Kerberos Error with Relocated Desktops

[picarolio]

Hello,

I'm a recent addition to the field and found tek-tips as a good starting point to add to my collection of resources.

We have 2003 Server and a single DC for the site. Two new computers were purchased and switched out with the ones being switched added to the design team. The ones that were moved to the design team had their name's changed to reflect their user.

Since then we have been recieving error 4 from Kerberos.

http://eventid.net/display.asp?eventid=4&eventno=1968&source=Kerberos&phase=1

I have since then, removed the computers from AD and added them back to the domain without a success conclusion to the issue.

Thanks for the help.

 

[IllogicallyLogical]

Have you tried resetting the computer accounts in Active Directory? Open AD Users and Computers> find the directory where the computer accounts are held> right click the computer object and select Reset Account. Reboot the workstation and join the domain again.

Joey
A+, Network+, MCP

 

[picarolio]

I'll give it a go and let'cha know.

 

[linney]

Troubleshooting Kerberos Errors

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx

 

[picarolio]

I reset the accounts and looked over the suggestions given by MS. None have panned out. The DNS server is working just fine, both computers do not even have NetBios installed, and I seriously doubt a hacker is playing middle man between the server and the two computers (since this error occured right when we transfered the computers to the new users within the same site).

Anyone have another idea?


Here is the error itself:

The kerberos client received a KRB_AP_ERR_MODIFIED error from the server (computer1). The target name used was (oldcomputer1name). This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (domain), and the client realm. Please contact your system administrator.

 

[IllogicallyLogical]

Maybe this tool from sysinternals can help you. Remove the computer accounts from AD and log on locally as administrator and run NewSID v4.10 to change the SIDs of the computers. Then rejoin the computers to AD.

-NewSID v4.10

http://www.microsoft.com/technet/sysinternals/Security/NewSid.mspx

Joey
A+, Network+, MCP

 

[hayes47]

Are there any other errors such as a time sync problem, failure to contact DC? How about running klist or kerbtray.

This exact error occurred at one of our small remote sites but it also contained other errors relating to time sync, netlogon, DC unreachable, etc. The issue was found by a network tech who found fragmentation errors on the router. Oddly enough some units could log in with absolutely no errors and some could not.

 

[picarolio]

No, no other related errors associated that I could find with this issue; infact, one of the PC's happened to have an installation issue with the company's proprietary program. After a complete wipe (including removing the computer from the AD) and rebuilding the PC then adding it back the error was still present.

I'll try those tools and report back, thanks.