We have met a questions when use AD to set initial password.
3 computers are involved in this problem. One for primary DC, one for another DC, and the rest one is the MIIS server. MIIS will provision the user and set an initial password to AD. The MIIS is running with a domain account.
It works fine if PDC is active. But when disable the PDC(Disable the network connectivity), and then export the user to DC, an error will be generated: “the Kerberos password set operation failed ”. Meanwhile, event ID 531,673 in security log will be generated on the second DC.
Any clue?Friday, July 27, 2007 2:51 AM
THe PDC emulator role is a very important role....
When it is down it causes many issues...
Here's some info on this role.... This would explain why you are receiving errors when it is down...
MIIS uses Kerberos to set the password...
The PDC emulator is necessary to synchronize time in an enterprise. Windows 2000/2003 includes the W32Time (Windows Time) time service that is required by the Kerberos authentication protocol. All Windows 2000/2003-based computers within an enterprise use a common time. The purpose of the time service is to ensure that the Windows Time service uses a hierarchical relationship that controls authority and does not permit loops to ensure appropriate common time usage.
The PDC emulator of a domain is authoritative for the domain. The PDC emulator at the root of the forest becomes authoritative for the enterprise, and should be configured to gather the time from an external source. All PDC FSMO role holders follow the hierarchy of domains in the selection of their in-bound time partner.
In a Windows 2000/2003 domain, the PDC emulator role holder retains the following functions:
Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
Account lockout is processed on the PDC emulator.
Editing or creation of Group Policy Objects (GPO) is always done from the GPO copy found in the PDC Emulator's SYSVOL share, unless configured not to do so by the administrator.
The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.
This part of the PDC emulator role becomes unnecessary when all workstations, member servers, and domain controllers that are running Windows NT 4.0 or earlier are all upgraded to Windows 2000/2003. The PDC emulator still performs the other functions as described in a Windows 2000/2003 environment.
At any one time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest.
JoeTuesday, July 31, 2007 12:49 AM