Hi all,
We have a UCS (5.2) domain at various locations. We started a migration to Windows by placing a Windows Domain controller alongside the UCS server in the domain. This was not very straightforward. Eventually, it seemed to work well. However, after more than a month, we encountered problems with the Windows servers. The computer account password had expired (after 30 days) and Windows was unable to automatically renew it.
Because the computer account password was no longer valid, there was no longer a secure channel, and problems arose with several services running under the system account “NT AUTHORITY\SYSTEM”, including DNS, Directory Service, etc. As a result, the server was virtually unusable, and Active Directory was not running properly—no replication, nothing. After searching for a very long time, we also discovered that the computer account of this Windows server could not be edited; not a single attribute, not even a “description” field. Every attempt to make a change resulted in the error:
“The following Active Directory Domain Services error occurred: While processing a change to the DNS Host Name for an object, the Service Principal Name values could not be kept in sync”.
Every attempt to restore the computer account secure channel (netdom resetpwd…) failed, presumably because the computer account object does not accept any changes, not even a new secure channel password. After searching even longer, I encountered another error message resulting from an attempt to make a change via LPD.exe: “ERROR_DS_COULDNT_UPDATE_SPNS error (Windows Error 8525 or 0x214D) and
0000214D: SvcErr: DSID-033E0CB7, problem 5012 (DIR_ERROR), data 590340”. After searching even further, I came across this error message: “problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90203 (serverReference)”.
After searching even longer, I encountered a problem that presumably originates from UCS, causing this issue. It concerns an attribute named “serverReference” that has been placed at the wrong level. Due to the internal AD database (NTDS) structure, a constraint is enforced, and consequently, every modification to the computer account object is refused.
The error lies in the following object: CN=NTDS Settings,CN=SRV2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=XXXXX,DC=XXXX,DC=eu
and specifically the attribute: serverReference. This must therefore not be filled! It must be set to: (not set), but one level higher; so at level “SRV2”, the “serverReference” attribute must be filled. This must literally refer to the computer account to which this site configuration relates.
So, as soon as you clear the serverReference (at the wrong level), you can reset the secure channel and everything works as it should again. Changes to the computer account object are also possible again.
Currently we have this problem under control (after weeks of searching :), however, we still have situations where UCS is running in combination with Windows. And the error returns after a while, presumably originating from UCS. Is there a possibility that the AD synchronization of CS contains an error causing serverReference to be set at the wrong level by UCS?