Event ID 11 KCC

I'm seeing this error on some child domain controllers:

Event ID 11
Source KDC
There are multiple accounts with name cifs/dc.parentdomain.com of type
DS_SERVICE_PRINCIPAL_NAME.

The duplicate account references a DC in the parent domain. Only one child
domain's DCs are logging this error. I've done a dump using ldifde and done
an ldp search for both the parent and child domain, and I cannot find even
one servicePrinipalName entry that matches the error, much less multiples.

I'm stuck, any suggestions?

look at this
http://www.planetmagpie.com/techtips...e-accounts.htm

see if it fits

--
Hope it helps...........

dw

Don Wilwol
Blog - http://spaces.msn.com/members/wilwol/
Web - http://capital.net/~wilwol/dw.htm
DonWilwol(REMOVE)@yahoo.com

"James" <James@discussions.microsoft.com> wrote in message
news:4FB5AB97-431C-468F-9CF9-72C57D91966A@microsoft.com...
> I'm seeing this error on some child domain controllers:
>
> Event ID 11
> Source KDC
> There are multiple accounts with name cifs/dc.parentdomain.com of type
> DS_SERVICE_PRINCIPAL_NAME.
>
> The duplicate account references a DC in the parent domain. Only one child
> domain's DCs are logging this error. I've done a dump using ldifde and
> done
> an ldp search for both the parent and child domain, and I cannot find even
> one servicePrinipalName entry that matches the error, much less multiples.
>
> I'm stuck, any suggestions?

http://www.microsoft.com/technet/pro...ceede4744.mspx

should have thrown this in also.

--
Hope it helps...........

dw

Don Wilwol
Blog - http://spaces.msn.com/members/wilwol/
Web - http://capital.net/~wilwol/dw.htm
DonWilwol(REMOVE)@yahoo.com

"James" <James@discussions.microsoft.com> wrote in message
news:4FB5AB97-431C-468F-9CF9-72C57D91966A@microsoft.com...
> I'm seeing this error on some child domain controllers:
>
> Event ID 11
> Source KDC
> There are multiple accounts with name cifs/dc.parentdomain.com of type
> DS_SERVICE_PRINCIPAL_NAME.
>
> The duplicate account references a DC in the parent domain. Only one child
> domain's DCs are logging this error. I've done a dump using ldifde and
> done
> an ldp search for both the parent and child domain, and I cannot find even
> one servicePrinipalName entry that matches the error, much less multiples.
>
> I'm stuck, any suggestions?

That pretty much describes what I've already tried. Doing an ldifde dump of
the directory doesn't show any instance of cifs/domaincontroller, but I'm
still getting the errors in the logs.

"Don Wilwol" wrote:

> look at this
> http://www.planetmagpie.com/techtips...e-accounts.htm
>
> see if it fits
>
> --
> Hope it helps...........
>
> dw
>
> Don Wilwol
> Blog - http://spaces.msn.com/members/wilwol/
> Web - http://capital.net/~wilwol/dw.htm
> DonWilwol(REMOVE)@yahoo.com
>
> "James" <James@discussions.microsoft.com> wrote in message
> news:4FB5AB97-431C-468F-9CF9-72C57D91966A@microsoft.com...
> > I'm seeing this error on some child domain controllers:
> >
> > Event ID 11
> > Source KDC
> > There are multiple accounts with name cifs/dc.parentdomain.com of type
> > DS_SERVICE_PRINCIPAL_NAME.
> >
> > The duplicate account references a DC in the parent domain. Only one child
> > domain's DCs are logging this error. I've done a dump using ldifde and
> > done
> > an ldp search for both the parent and child domain, and I cannot find even
> > one servicePrinipalName entry that matches the error, much less multiples.
> >
> > I'm stuck, any suggestions?
>
>
>

next thing i would do is check DNS records for the dns server from the dc
throwing the errors. Maybe even point it to another DNS server to see if the
errors go away. It could be a stuck dns entry that needs to be removed.

dw

--
Hope it helps

dw

_______________________________
Don Wilwol
donwilwol(DELETE)@yahoo.com
http://spaces.msn.com/members/wilwol/


"James" <James@discussions.microsoft.com> wrote in message
news:61E78069-357B-433B-BE2A-FA22237A4A6C@microsoft.com...
> That pretty much describes what I've already tried. Doing an ldifde dump
> of
> the directory doesn't show any instance of cifs/domaincontroller, but I'm
> still getting the errors in the logs.
>
> "Don Wilwol" wrote:
>
>> look at this
>> http://www.planetmagpie.com/techtips...e-accounts.htm
>>
>> see if it fits
>>
>> --
>> Hope it helps...........
>>
>> dw
>>
>> Don Wilwol
>> Blog - http://spaces.msn.com/members/wilwol/
>> Web - http://capital.net/~wilwol/dw.htm
>> DonWilwol(REMOVE)@yahoo.com
>>
>> "James" <James@discussions.microsoft.com> wrote in message
>> news:4FB5AB97-431C-468F-9CF9-72C57D91966A@microsoft.com...
>> > I'm seeing this error on some child domain controllers:
>> >
>> > Event ID 11
>> > Source KDC
>> > There are multiple accounts with name cifs/dc.parentdomain.com of type
>> > DS_SERVICE_PRINCIPAL_NAME.
>> >
>> > The duplicate account references a DC in the parent domain. Only one
>> > child
>> > domain's DCs are logging this error. I've done a dump using ldifde and
>> > done
>> > an ldp search for both the parent and child domain, and I cannot find
>> > even
>> > one servicePrinipalName entry that matches the error, much less
>> > multiples.
>> >
>> > I'm stuck, any suggestions?
>>
>>
>>

James if you haven't figured this one out then try this...

ldifde -f ldif.txt -t 3268 -d "DC=parentdomain,DC=com" -l
serviceprincipalname -r "(serviceprincipalname=host/dc*)" -p subtree

You most likely have two computer objects with the same HOST/dc or
HOST/dc.parentdomain.com attribute value. I am pretty certain this should be
unique accross the forest.

-Eddie Joyner
"James" wrote:

> I'm seeing this error on some child domain controllers:
>
> Event ID 11
> Source KDC
> There are multiple accounts with name cifs/dc.parentdomain.com of type
> DS_SERVICE_PRINCIPAL_NAME.
>
> The duplicate account references a DC in the parent domain. Only one child
> domain's DCs are logging this error. I've done a dump using ldifde and done
> an ldp search for both the parent and child domain, and I cannot find even
> one servicePrinipalName entry that matches the error, much less multiples.
>
> I'm stuck, any suggestions?