Computer rename / join domain problem

[AndyE45]

(Also posted in Win XP forum)

We've run into something lately that I didn't think was possible.

We're running a Win2K AD and things are largely OK but recently we've run into the situation a few times where we rename a computer to a name of a computer account that already exists or join a computer to the domain with a name that matches an account that is likewise already in use. There is no warning during the operation, it's just allowed to proceed. As expected we then see Netlogon errors on the machines that are already on the domain with the same name.

It seems that the two computers are now sharing the same account. If I then rename the older computer it will be reflected in AD but it still has the netlogon errors in its system log. The new computer will then start to have Netlogon errors.

Has anybody else seen anything like this?

 

[elmurado]

One of the things which will differentiate the computer will be the SID's as they are unique. However, you will have netlogon problems. I think you may have to remove the machine from the domain(you need domain admin to do this) and then login as local admin(must have password for this)rename it(uniquely) and then rejoin the domain(You'll need domain admin login for this). This will reset the computer account and create a new trust/password for the comp account etc.
Do it with both machines and see how that goes.
having two machines with same name will always cause problems--similar if you had two identical ip's.

 

[aftertaf]

and if it gets a bit messed up and you find yourself a bit stuck for rejoining...
make sure all names are unique and on the PC that will not join, run a tool called NewSID.

http://www.sysinternals.com/ntw2k/source/newsid.shtml

Aftertaf

"Solutions are not the answer." - Richard Nixon

 

[AndyE45]

elmurdo and afteraf,

Thanks for your reponses.

I should have been a little clearer in my initial posting. We know about machine SID's and the Newsid utility, we use it all the time.

My question is how is this possible? The unique account names and SID's for each account should have prevented this from happening. When either operation is attempted we should have gotten an warning about the name\SID conflict and the operation should have been disallowed.

We know how to fix the problems after they've happened but the big question is why were the operations allowed to go through unchallenged in the first place?

 

[aftertaf]

one more hole in microsoft's world domination plan Operating Systems i imagine...

Aftertaf

"Solutions are not the answer." - Richard Nixon