Logon failure when domain controller unavailable - why?

[NJSJL]

I have a Windows service on a Windows 2003 server that authenticates with its database server (SQL 2005) on a regular basis. Recently the Windows server's logon server was rebooted. This resulted in authentication failures relating to the Windows service.

The event log details are:
Event ID: 529
Reason: Unknown user name or bad password

It's not an unknown user name or bad password as once the logon server had completed its reboot the service could authenticate again.

The AD site that the server is in has three domain controllers but for some reason the server did not go through the process of finding another DC when it couldn't contact its logon server, it simply rejected the logons.

Can anyone explain under what conditions a search for a new DC will take place or why else the logon failed.

Thanks.
NJSJL

 

[Davetoo]

You have to have a GC available in order to authenticate logons. If you only have one GC and you stop it, then users will fail logon.

What logon type is indicated in the event log error?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[SteveRoadWarrior]

DNS settings for your SQL server include more than one DNS/AD server right? If so, doublecheck your DNS forward zone for all the appropriate records then run dcdiag /c and dnslint. If you reboot the AD server, it may take up to 5 minutes for the DNS cache for "domain.local" to expire and the server to ask again for the IP of the domain. Typing ipconfig /flushdns will speed this up.

 

[NJSJL]

Answers to the questions:

I can confirm that there are two global catalog servers within the AD site that this server is in and the second GC remained available when other was rebooted.

The logon type reported in the event log is 5 (service).

The SQL server and application server are both configured with primary, secondary and tertiary DNS servers. None of the DNS servers were rebooted, it was a DC which is also a GC.

Any further suggestions?

 

[SteveRoadWarrior]

dcdiag, and netdiag
also verify your service records for DNS