none
Windows Server 2012 R2 Problem

    Question

  • I have this 4 error on event viewer at my server pc. Also failed when i tried to use command gpupdate. How to fix this. Please help me. Thanks

    1 - The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
    a) Name Resolution failure on the current domain controller. 
    b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

    2 - The DNS server was unable to open Active Directory.  This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it.  Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.

    3 - This computer is now hosting the specified directory instance, but Active Directory Web Services could not service it. Active Directory Web Services will retry this operation periodically.

     
     Directory instance: NTDS
     Directory instance LDAP port: 389
     Directory instance SSL port: 636

    4 - The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server srv-namlifa$. The target name used was LDAP/SRV-NAMLIFA. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (NAMLIFA.LOCAL) is different from the client domain (NAMLIFA.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

    Wednesday, November 9, 2016 4:13 AM

All replies

  • Can You please share the event ID as well?

    Thanks,


    Mayank Dhama

    Wednesday, November 9, 2016 4:41 AM
  • Event ID

    Q1 - ID:1055

    Q2 - ID:4000

    Q3 - ID:1202

    Q4 - ID:4

    Wednesday, November 9, 2016 4:44 AM
  • Refer below reference Links:

    Q1: 

    https://social.technet.microsoft.com/Forums/windows/en-US/865c747f-8e28-4f11-8fe4-1537443aff9c/the-processing-of-group-policy-failed-windows-could-not-resolve-the-computer-name?forum=winserverGP

    https://community.spiceworks.com/how_to/61280-event-1055-grouppolicy-fails-to-apply-computer-configuration-to-member-machine

    Q2:

    This indicated the Startup process. Refer below in detailed explanation:

    https://technet.microsoft.com/en-us/library/cc749336(v=ws.10).aspx

    Also see,

    https://technet.microsoft.com/en-us/library/cc735673(v=ws.10).aspx

    https://www.experts-exchange.com/questions/28530732/DNS-server-was-unable-to-open-Active-Directory-Event-ID-4000.html

    Q3:

    https://community.spiceworks.com/topic/100953-tons-of-scecli-event-warnings-in-event-log-event-1202-0x534

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/aa407f63-3b4f-41b2-ae2d-7904bc44a8ee/event-id-1202-scecli-on-domain-controllers?forum=winserverDS

    https://support.microsoft.com/en-us/kb/324383

    Q4:

    https://blogs.technet.microsoft.com/dcaro/2013/07/04/fixing-the-security-kerberos-4-error/

    https://social.technet.microsoft.com/Forums/windows/en-US/6b9bc939-9439-4b11-94a4-532d9a097150/event-id-4-security-kerberos-and-dns-issues?forum=winserverDS

    https://technet.microsoft.com/en-us/library/cc733987(v=ws.10).aspx

    Thanks,


    Mayank Dhama

    Wednesday, November 9, 2016 4:56 AM
  • Thanks Mayank Dhama. I'll try to do it and later i'll update to you. :)
    Wednesday, November 9, 2016 4:59 AM
  • Hi,

    Did you configure DNS configuration correctly?

    The preferred DNS should point to the IP address of domain controller.

    And you could see all domain members’ A records on DNS.

    In addition, if you has enabled firewall, you could try to disable firewall temporarily.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, November 10, 2016 9:44 AM
    Moderator