.
I want to troubleshoot this further since we have had 2 issues already and i dont want this widespread. We are also seeing strange issues with authentication on our Cisco ACS Wireless in remote domains but that may be unrelated.
DCDiags and all the typical troubleshooting has looked fine. Has anyone seen this before? It is very strange that it works fine, except for those few users.