Name inconsistent with trust information? Wha?

[zeveck]

I just tried to login to one of my machines and got:

---------------------------
Logon Message
---------------------------
The system cannot log you on due to the following error:

The name of security ID (SID) of the domain specified is inconsistent with the trust information for that domain.

Please try again or consult your system administrator.
---------------------------
OK
---------------------------

Does anybody know what causes this or how to troubleshoot it?

The machine in question is running Win2K3 SP1, and nothing else of interest. I can login fine from a WinXP SP2 machine in the domain, and can login fine from the DC.

 

[adcfaq]

u are in a lost SID mapping case, meaning, u have a trust domain is not reachable, so the other domain account can't be resolved, it will have something like s-1-2-3-121-1212-121, u need to locate that account and manually delete the entry somewhere in security tab.

-----
Directory Services/Exchange Consultant

 

[zeveck]

Could you possibly explain that a little more clearly / in more detail?

 

[porkchopexpress]

Does your domain trust another or did it in the past?

I beleive benlu it saying you are in a domain that trusts another domain and an account is trying to authenticate with the other domain but that domain cannot be contacted.

 

[zeveck]

No, this is a single domain with only three machines on it that I created this week. It worked fine yesterday.

 

[zeveck]

I've now tried rolling the computer back to a previous image from just before it joined the domain, have it re-join the domain, and then reset and have it try to login and it gets THE SAME ERROR.

 

[zeveck]

My apologies...I seem to have left out a key element of this, which is that it involves cloned computers. Evidently this is a known and common problem because the cloned computer has SIDs in conflict with the original system.

http://www.sysinternals.com/Utilities/NewSid.html

 

[porkchopexpress]

Think this might help regenerate your SID's

http://www.microsoft.com/windows2000/downloads/tools/sysprep/default.asp

 

[zeveck]

I looked at that before trying out NewSID, but it seemed to do a lot of other strangeness. What exactly is sysprep and what is its purpose?

 

[porkchopexpress]

It removes all SID's from a cloned PC, the next time you turn it on it generated a new set of SID's, this way non of your cloned boxes have identical SID's which would totally undermine NT's security.

http://www.networkcomputing.com/917/917ws1.html