Проблемы с Kerboros и DC

[Jack Профиль]

Здравствуйте!

Проблема выглядит так. Есть два контроллера домена Windows 2003 Server.
DC1 - DNS, Exchange, он является хозяином операций.
Некоторое время назад DC1 сгорел, пришлось переустанавливать систему. Windows была восстановлена из образа Acronis, затем поверх была восстановлена Active Directory из бекапа System State десятидневной давности.

После этого на DC2 перестала происходит репликация AD. На DC1 все было нормально: никаких ошибок в логах.

В прошлую пятницу произошло отключение электричества, УПС не выдержали и сервера перезапустились. После этого проблем стало больше.
К DC1 невозможно подключиться с половины рабочих станций (подключиться к Exchange, открыть папку на DС1) и DC2 (открыть папку на DC1, подключиться к AD DC1). Ошибка: logon Failure: the target account name is incorrect.

В логах DC1.

Источник события: Kerberos
Категория события: Отсутствует
Код события: 4
Описание:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/DC1. The target name used was ldap/DC1 . This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (Domain.RU), and the client realm. Please contact your system administrator.

Перезапустил DC1, затем все компы, затем DC2.
С DC2 папки на DC1 стали открываться, но репликации нет по-прежнему. При подключении к DC1 через консоль AD Users and Computers: The following domain controller could not be contacted. Access is denied.
На рабочих станциях поначалу все было нормально, но затем все вернулось к прежнему состоянию. Перой помогает перезагрузка компа (иногда несколько раз надо перезагружать). Тогда можно подключиться и к почте, и папки открыть. Но это не выход.
Ошибки:

Тип события: Предупреждение
Источник события: LSASRV
Категория события: SPNEGO (согласователь)
Код события: 40961
Дата: 09.08.2006
Время: 18:24:35
Пользователь: Н/Д
Описание:
Системе безопасности не удалось установить безопасное подключение к серверу ldap/sirius.etsn.ru. Отсутствуют доступные протоколы проверки подлинности.

Тип события: Ошибка
Источник события: Kerberos
Категория события: Отсутствует
Код события: 4
Дата: 09.08.2006
Время: 18:23:56
Пользователь: Н/Д
Компьютер
Описание:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/DC1. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (DOMAIN), and the client realm. Please contact your system administrator.


Помогите, пожалуйста, решить проблему!

[slz Профиль]

dcdaig, netdiag и ipconfig /all (с обоих DC)
Подобная проблема - index.php?showtopic=5502

[Jack Профиль]

DC1
DcDiag:

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\DC1
Starting test: Connectivity
......................... DC1 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DC1
Starting test: Replications
......................... DC1 passed test Replications
Starting test: NCSecDesc
......................... DC1 passed test NCSecDesc
Starting test: NetLogons
......................... DC1 passed test NetLogons
Starting test: Advertising
......................... DC1 passed test Advertising
Starting test: KnowsOfRoleHolders
......................... DC1 passed test KnowsOfRoleHolders
Starting test: RidManager
......................... DC1 passed test RidManager
Starting test: MachineAccount
......................... DC1 passed test MachineAccount
Starting test: Services
......................... DC1 passed test Services
Starting test: ObjectsReplicated
......................... DC1 passed test ObjectsReplicated
Starting test: frssysvol
......................... DC1 passed test frssysvol
Starting test: frsevent
There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
......................... DC1 failed test frsevent
Starting test: kccevent
......................... DC1 passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 08/10/2006 10:18:04
Event String: Driver hp LaserJet 3030 PCL 6 required for

......................... DC1 failed test systemlog
Starting test: VerifyReferences
......................... DC1 passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : firma
Starting test: CrossRefValidation
......................... firma passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... firma passed test CheckSDRefDom

Running enterprise tests on : firma.ru
Starting test: Intersite
......................... firma.ru passed test Intersite
Starting test: FsmoCheck
......................... firma.ru passed test FsmoCheck

[Jack Профиль]

DC2
DcDiag:
Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\DC2
Starting test: Connectivity
......................... DC2 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DC2
Starting test: Replications
[Replications Check,DC2] No replication recently attempted:
From DC1 to DC2
Naming Context: DC=ForestDnsZones,DC=firma,DC=ru
The last attempt occurred at 2006-08-10 03:47:59 (about 6 hours ago).
[DC1] DsBindWithSpnEx() failed with error -2146893022,
Win32 Error -2146893022.
[Replications Check,DC2] No replication recently attempted:
From DC1 to DC2
Naming Context: DC=DomainDnsZones,DC=firma,DC=ru
The last attempt occurred at 2006-08-10 03:47:59 (about 6 hours ago).
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Schema,CN=Configuration,DC=firma,DC=ru
The replication generated an error (-2146893022):
Win32 Error -2146893022
The failure occurred at 2006-08-10 10:32:58.
The last success occurred at 2006-08-10 03:47:59.
27 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Configuration,DC=firma,DC=ru
The replication generated an error (-2146893022):
Win32 Error -2146893022
The failure occurred at 2006-08-10 10:33:13.
The last success occurred at 2006-08-10 03:48:12.
38 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=firma,DC=ru
The replication generated an error (-2146893022):
Win32 Error -2146893022
The failure occurred at 2006-08-10 10:46:59.
The last success occurred at 2006-06-30 10:13:57.
91727 failures have occurred since the last success.
REPLICATION-RECEIVED LATENCY WARNING
DC2: Current time is 2006-08-10 10:47:00.
DC=firma,DC=ru
Last replication recieved from DC1 at 2006-06-30 10:13:57.
......................... DC2 passed test Replications
Starting test: NCSecDesc
......................... DC2 passed test NCSecDesc
Starting test: NetLogons
......................... DC2 passed test NetLogons
Starting test: Advertising
......................... DC2 passed test Advertising
Starting test: KnowsOfRoleHolders
Warning: DC1 is the Schema Owner, but is not responding to DS RPC Bind.
[DC1] LDAP bind failed with error 8341,
Win32 Error 8341.
Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Domain Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Domain Owner, but is not responding to LDAP Bind.
Warning: DC1 is the PDC Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the PDC Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Rid Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Rid Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to LDAP Bind.
......................... DC2 failed test KnowsOfRoleHolders
Starting test: RidManager
......................... DC2 failed test RidManager
Starting test: MachineAccount
......................... DC2 passed test MachineAccount
Starting test: Services
......................... DC2 passed test Services
Starting test: ObjectsReplicated
......................... DC2 passed test ObjectsReplicated
Starting test: frssysvol
......................... DC2 passed test frssysvol
Starting test: frsevent
......................... DC2 passed test frsevent
Starting test: kccevent
......................... DC2 passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x40000004
Time Generated: 08/10/2006 09:52:48
Event String: The kerberos client received a
An Error Event occured. EventID: 0x0000165B
Time Generated: 08/10/2006 10:16:03
Event String: The session setup from computer 'FIRMAW136' failed
An Error Event occured. EventID: 0x000016AD
Time Generated: 08/10/2006 10:18:18
Event String: The session setup from the computer FIRMAW136
An Error Event occured. EventID: 0x00000457
Time Generated: 08/10/2006 10:19:42
Event String: Driver hp LaserJet 3030 PCL 6 required for
An Error Event occured. EventID: 0x40000004
Time Generated: 08/10/2006 10:20:11
Event String: The kerberos client received a
An Error Event occured. EventID: 0x0000165B
Time Generated: 08/10/2006 10:29:42
Event String: The session setup from computer 'FIRMAW134' failed
An Error Event occured. EventID: 0x000016AD
Time Generated: 08/10/2006 10:33:03
Event String: The session setup from the computer FIRMAW134
An Error Event occured. EventID: 0x40000004
Time Generated: 08/10/2006 10:47:00
Event String: The kerberos client received a
An Error Event occured. EventID: 0x40000004
Time Generated: 08/10/2006 10:47:00
Event String: The kerberos client received a
......................... DC2 failed test systemlog
Starting test: VerifyReferences
......................... DC2 passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : firma
Starting test: CrossRefValidation
......................... firma passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... firma passed test CheckSDRefDom

Running enterprise tests on : firma.ru
Starting test: Intersite
......................... firma.ru passed test Intersite
Starting test: FsmoCheck
......................... firma.ru passed test FsmoCheck

[Jack Профиль]

DC1
NetDiag

Computer Name: DC1
DNS Host Name: DC1.firma.ru
System info : Windows 2000 Server (Build 3790)
Processor : x86 Family 15 Model 3 Stepping 3, GenuineIntel



Netcard queries test . . . . . . . : Passed
[WARNING] The net card '1394 Net Adapter' may not be working because it has not received any packets.



Per interface results:

Adapter : Local Area Connection

Netcard queries test . . . : Passed


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{EFFDFA74-3B1B-4377-9325-13A86690599B}
1 NetBt transport currently configured.


Kerberos test. . . . . . . . . . . : Passed


The command completed successfully

[Jack Профиль]

DC2
NetDiag

А вот тут-то еще проблема встпыла:
при запуске Netdiag.exe появилось окошко:
Точка входа в процедуру DnsGetMaxNumberOfAddressToRegister не найдена в библиотеке DLL DNSAPI.dll

Причем эта ошибка наблюдается и на рабочих станциях

[Jack Профиль]

Господа, может кто-нибудь сможет помочь мне на месте?
Естесственно, будет оплачено.
Так как на свои силы я мало рассчитываю уже (

[slz Профиль]

Netdiag запускается только под серверной ОС.
1. Скинуть пароль на учетные записи DC1 и DC2, они оба разные, на разных DC.
http://support.microsoft.com/default.as ... -us;325850
Кто GC?

[slz Профиль]

Если мой регион, то пиши, иначе никак.