Windows Forum

Ask something
Discussion Locked

PDC offline-Can't authenticate to Domain

0 helpful
9 replies

by garos

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

When our PDC is offline, our users are unable to authenticate to the domain.

Event viwer shows successfull sync between BDC and PDC.

There are 2 BDC's on two seperate subnets.

Netlogon running on both. Both can ping PDC by name.

I've seen many articles on this issue, but none that have pointed to the right cause.

Your input is appreciated.

GSM

9 replies

by mackem

Your BDC's cannot authenticate logins. When the PDC is down you must promote a BDC to Pdc and then do the reverse when PDC comes back on line.
Best of luck.

by david.gruenewald

The previous post is incorrect, BDCs do authenticate logins and you can run without a PDC, just don't make any changes.

As for your problem, I am sure that you have force a manual resync of the SAM. Check your WINS servers and make sure that there are entries for your domains that have IP addresses to both your BDC and PDC.

If that is not it the majority of the technet articles on this subject look to a problem with the connections between the PDC and BDCs look there for additional ideas.

by magetower

There is a NT Res Kit tool that will check and reset the secure channels between your DCs. The tool is netdom.exe. You have to run the tool from the DC you are trying to check out. (i.e. run on BDC if tryinng to reset BDC channel).

If your PDC is off-line for an extended length of time your BDCs will eventually stop authenticating selective accounts due to age of the account information. Machine accounts tend to 'time out' first preventing logins from that workstation.

If your PDC is going to be off for more than an hour consider promoting one of the BDCs first.

by garos

Right on the money Magetower.

I will use AT to assure channels are kept open.

by bohicam1

It is the logon script that must be replicated between servers. When you see replication successful in your event viewer, it means the SAM was replicated. To replicate the logon script you must go through a number of steps. I do not have the space here to explain it all but if you like you can email me and I will get back to you in short time.
awaiting your response...

Mike

This discussion is closed to new replies.