Home / server / Questions / 127678
Accepted
TheCodeMonk
Asked: 2010-03-31 05:48:58 +0800 CST

The session setup from the computer <computerName> failed to authenticate

  • 772

Every once in a while, I get a client PC that won't be able to log into the domain. This morning it was telling us that the trust relationship between the pc and the domain failed. I checked the event logs on the primary domain controller and I see this for 2 PCs (the one that had the problem and one that can log in today).

The session setup from the computer failed to authenticate. The name(s) of the account(s) referenced in the security database is . The following error occurred: Access is denied.

I know how to fix this, by rejoining the PC to the domain... But why does this happen and how can I prevent it so I don't have to keep rejoining PCs to the domain?

windows-server-2008 active-directory windows-7

1 Answers

  1. Best Answer

    Computers joined to a domain manage their membership by use of a shared secret. Basically, all computers on the domain have their very own account password, just like all your user accounts.

    The difference is that the computers maintain this themselves, without any involvement from you and without you ever seeing what that password is. The machine periodically goes through a password change where a new password is generated and updated on both the computer and the AD computer account object.

    What you're seeing is a situation where the password stored on the domain and the password the computer believes is valid, are not the same. This could happen for a multitude of reasons but the most common ones are:

    • Restoring a computer from backup, and restoring an invalid password along with it
    • Reverting a computer VM to a snapshot which was taken before the latest password update
    • Reverting a domain controller vm to a snapshot or restoring a DC from a backup without using recovery mode, and causing a USN Rollback scenario (don't do this!)
    • Replication errors on the domain leaving a domain controller with outdated password information.

    So to fix it, watch for issues similar to the above. Any cases where either the domain or the workstation could be ending up with a stale or corrupted account password will bring you this issue.

    • 1