Kerberos: Event ID 4 after a domain controller IP change

During migration tests between VMware Workstation and Virtual Server 2005 R2 SP1, I created two domain controllers for the Networknet.nl domain. At one point, I had DNS issues and assigned the second domain controller’s IP address to the primary controller.

All my domain clients are now reporting the error below. The Kerberos client received a KRB_AP_ERR_MODIFIED error for the domain controller account. I have seen this before and plan to fix it by deleting the Active Directory DNS records.

Screen clipping taken: 12/2/2007, 2:18 PM

Clear the Active Directory DNS records

Open the Computer Management console and scroll down to the DNS snap-in. Locate the _msdcs zone and select all records except those marked (same as parent folder). Right-click and delete them.

Screen clipping taken: 12/2/2007, 2:21 PM

Go to the primary AD zone and select all other AD-related records.

Screen clipping taken: 12/2/2007, 2:24 PM

Select the records shown above, then right-click to delete them. Check that the domain controllers’ hostnames have the correct IP addresses.

Recreate the records

The DNS zones are now clean. To recreate the records required by Active Directory, do one of the following:

• Stop and restart the Netlogon service. For example, run "net stop netlogon & net start netlogon" in a command prompt.
• Reboot the domain controller

Verify the records after restarting the service or rebooting the domain controller.

These steps were performed in a lab environment. Be careful when deleting Active Directory DNS records in a production environment. If there are a dozen domain controllers, the service must be restarted or the server rebooted on all of them to recreate the records.

In the background, C:\WINDOWS\system32\config\netlogon.dns is imported into the DNS zones.