One of the DC can't connect to AD for Windows server 2003

Question

Dear Sir,
We have 2 Domain Controllers in our Domain, DC1 and DC3, which is running on Windows Server 2003 SP2, I found the DC3 failed to connect to AD, and I found the following error message logged in the system event many time
Source: MRxSmb
Type : Error
主瀏覽器從電腦 DC1 收到 認為它是傳輸 NetBT_Tcpip_{C1D9AA59-2423-4059-A773 網域主瀏覽器的伺服器宣告。 主瀏覽器已中止或已強制選擇。
Source: KDC
Type: warning
找不到事件識別碼 20 (在來源 KDC 中) 的描述。本機電腦可能沒有所需的登錄資訊或訊息 DLL 檔案，因此無法顯示發自遠端電腦的訊息。您可以使用 /AUXSOURCE= flag 來重新抓取這個描述。請參閱 [說明及支援] 來了解詳細資料。以下資訊為事件的一部份: 事件日誌檔已損毀。
Source: Kerberos
Type: Error
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.  This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically
named  machine accounts in the target realm (Domain name), and the client realm.   Please contact your system administrator.
I have searched on internet, and tried some of the suggestions but still can't fixed the issue, I also can't depromo the DC3, and can't use remote desktop connection connect to DC3
What can I do now, can I just reinstall the DC3 and process the dcpromo again?

Answer 1

Hi Calin,
Here is the log content for your reference:-
Domain Controller Diagnosis
Performing initial setup:
   * Verifying that the local machine DC3, is a DC.
   * Connecting to directory service on server DC3.
   * Collecting site info.
   * Identifying all servers.
   * Identifying all NC cross-refs.
   * Found 2 DC(s). Testing 1 of them.
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\DC3
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         * Active Directory RPC Services Check
         ......................... DC3 passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\DC3
      Starting test: Replications
         * Replications Check
         [Replications Check,DC3] Inbound replication is disabled.
         To correct, run "repadmin /options DC3 -DISABLE_INBOUND_REPL"
         [Replications Check,DC3] Outbound replication is disabled.
         To correct, run "repadmin /options DC3 -DISABLE_OUTBOUND_REPL"
         ......................... DC3 failed test Replications
      Test omitted by user request: Topology
      Test omitted by user request: CutoffServers
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC DC3.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=domain,DC=COM,DC=HK
            (NDNC,Version 2)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=domain,DC=COM,DC=HK
            (NDNC,Version 2)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=domain,DC=COM,DC=HK
            (Schema,Version 2)
         * Security Permissions Check for
           CN=Configuration,DC=domain,DC=COM,DC=HK
            (Configuration,Version 2)
         * Security Permissions Check for
           DC=domain,DC=COM,DC=HK
            (Domain,Version 2)
         ......................... DC3 passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share
\\DC3\netlogon
         Verified share
\\DC3\sysvol
         ......................... DC3 passed test NetLogons
      Starting test: Advertising
         Warning: DsGetDcName returned information for
\\dc1.domain.COM.HK, when we were trying to reach DC3.
         Server is not responding or is not considered suitable.
         The DC DC3 is advertising itself as a DC and having a DS.
         The DC DC3 is advertising as an LDAP server
         The DC DC3 is advertising as having a writeable directory
         The DC DC3 is advertising as a Key Distribution Center
         The DC DC3 is advertising as a time server
         [DC1] LDAP bind failed with error 8341,
         Win32 Error 8341.
         Server DC3 is advertising as a global catalog, but
         it could not be verified that the server thought it was a GC.
         ......................... DC3 failed test Advertising
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK
         [DC1] DsBindWithSpnEx() failed with error -2146893022,
         Win32 Error -2146893022.
         Warning: DC1 is the Schema Owner, but is not responding to DS RPC Bind.
         Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.
         Role Domain Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK
         Warning: DC1 is the Domain Owner, but is not responding to DS RPC Bind.
         Warning: DC1 is the Domain Owner, but is not responding to LDAP Bind.
         Role PDC Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK
         Warning: DC1 is the PDC Owner, but is not responding to DS RPC Bind.
         Warning: DC1 is the PDC Owner, but is not responding to LDAP Bind.
         Role Rid Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK
         Warning: DC1 is the Rid Owner, but is not responding to DS RPC Bind.
         Warning: DC1 is the Rid Owner, but is not responding to LDAP Bind.
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK
         Warning: DC1 is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
         Warning: DC1 is the Infrastructure Update Owner, but is not responding to LDAP Bind.
         ......................... DC3 failed test KnowsOfRoleHolders
      Starting test: RidManager
         * Available RID Pool for the Domain is 9126 to 1073741823
         * dc1.domain.COM.HK is the RID Master
         ......................... DC3 failed test RidManager
      Starting test: MachineAccount
         Checking machine account for DC DC3 on DC DC3.
         * SPN found :LDAP/DC3.domain.COM.HK/domain.COM.HK
         * SPN found :LDAP/DC3.domain.COM.HK
         * SPN found :LDAP/DC3
         * SPN found :LDAP/DC3.domain.COM.HK/domainHK
         * SPN found :LDAP/34106c30-327d-4d63-ae93-fec48cac2975._msdcs.domain.COM.HK
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/34106c30-327d-4d63-ae93-fec48cac2975/domain.COM.HK
         * SPN found :HOST/DC3.domain.COM.HK/domain.COM.HK
         * SPN found :HOST/DC3.domain.COM.HK
         * SPN found :HOST/DC3
         * SPN found :HOST/DC3.domain.COM.HK/domainHK
         * SPN found :GC/DC3.domain.COM.HK/domain.COM.HK
         ......................... DC3 passed test MachineAccount
      Starting test: Services
         * Checking Service: Dnscache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: RpcSs
         * Checking Service: w32time
         * Checking Service: NETLOGON
            NETLOGON Service is paused on [DC3]
         ......................... DC3 failed test Services
      Test omitted by user request: OutboundSecureChannels
      Starting test: ObjectsReplicated
         DC3 is in domain DC=domain,DC=COM,DC=HK
         Checking for CN=DC3,OU=Domain Controllers,DC=domain,DC=COM,DC=HK in domain DC=domain,DC=COM,DC=HK on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK in domain CN=Configuration,DC=domain,DC=COM,DC=HK on 1 servers
            Object is up-to-date on all servers.
         ......................... DC3 passed test ObjectsReplicated
      Starting test: frssysvol
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... DC3 passed test frssysvol
      Starting test: frsevent
         * The File Replication Service Event log test
         There are warning or error events within the last 24 hours after the          SYSVOL has been shared.  Failing SYSVOL replication problems may cause         
Group Policy problems.
         An Warning Event occured.  EventID: 0x800034C4
            Time Generated: 11/04/2014   15:59:23
            (Event String could not be retrieved)
         ......................... DC3 failed test frsevent
      Starting test: kccevent
         * The KCC Event log test
         Found no KCC errors in Directory Service Event log in the last 15 minutes.
         ......................... DC3 passed test kccevent
      Starting test: systemlog
         * The System Event log test
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:11:27
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was
ldap/dc1.domain.COM.HK/[email protected]. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this
is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.   Please contact your system administrator.
         An Error Event occured.  EventID: 0x00000423
            Time Generated: 11/05/2014   11:11:27
            Event String: The DHCP service failed to see a directory server for authorization.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:29:56
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was
LDAP/dc1.domain.COM.HK/[email protected]. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this
is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.   Please contact your system administrator.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:29:56
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was domainHK\DC1$. This indicates that the password
used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (domain.COM.HK), and the client realm.   Please contact your system administrator.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:43:20
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was cifs/dc1.domain.COM.HK. This indicates that the
password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.   Please contact your system
administrator.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:50:39
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was ldap/dc1.domain.COM.HK. This indicates that the
password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.   Please contact your system
administrator.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:50:41
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was ldap/ba3f48bc-fa6a-4698-9947-ba8435cbf92b._msdcs.domain.COM.HK. 
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.  
Please contact your system administrator.
         An Error Event occured.  EventID: 0x40000004
            Time Generated: 11/05/2014   11:50:41
            Event String: The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/dc1.domain.com.hk.  The target name used was LDAP/ba3f48bc-fa6a-4698-9947-ba8435cbf92b._msdcs.domain.COM.HK. 
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (domain.COM.HK), and the client realm.  
Please contact your system administrator.
         ......................... DC3 failed test systemlog
      Test omitted by user request: VerifyReplicas
      Starting test: VerifyReferences
         The system object reference (serverReference)          CN=DC3,OU=Domain Controllers,DC=domain,DC=COM,DC=HK and backlink on         
CN=DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK          are correct.
         The system object reference (frsComputerReferenceBL)          CN=DC3,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=domain,DC=COM,DC=HK         
and backlink on CN=DC3,OU=Domain Controllers,DC=domain,DC=COM,DC=HK are          correct.
         The system object reference (serverReferenceBL)          CN=DC3,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=domain,DC=COM,DC=HK         
and backlink on          CN=NTDS Settings,CN=DC3,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=COM,DC=HK          are correct.
         ......................... DC3 passed test VerifyReferences
      Test omitted by user request: VerifyEnterpriseReferences
      Test omitted by user request: CheckSecurityError
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   Running partition tests on : domain
      Starting test: CrossRefValidation
         ......................... domain passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... domain passed test CheckSDRefDom
   Running enterprise tests on : domain.COM.HK
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope          provided by the command line arguments provided.
         ......................... domain.COM.HK passed test Intersite
      Starting test: FsmoCheck
         Warning: Couldn't verify this server as a GC in this servers AD.
         GC Name:
\\dc1.domain.COM.HK
         Locator Flags: 0xe00003fd
         PDC Name:
\\dc1.domain.COM.HK
         Locator Flags: 0xe00003fd
         Time Server Name:
\\dc1.domain.COM.HK
         Locator Flags: 0xe00003fd
         Preferred Time Server Name:
\\dc1.domain.COM.HK
         Locator Flags: 0xe00003fd
         KDC Name:
\\dc1.domain.COM.HK
         Locator Flags: 0xe00003fd
         ......................... domain.COM.HK passed test FsmoCheck
      Test omitted by user request: DNS
      Test omitted by user request: DNS