BDC Secure Channel May Fail If More Than 250 Computer Accounts

MORE INFORMATION

For each BDC, there is a discrete communication channel (the secure channel) with the PDC. The secure channel is used by the NetLogon service on the BDC and on the PDC in order to communicate.

When a BDC is part of a domain, a computer account is created (the computer account can be seen with Server Manager.) A default password is given to the computer account and the BDC stores the password in LSA secret storage $machine.acc.

Each BDC maintains such an LSA secret, which is used by the NetLogon service in order to establish a secure channel.

The problem described above is not related to the secure channel's password. The NetLogon service fails to start on the BDC even though the BDC computer's account password and BDC secret $machine.acc are synchronized. This can be checked with NETDOM utility provided with Windows NT 4.0 Resource Kit Supplement 2 by running the following command on the BDC:

   netdom bdc \\bdcname /query
				

The output looks similar to the following:

   NetDom 1.2 @1997.
   Querying domain information on computer \\BDCNAME ...
   The computer \\BDCNAME is a domain controller of DOMAIN.
   Searching PDC for domain DOMAIN ...
   Found PDC \\PDCNAME
   Verifying secure channel on \\BDCNAME ...
   Verifying the computer account on the PDC \\PDCNAME ...
   Secure channel checked successfully.
				

NOTE: If you receive the error message below, please see the following article in the Microsoft Knowledge Base:


150518 NetLogon Service Fails when Secure Channel Not Functioning