This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 89%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEZ%3C/text%3E%3C/svg%3E)
Hello, in a large AD environment we have same issues reported on the page below:
Often when I reboot domain controller on branch office I'm not be able to logon, with the same issue:
System is restarted using the restart option in Windows. Server appears to start normally. Press CTRL-ALT-DEL to get a login prompt. User is administrator (or any other domain admin account), enter password and hit enter or click the arrow. The cursor is moved back to the beginning of the password field and the previously entered password remains.
This issue seems start happens after we raise the domain functionality level from 2003 to 2008 R2. Note: PDC is still on 2008 R2
After that no way to logon on DC's, only after many and many reboot server accepts credentials. Same issue if I try to isolate domain controller from network.
New domain controllers are also affects by this problem, immediatly after promotion still not be able to connect
Same errors in the event viewer reported on the thread.
We are working around this issue from many days, time is correct on every DC's.
Thanks in advance for the help to resolve this issue.
Enrico Z.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 36%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EF%3C/text%3E%3C/svg%3E)
Can you run "dcdiag /e /c /v /f:c:\temp\dcdiag.txt" and post the output
Hello Fabian-7704, thank you for reply.
Here attached log generated in a DC with issue.
Let me know if you need some other kind of informations
Enrico
As a community user I can only advise you to either search the dciag log for "failed test" and work through the errors one by one. You can start with the simple test (dcdiag /e /c without /v). Due to the number of domain controllers your environment does not seem to be very small, so I suggest opening a ticket at Microsoft.
Thank you!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 79%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Hi Enrico,
did you find a solution?
I have a similar problem with DC with OS 2016.
I think, something is wrong with our previous domain controllers (2008 or 2003).
YESSSSS!!! I open a case and MS identify that CN=Password Settings Container was missing.
Now it's ok!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 62%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDZ%3C/text%3E%3C/svg%3E)
Hello @Enrico Zocca ,
Thank you for your update and sharing.
I am very glad that the problem has been solved.
As always, if there is any question in future, we warmly welcome you to post in this forum again. We are happy to assist you!
Best Regards,
Daisy Zhou
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 76%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFC%3C/text%3E%3C/svg%3E)
@Enrico Zocca
Hello Enrico,
We have been experiencing this issue across our 2012 R2 Forest (All DC's 2012 R2). I have tested this fix and so far it seems to be working.
Do you have any additional information as to how or why CN = Password Settings Container was missing?
This is great news to have a fix, but I am still very curious regarding a root cause.
Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 69%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERH%3C/text%3E%3C/svg%3E)
You have NO IDEA how this helped me. HOLY CRAP I was pulling my hair out trying to solve this for WEEKS!!!! I was restoring DC's all over the place because once rebooted they were not allowing me to login. Same as your description. This ONE article on the ENTIRE internet had the solution! THANK YOU!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 92%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDS%3C/text%3E%3C/svg%3E)
Thank you so much for this answer about the CN=Password Settings Container. I have been trying to figure this out for months.
Hello @Enrico Zocca ,
Thank you for posting here.
1.Based on "Often when I reboot domain controller on branch office I'm not be able to logon, with the same issue", do you mean when reboot any one DC in the forest, this DC will have such issue?
2.Or only reboot this specific DC, this DC will have such issue?
3.Based on "New domain controllers are also affects by this problem, immediatly after promotion still not be able to connect", do you mean the issue is replicated between all the DCs in the forest?
Meanwhile, check the information below:
Best Regards,
Daisy Zhou
Hello @Enrico Zocca ,
Thank you for posting here.
1.Based on "Often when I reboot domain controller on branch office I'm not be able to logon, with the same issue", do you mean when reboot any one DC in the forest, this DC will have such issue?
2.Or only reboot this specific DC, this DC will have such issue?
3.Based on "New domain controllers are also affects by this problem, immediatly after promotion still not be able to connect", do you mean the issue is replicated between all the DCs in the forest?
Meanwhile, check the information below:
Best Regards,
Daisy Zhou
Hello @Enrico Zocca ,
Thank you for posting here.
1.Based on "Often when I reboot domain controller on branch office I'm not be able to logon, with the same issue", do you mean when reboot any one DC in the forest, this DC will have such issue?
2.Or only reboot this specific DC, this DC will have such issue?
3.Based on "New domain controllers are also affects by this problem, immediatly after promotion still not be able to connect", do you mean the issue is replicated between all the DCs in the forest?
Meanwhile, check the information below:
Best Regards,
Daisy Zhou
Hello @Daisy Zhou ,
Thank you for reply
1.Based on "Often when I reboot domain controller on branch office I'm not be able to logon, with the same issue", do you mean when reboot any one DC in the forest, this DC will have such issue? No, all 2012 R2 DC's are affects. 2008 R2 seems ok.
2.Or only reboot this specific DC, this DC will have such issue? No, all DC's 2012 R2 have this issue
3.Based on "New domain controllers are also affects by this problem, immediatly after promotion still not be able to connect", do you mean the issue is replicated between all the DCs in the forest? ****Yes.** For testing purpose we promoted a fresh new 2012 R2 server to DC, after first reboot logon is "hang", instead a fresh new DC 2008 R2 works without any issue **
We notice that AD replicate correctly on all DC's, also when DC's are in this strange "stall mode".
Keep in mind that this issue is observed immediatly time after we demote all 2003 DC's and raise forest/domain functional level to 2008 R2
The condition in which the domain controllers are after the reboot is strange, some services do not start (for example MSDTC) if you type the password, at logon screen, and press enter it does not work, even if you press the arrow next to the password field it does not work.
If you reboot the DC 10-20 or 30 times it may be that the services start and accept the credentials. the only condition in which you can logon is safe mode. When the DC starts correctly and you restart "Active Directory Domain Services" the services do not restart, you have to restart the DC and start again.
When the DC is in "stalled mode" you can remotely manage the event viewer but not the services or the registry
Check if AD environment is healthy. Check whether all DCs in this domain is working fine by running Dcdiag /v on each DC. We checking log as suggest by @Fabian . file is attached28290-dcdiag-full.txt
Check if AD replication works properly by running repadmin /showrepl and repadmin /replsum on each DC. Replication works fine
Check both SYSVOL folder and Netlogon folder are shared by running net share on each DC. Up and running on all DC's
Check we can update gpupdate /force on each DC successfully. Update is successfully
Regards.
Enrico
Hello @Enrico Zocca ,
Thank you for your update.
1.Do you install any third-part apps or programs on all the 2012 R2 DCs?
2.Or do you run any third-part services on all the 2012 R2 DCs?
3.Do you install all the updates on all the 2012 R2 DCs?
4.Do you install the same image for these 2012 R2 DCs?
5.Are all these 2012 R2 DCs running the same operating system (run winver to check)?
Best Regards,
Daisy Zhou