Windows NT Netlogon services uses a secret LSA account and password to
communicate with Windows NT domain controllers using secure channels. For each
member in the domain, there is a secure communication channel with a domain
controller which I think of as a special form of VPN. The secure channel is used
by the Netlogon service on the member and on the domain controller to
communicate. The password of the secure channel is stored on the member itself
under an LSA secret entry and on the PDC in the SAM.
If a secure channel gets out of synch, NETDOM (
netdom.exe ) can reset it automatically. Prior to Windows NT SP4, to check a
secure channel remotely, NETDOM established a connection
with the PDC using the computer account and the password found in the LSA secret
$MACHINE.ACC. With SP 4, LSA secret values are no
longer returned to clients over the network and it prevented NETDOM from working.
Microsoft has released a new version that is compatible with Windows NT SP4
and later. Secure channels are no longer checked by comparing passwords on both
sides of the secure channel. The new release of NETDOM
relies on the NETLOGON service to query secure channels status.
When the secure channel fails, you will only be able to logon using local
accounts since the NETLOGON service has stopped itself. The NETDOM utility which shipped with Windows NT Resource Kit is
version 1.7 and will fix the secure channel failure. When run against a Windows
NT SP4 or later, you get the error message:
Access Denied
The newer Windows NT Resource Kit supplements should have the fixed version
of NETDOM. My tip Resource Kit Support Tools Updates has links
to the updated supplement and to the download site where you can get updated
executables. Click to download the new netdom.exe .
The new NETDOM adds the ability to force partial synchronization from a BDC
to a PDC:
NETDOM BDC \\BDCNAME /PARTIALSYNC
a ability to force full synchronization from a BDC to a PDC
NETDOM BDC \\BDCNAME /FULLSYNC
For related information:
Resource Kit Support Tools Updates
How to
Join a Domain From the Command Line
Resetting
Domain Member Secure Channel
NetLogon
Service Fails when Secure Channel Not Functioning
How to
Build and Reset a Trust Relationship from a Command Line
