DsBindWithSpnEx() failed with error -2146892976

We are in the process of upgrading our Active Directory domain to Windows
2003. We have a empty forest and several domains in the forest each with
multiple sites. The forest root has one Windows 2003 DC and the rest are
Win2k. The various other domains and sites are in the process of being
upgrading so each has both Win2k3 dc's and Win2k.

I have just recently upgraded both dc's in my site to Win2k3. Before the
upgrade one of my dc's in this site replicated back to the forest and all the
other dc's in my domain (all sites in my domain) replicated back to this
domain controller.

Since the upgrade this dc shows the error pasted below when I run a dcdiag.
However, dcdiag on the other dc's in this site do not show any such error.
My dc is Windows 2003 (non sp1) based and the server mentioned in the error
is a Windows 2000 SP4 server.

Anyone have any ideas why this error has started since the upgrade? These
two dc's replicated without errors like this for over a year until this
upgrade.

IStarting test: KnowsOfRoleHolders
[LEBAD-SRV01] DsBindWithSpnEx() failed with error -2146892976,
The system detected a possible attempt to compromise security.
Please ensure that you can contact the server that authenticated you..
Warning: LEBAD-SRV01 is the Schema Owner, but is not responding to
DS RPC Bind.
[LEBAD-SRV01] LDAP bind failed with error 8341,
A directory service error has occurred..
Warning: LEBAD-SRV01 is the Schema Owner, but is not responding to
LDAP Bind.
Warning: LEBAD-SRV01 is the Domain Owner, but is not responding to
DS RPC Bind.
Warning: LEBAD-SRV01 is the Domain Owner, but is not responding to
LDAP Bind.
......................... USFBGAD01 failed test KnowsOfRoleHolders

Thanks,
Wayne

There's a number of suggestions in here:
-- http://support.microsoft.com/?id=839880

I would point that DC (the OM holder) to another DC for DNS and restart
NETLOGON after ensuring that it's configured to register in DNS and the DHCP
Client Service is running.

Then I would replicate using REPLMON and then change the DNS back to
wherever it was.

After that I would check the event logs then run the test agian.

I assume the FSMO holder is still online?

--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net

I'm receiving the exact same issue, and I do have my DC (erroring) pointed
another DNS server.
Also what I found was is you run Dcdiag from the 03 service packs files, it
gives you that error. However, if you install the win2k resource kit on the
03 server, it will give you the connectivity error. I also have SP1 on both
my DC's and only the BDC emulator is giving me this error.


"Paul Williams [MVP]" <ptw2001@hotmail.donotspam.com> wrote in message
news:85276A13-30FF-4C40-9445-B374AF0D3144@microsoft.com...
> There's a number of suggestions in here:
> -- http://support.microsoft.com/?id=839880
>
> I would point that DC (the OM holder) to another DC for DNS and restart
> NETLOGON after ensuring that it's configured to register in DNS and the
DHCP
> Client Service is running.
>
> Then I would replicate using REPLMON and then change the DNS back to
> wherever it was.
>
> After that I would check the event logs then run the test agian.
>
> I assume the FSMO holder is still online?
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>