Disabled domain controller computer object

Question

on one of our DC's DC01 (RID/PDC) the computer account was disabled this was showing as disabled on all DC's in the domain. I have managed to fix it by changing the
User account control attribute on that object to 532480 in adsiedit on all DC's. I then had to reset the secure password for DC01 using netdom resetpwd as it had got out of sync. Everything now seems fine replication/authentication/DCdiag/netdiag
Why did this occur ? it looks like you cant disable a Domain controller computer account from the GUI ? am i likely to get any further issues

Answer 1

I have seen similar situations on the net but I have not found an explanation to this behavior (assuming here that this is a bug in the system). You can see references here:
http://www.kenmanohar.com/blog/tag/domain-controller-computer-account-disabled/
http://social.technet.microsoft.com/Forums/windowsserver/en-US/9fb5084e-b27d-48c8-92e7-8818fc769a90/disabled-domain-controller-computer-account
You might check if any of the administrators have mistakenly changed the value of UserAccountControl attribute. By using ADUC, you would not be able to disable the computer account of a DC.
Please also enable the auditing in AD so that you can get more details about what happened in the future: http://technet.microsoft.com/en-us/library/cc731607(v=ws.10).aspx
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password