|
Posted by Steven L Umbach on June 16, 2006, 3:00 pm
Please log in for more thread options Heh Heh. Glad you sorted it out and thanks for reporting back what you
found. Good thing you didn't delete a whole bunch of accounts though an
authoritative restore of AD for that container would have fixed the
roblem. --- Steve
>
>>I suppose it is possible that AD did not replicate that the computer
>>account was disabled to all domain controllers but I would think that
>>problem would make itself aware to you in a three month time period and
>>the support tools dcdiag and replmon could verify replication problems as
>>would errors in the logs of the domain controllers. You might find helpful
>>information in the logs of the client computer like type 11 cached logons
>>and also searching the security logs of the domain controllers for the
>>computer names to see if any computer account logon failures or other
>>helpful information have been recorded in that time period of course a lot
>>depends on the size of the security logs on your domain controllers as to
>>how far back they have information. You can use the free Event Comb from
>>Microsoft to search the security logs of the domain controllers and enter
>>text strings in the searches such as for the computer name though I would
>>also search for the computer name with $ after it which you often will see
>>in the security logs indicating that the account is a computer account.
>>The other thing I would verify is that someone else had not fixed the
>>computer account issue after you had disabled it and not assume it still
>>was disabled when you deleted the computer accounts. --- Steve
>
> After further investigation, as per usual, this is turning out to be a
> user problem (i.e. ME). Using ldp.exe I have looked at the properties of
> the 4 accounts we've had issues with, and they differ from the other 300+
> accounts I deleted in one way; they weren't disabled when I deleted them.
>
> Account that didn't have a problem:
>
> 1> userAccountControl: 0x1002 = ( UF_ACCOUNTDISABLE |
> UF_WORKSTATION_TRUST_ACCOUNT );
>
> Account that did have a problem:
>
> 1> userAccountControl: 0x1000 = ( UF_WORKSTATION_TRUST_ACCOUNT );
>
> I got the names of the 4 PCs in question from the Helpdesk agents and
> noticed they were consecutive alphabetically, which seemed even less
> likely than the rest of the scenario, so I got to wondering if perhaps as
> I manually deleted a bunch around them I used my SHIFT key when I should
> have been using my Ctrl key. That's my best guess. My bad (my "DOH!" of
> the week), and that beats the hell out of the alternative that it was some
> kind of bizarre AD issue.
>
> Thanks for helping me out both Joe and Steve. Another mystery solved.
>
| 
XML Sitemap