Date Change killed AD 1

[NatRH]

Greetings,

Had a situation where my time server set the date on my Domain Controller back by 1 year. After resetting the date, my secondary domain controller quit replicating.

The issue I'm really concerned about is that all my domain members can no longer see the DC by UNC. Typing \\domainController gives me an error about not sufficient permissions. Also my domain printers quit working.

Logins appear to work right now, but accessing the UNC share or browsing the network fails.

Any ideas?

 

[mrdenny]

Windows AD is very time sensitive. When the DCs were out of sync with each other they stopped talking to each other.

You will probably need to do a full network restart to get everything working again.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[NatRH]

Because the DC's quit talking, would that affect network printing if the printers are shared from the main DC?

Also, I cannot understand why the \\DomainController function is not working, which appears to be the issue with the printers also.

Thanks for the help.

 

[mrdenny]

All network services rely on machines being within a few minutes of each other time wise. If they are not then services will begin to fail.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[djtech2k]

mrdenny is correct. The KDC service relies heavily on the time. There is a also a kerberos threshold that can be set in GPO to limit the time difference in authentication.

 

[NatRH]

Thanks for everyone's help.

I added the registry entry to allow the secondary DC to replicate again. Once replication was successful I rebooted every device in two facilities.

After about 6 hours of monitoring, it appears like everything is back to normal.

That was quite a scare and will most certainly cause a fine tuning of my AD disaster recovery skills.

Happy Weekend!

 

[58sniper]

A star for MrDenny for his quick, correct answer.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[mrdenny]

Thanks.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com