Unexplained logon (Kerberos) error

[agentflicker]

Hello all,

I hope someone can give me a lead on this as I'm completly stuck.

We have a parent/child domain setup. When I try to browse (logon) to the PDC in the child domain from the parent domain I get the following winpopup stop error:

"\\COMPUTER-PDC is not accessible
Logon failure: The target account name is incorrect."

This happens from any computer in the parent domain and from any logon. But I can logon to and browse any other PC in the child domain from the parent domain no problems.

If I logon to the child domain and then try logging onto the parent domain (ie in the reverse direction) I have no problems.

I used the "verify trusts" test button from both domains and they say that the trusts are fine.

I then turned Auditing on on the child domain and I got the following errors in the event log each time I attempted to logon to the child PDC.

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 29/05/2001
Time: 3:36:29 PM
User: NT AUTHORITY\SYSTEM
Computer: COMPUTER-PDC
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -

So I tested the Kerberos on both PDC's with netdiags and found no errors and (as far as I know) the Kerberos appears to be setup correctly.

Any ideas anyone?

Cheers.

 

[tbutke]

Hi,
seems to me that the user doing the net time command has not enough priviledges. Standardusers are not allowed to change system time. Add the right to it using gpo.

thorsten

 

[Guest_imported]

Hi,

I am having a very similar problem with W2K server ... when I try to log on to the DC at the console using the Admin account, I get the message:
"The system cannot log you on due to the following error:
There is a time difference between the Client and Server.
Please try again or consult your system administrator."
The only problems are:
1.) I am the system administrator
2.) The solution is to log on locally using the administrator an sync the time with the DC using "net time"
3.) I am using the admin account
4.) I am trying to log on to the DC

I am close to having no hair left over this one ... any ideas? Will post as new thread also.

Thanks,
B.
b00007@hotmail.com

 

[agentflicker]

Some further info on my orignal problem, I've found that I am able to logon to the PDC giving the errors from a NT4 PC from any domain with no problems. So it definitely seems to be a Kerberos problem.


Can anybody help?

agentflicker@yahoo.com