Logon Script Failure LSASRV (SPNEG0)

[Amitgujaran]

We are using Windows 2003 Active Directory environment and in that recently we noticed that some of the XP SP2 computers fail sometimes to run the users logon script, that is provided by the AD user profiles. If this happens then we get the below errors in their event logs:

Application Log:
Source: Userenv
Description: Windows connot determin the user or computer name. (The RPC
server is unavailable). Group Policy processing aborted.

Then sequentially from the System Log: A series of LSASRV (SPNEG0) events including

"The Security System detected an attempted downgrade attack for server cifs/servername. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon request. (0xc000005e)".

"The Security System could not establish a secured connection with the server cifs/servername. No authentication protocol was available."

The Security System detected an attempted downgrade attack for server cifs/logonserver. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)".

The Security System could not establish a secured connection with the server cifs/logonserver. No authentication protocol was available.

The Security System detected an attempted downgrade attack for server cifs/servername. The failure code from authentication protocol Kerberos was
"There are currently no logon servers available to service the logon request. (0xc000005e)".

We get the DNS server automatically and I tried hardcoding the proper and alternate DNS server with it, but the problem continues. So, is there anyone who can help us to sort this issue? Thanks.

[Techguru01]

Did you ensure that you are using the right DNS? Can you try to run 'netdiag /test:dns' at Start. You can also try to run 'dcdiag /v /c /e' and check it out. Also, try to do a 'nltest /dsgetdc:domainName.com' and see if that works or fails? There are other commands like 'nltest /dsgetsite' or 'nltest /dnsgetdc:domainName.com' that you can try as well.