Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5783
Time: 4:52:57 PM
The session setup to the Windows NT or Windows 2000 Domain Controller \\DC02.DOMAIN.com for the domain DOMAIN is not responsive. The current RPC call from Netlogon on \\THISSERVER to \\DC02.DOMAIN.com has been cancelled.
I'm seeing this logged 4-5x a day on various servers in the domain.. Everything is on 1918 space with two DCs and an open firewall policy. I cant find any other symptoms besides the error. Its occasionally triggered with an RDC login but everything seems to work fine.
The two DCs are in sync and show no corresponding errors. DCDIAG is totally clean, everything passes. The unc paths in the error are reachable as well and RPC is listening. The client mentioned slow login times but I've been unable to reproduce that myself, and I'm not sure its related to these errors.
The DCs are running Win2012 and most of the members are 2k3R2. Member DNS is pointed to both DCs and nothing else. Nslookups work as expected and can query DNS records on the domain
I'm also seeing this get logged about once a day, though unsure if its related:
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Time: 7:39:51 AM
The Security System detected an authentication error for the server cifs/DC02.DOMAIN.com. The failure code from authentication protocol Kerberos was "The time at the Primary Domain Controller is different than the time at the Backup Domain Controller or member server by too large an amount.
Again, it doesnt seem to impact anything - it just gets logged. The clocks are perfectly in sync when this happens.
So far I have tried:
- this hotfix: http://support.microsoft.com/kb/979159
- disabled msrpc alg filtering on the fw
- disabled ipv6 on the DCs
- disabled tcp chimney offload and rss on the 2k3 member
- reconfigured ntp on the DCs
Nothing has had any effect on the errors. I'm not convinced theres anything wrong with this but the client is very sensitive to errors and I'd like to get them sorted out. However, without any real symptoms to troubleshoot I'm not sure where to go next.