Active Directory computer account password not in sync

Question

I have a computer on a remote location which has not not been connected to the network for a while. During an recent installation, a procedure went wrong and its password was changed on AD side. I can't remotely leave/rejoin domain on this computer.

Is it enough to reset its password to %computername%$ as it seems to been implied here (http://technet.microsoft.com/en-us/library/ee198778.aspx) or do I need to restore the computer account on AD to a date before the password was wrongly changed ?

Or maybe there is an intermediate solution ?

Computer is on W7, AD is W2008

Thanks for your help

PS : I did search for a similar question, but what I've found is quite unconclusive : what to do if i accidentally reset the computer account

Solution 1

You may want to pull down a copy of nltest and verify the trust relationship: nltest /sc_verify:*<domainName>*

If the trust is broken, you should still be able to move the workstation to a workgroup (might display an error when you do, but it will still move it to a workgroup). Reset the computer account in ADUC, and rejoin the computer to the domain. I'm not sure why you wouldn't be able to do this remotely.

The script from the article you linked to should work as well. Or, you can use netdom to reset the computer account if you didn't want to use a script.

netdom reset *<computername>* /domain:*<domainName>*

Solution 2

I'm not clear what is meant by 'password was wrongly changed'. Computers manage their own passwords, and those passwords do not expire. There would be no need to change a computer's password.

If the computer account was reset, it needs to leave and re-join the domain.

Comments

[Rex]

Technically, he didn't say the password was wrongly changed, he stated that a procedure went wrong and the password was changed. It can happen - ie: virtual machines rolling back to old snapshots. He also says that he hasn't reset the computer account - provided he hasn't reset the computer account yet, he could reset the passwords and reestablish the machine/domain trust.