Home All Groups Group Topic Archive Search About
Author
8 Jun 2005 9:44 PM
Jerry
We currently have a couple of XP pro pcs on our network.  We needed to
change there network passwords (Server 2003 AD).  After changing them on the
server, they could not login into the domain.  Do you have to change
anything on the client PC or does changing it on the server (active
directory user and computers) get the job done.  We changed them back to the
original for now.

Thanks for your response...

Author
9 Jun 2005 6:48 AM
Glenn LeCheminant
ok.
changing a computer account password on the server as you say (from active
directory user and computers)....I'm assuming you mean right click the
computer account and choose 'reset account'.
This is a very bad thing.  This essentially throws out all knowledge of a
computer account password and resets it to I think computername$.
When the workstation reboots and trys to establish a secure channel, it will
fail, because the DC no longer has the password for the computer, and
essentially does not trust the computer.
The computer has no knowledge of what you have done on the DC.
You are forced to disjoin and rejoin the computer at this point.

If fact it is far too easy do this in my opinion.  It should not be a
context menu item.
This is something to do when your system cannot establish a secure channel,
you have exhaused all troubleshooting steps (kerberos, nltest, netdom, DNS,
networking), and have decided to resort to disjoining and rejoining.
In fact, 'reset account' is not required when disjoning and rejoining the
computer.
I'm really not sure what the value of this feature is.

--
Glenn LeCheminant
CCNA, MCSE 2000/2003 + Security

Show quoteHide quote
"Jerry" <jts023***@yahoo.com> wrote in message
news:u%23n50MHbFHA.3840@tk2msftngp13.phx.gbl...
> We currently have a couple of XP pro pcs on our network.  We needed to
> change there network passwords (Server 2003 AD).  After changing them on
> the
> server, they could not login into the domain.  Do you have to change
> anything on the client PC or does changing it on the server (active
> directory user and computers) get the job done.  We changed them back to
> the
> original for now.
>
> Thanks for your response...
>
>

Bookmark and Share