1000's of audit failures

Question

I am having an issue with server's randomly getting 1000's of audit failure errors, usually a reboot fixes the problem for a while but i need to get to the root cause of the issue. This is a virtual environment. I have 3 esx host running esx 4.1.  The
first error i get is usually this 
Message: 'This computer was not able to set up a secure session with a domain controller in domain NJ1due to the following: The RPC server is unavailable. This may lead to authentication problems. Make sure that this computer is connected to the network.
If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise,
this computer sets up the secure session to any domain controller in the specified domain.'
Data: 'C0020017'
The computer is still on the network as i can RDP to it. The 1000's of event ID errors are all the same See Below
n account failed to log on.
Subject:
Security ID:
NULL SID
Account Name:
Account Domain:
Logon ID:
0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID:
NULL SID
Account Name:
svc_or
Account Domain:
nj1
Failure Information:
Failure Reason:
An Error occured during Logon.
Status:
0xc000005e
Sub Status:
0x0
Process Information:
Caller Process ID:
0x0
Caller Process Name:
Network Information:
Workstation Name:
NJ100-MGMT01
Source Network Address:
10.8.32.45
Source Port:
56481
Detailed Authentication Information:
Logon Process:
NtLmSsp 
Authentication Package:
NTLM
Transited Services:
Package Name (NTLM only):
Key Length:
0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Any help would be appreciated. 

Answer 1

@Pace0214
I need a little more info on your environment to get a feel for what may be going on.  How many domain controllers are you using?  How many sites do you have?  How are they configured, i.e., hub and spoke, spanned, etc.? Do you have DC's
in the sites?  Are you using AD integrated DNS or some other method?  These are the big ones that come to mind. 
Mr. X has got you looking in the right places, these types of errors are usually DNS or IP configuration related.  AD uses subnets to find everything that DNS doesn't.  It is what clients use to locate a DC to authenticate against and unless
properly configured, you will get these types of errors. 
Gary
Gary G. Gray
 MCP, MCTS, MCITP, MCT Alumni
Please remember to mark the replies as answers if they are helpful.
This posting is provided AS-IS with no warranties or guarantees and confers no rights.