Windows 2000-based member computers always authenticate with the PDC in a Windows NT 4.0 domain (269262)

CAUSE

This problem occurs when a Windows 2000-based computer is joined to a domain, and the join process caches the domain controller that was used to join the domain.

When the computer restarts for the first time after it joins the domain, the computer reads the cached information from the registry and then uses the cached domain controller to set up a security channel. This action makes sure that the computer communicates with the domain controller that has the correct account information. However, this cached information is not removed unless Kerberos authentication is used. Therefore, a Windows 2000-based host always uses the cached information to establish a security channel with the PDC.

In a Windows NT 4.0 domain, users, computers, and groups can only be created on the PDC of a domain. Therefore, all Windows 2000 clients that join a Windows NT 4.0 domain establish a security channel with the PDC on the first restart after the clients join the domain.

This behavior may contribute to the following problems:

• Higher network use occurs as Windows 2000-based member computers establish security channels and perform logon authentication exclusively with the Windows NT 4.0 PDC. Windows 2000-based member computers ignore local Windows NT 4.0 BDCs for logon requests in favor of the PDC across the wide area network (WAN).
• Higher CPU use and longer logon requests occur as Windows 2000-based member computers use the Windows NT 4.0 PDC exclusively for logon authentication. The PDC typically has the highest CPU and memory use of all domain controllers in a domain.

Cached information in the registry is used by the Net Logon service and Kerberos client components.

The expected behavior is that after Kerberos is finished with the cache info, it writes KerbIsDoneWithJoinDomainEntry in the \Netlogon\Parameters section of the registry. The Net Logon service is notified by the registry. The service deletes the cached information so that next time the service establishes the security channel, member computers use a generic domain controller that is discovered through the 1C query in Windows Internet Name Service (WINS).

However, when Windows 2000-based member computers are joined to a Windows NT 4.0 domain, Kerberos does not write KerbIsDoneWithJoinDomainEntry. Therefore, all Windows 2000-based member computers that join a Windows NT 4.0 domain always authenticate with the domain's PDC, unless the PDC is unavailable or unless the security channel is reset manually.