Microsoft KB Archive/180114

= Netlogon Event ID 5770 and 5722 on Primary Domain Controller =

Article ID: 180114

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Advanced Server 3.1
 * Microsoft Windows NT Workstation 3.1
 * Microsoft Windows NT Advanced Server 3.1
 * Microsoft Windows NT Workstation 3.5
 * Microsoft Windows NT Workstation 3.51
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 3.5
 * Microsoft Windows NT Server 3.51
 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q180114



SYMPTOMS
The following errors may occur in Windows NT when connecting to a Windows NT Workstation or a member Windows NT Server computer with User Manager or Server Manager:

The trust relationship between this workstation and the domain failed.

Additionally, the following 5770 and 5722 errors may occur in the event log on a primary domain controller:

Netlogon Event ID 5722:

The session setup from the computer CSWINS failed to authenticate. The

name of the account referenced in the security database is CSWINS$. The

following error occurred:

Access is denied.

Netlogon Event ID 5770:

The session setup to the Windows NT Domain Controller <\\server> from

computer CSWINS using account CSWINS$ failed. CSWINS2 is declared to be

a BDC in domain . However, CSWINS2 tried to connect as

either a DC in a trusted domain, a member workstation in domain

, or as a server in domain . Use the Server

Manager to remove the BDC account for CSWINS.

And the following errors will occur on the target workstation or member server:

Netlogon Event ID 5719:

No Windows NT Domain Controller is available for domain .

The following error occurred:

There are currently no logon servers available to service the logon

request.

NOTE: This event is expected and can be ignored when booting with the No Net Hardware Profile.

Netlogon Event ID 3210:

Failed to authenticate with <\\server>, a Windows NT domain controller

for domain .



CAUSE
Workstation and stand-alone server computer accounts are mistakenly treated as LanMan backup domain controllers (BDC) by the primary domain controller (PDC). LanMan BDCs are declared as such in a Windows NT domain by creating a special Windows NT global group called servers, creating user accounts that correspond to the computer names of the LanMan BDCs, and placing those user accounts in the servers group.

Authentication with the PDC fails when the accounts in the servers group are actually Windows NT workstations and servers. This is because Windows NT will use the secure channel account password against to authenticate with the PDC. The PDC finds a matching user account in the servers group for the Windows NT system and treats it as a LanMan BDC. During challenge/response authentication, the PDC uses the user account password instead of the secure channel password to authenticate the Windows NT system. This causes the errors noted in the summary.



RESOLUTION
If no LanMan BDCs exist, then remove the servers group and restart the Netlogon service on the PDC.

If LanMan BDCs exist, then remove the user accounts for the Windows NT systems experiencing this problem from the servers group. Restart the Netlogon service on the PDC.

Keywords: kbprb KB180114

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.