I've got several Domain Controllers running on Server 2016, 2019, and even 2025, but recently, I've been facing some strange issues. For the last month or so, some machines are struggling with domain authentication, whether they're freshly imaged, upgraded, or just updated. I found a resource that mentioned possible issues, but it didn't help me out.
I noticed an entry in the event log indicating that a specific machine couldn't authenticate with a given DC, which could be due to either a name conflict with another computer on the network or an unrecognized password for the computer account. Even when I run the command Test-ComputerSecureChannel -Repair, it works for some machines but fails for others, while Test-ComputerSecureChannel alone returns as True.
What's worse is that users cannot log in at all when the issue occurs, even though they're entering the correct password. Sometimes, a machine will allow logins for a little while before locking everyone out again—it's pretty erratic. I'm stumped and would love to hear any advice on what else I might try or troubleshoot!
4 Answers
I'd recommend running a `dcdiag` on every server to check for any underlying issues. Also, using `repadmin /showreps` can help verify that everything is syncing correctly across the board.
Honestly, a lot of the time, these kinds of issues come down to DNS problems. It's a common culprit, so that's definitely worth checking out!
Couldn’t agree more! DNS issues can really mess things up.
Make sure to check your DNS, replication, and time settings on all servers. Any discrepancies here could lead to authentication problems.
Don’t forget to see where each DC thinks the FSMO roles are. If there was a split network issue before, that might definitely cause these kinds of authentication headaches.
Absolutely, `dcdiag` is a lifesaver for these situations!