The secure channel is used to validate the member servers or workstations membership in the domain, based upon its hashed password. This discrete communication channel helps provide a more secure communication path between the domain controller and the member servers or workstations.  It can also be used to change the accounts password, and to retrieve domain-specific information, handling NTLM authentication pass-through to the domain controller, or from DC to DC for the same.   

When you join a computer to a domain, a computer account is created, and a password is shared between the computer and the domain. By default, this password is changed every 30 days. The secure channel's password is stored together with the computer account on the domain controllers.  Upon starting, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC. After the machine account is verified, the workstation establishes a secure channel with that DC.   If it is a DC,  when you start a PDC, Netlogon builds a list of all the BDCs in the domain, and a list of trusted domains. At this time, Netlogon attempts to set up a secure channel with a DC from each trusted domain, and if this attempt does not succeed, Netlogon does not make another attempt until a secure channel with that domain is explicitly needed.  The BDC's behavior is similar. While Netlogon on a BDC does not enumerate other BDCs, it does contact the DC and sets up secure channels with trusted domains as needed.

Therefore, the Netlogon service on a workstation sets up a secure channel to a DC in its primary domain.  The Netlogon service on a BDC sets up a secure channel to the PDC in its domain.  The Netlogon service on a PDC sets up a secure channel to a DC in each of it trusted domains.

If there are problems with system time, DNS configuration or other settings, secure channel’s password between domain members and DCs may not synchronize with each other. AD replication issue, other electronic problems may cause secure channel broken to member servers. To DCs, the secure may broken due to communication issues.

When secure channel is broken, it may cause a lot of problems to Active Directory. Here we summarize some symptoms which indicate secure channel is broken. If you see the behavior, you can first check the secure channel before performing any further troubleshooting.  

1. Replication error

When you use the Active Directory Sites and Services snap-in to manually replicate data between domain controllers, you may receive one of the following error messages:

The Target Principal Name is incorrect

-or-

Access is denied

You may get Netlogon event ID 3210, 5722 or NTDS KCC event 1925. For example, the following event ID messages may be logged in the system log:

Event Source: Netlogon
Event Category: None Event ID: 3210
User: N/A Event Description:
Failed to authenticate with \\DOMAINDC, a Windows NT domain controller for domain DOMAIN.

-and-

Event Source: Netlogon
Event ID: 5722
Event Category: None User: N/A Event Description:
The session setup from the computer 1 failed to authenticate. The name of the account referenced in the security database is 2. The following error occurred: n3

When you try to replicate changes between replica partners, you may receive the following error message:

The following error occurred during the attempt to synchronize the domain controllers.
The naming context is in the process of being removed or is not replicated from the specified server.

2. Logon error

The client may be unable to log on to the domain. You may receive the following error message:

“Windows cannot connect to the domain either because the domain controller is down or otherwise unavailable or because your computer account was not found.”

Or

"The system could not log you on. Make sure your username and domain are correct."

3. Accessing resource

When you attempt to access shares on a server, you may get error:

"System error 1396 - Logon Failure: The target account name is incorrect."

4.  Running nltest

nltest /sc_query: <domain_name> 

-- Access is denied.

If you encounter the above behavior or error messages, suggest first reset secure channel. On the computer that are experiencing this issue, disable the Kerberos Key Distribution Center service (KDC) and then restart the computer. After the computer restarts, use the Netdom utility to reset the secure channels between the computer and the PDC Emulator operations master role holder. To do so, run the following command from the computer other than the PDC Emulator operations master role holder:

netdom resetpwd /server:server_name /userd:domain_name\administrator /passwordd:administrator_password

Where server_name is the name of the server that is the PDC Emulator operations master role holder.

Note: This method only works for DC. If it’s member server, we have to disjoin and rejoin domain.

For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

260575 How to Use Netdom.exe to Reset Machine Account Passwords

(http://support.microsoft.com/kb/260575/EN-US/)

If the problem is not resolved or secure channel keeps being broken, you may need to find the root cause by performing further diagnosing or troubleshooting.

Two Microsoft Knowledge Base articles have been recently published to clarify and update Microsoft Support Policy on Exchange Tools. Microsoft Customer Support Services (CSS) supports the Microsoft Exchange Server 2003 tools that you can download from the Microsoft Download Center Web site. Support includes installation and usage of the tools, as well as errors encountered while using the tools.

CSS supports the Exchange Server 2003 tools that you can download from the Download Center

http://support.microsoft.com/?id=928583

The Exchange Server Quota Message Service tool is supported by Customer Support Services

http://support.microsoft.com/?id=928582

With improvements in Exchange Server 2007, some of the common issues hit by users when using the Out of Office Assistant are addressed:

l   Users sometimes forget to turn the Out of Office assistant on and off, because it cannot be scheduled in advance. Exchange Server 2007 provides end users the ability to schedule OOF times in the future.

l   Users would like to send more detailed Out of Office information to their co-workers, but send more generic information to external senders. Exchange Server 2007 allows end users to set separate internal and external OOF messages.

l   Some users want to send their Out of Office messages only to a limited set of external contacts, but not anyone who might email them – for privacy reasons. In Exchange Server 2007, users can choose to send their external OOF message only to their external contacts.

Exchange Server 2007 provides both end-users and administrators with great flexibility in configuring OOF to well meet various requirements. The article at Microsoft Exchange Tam Blog Web site contains details on this topic http://msexchangeteam.com/archive/2006/10/06/429115.aspx

A lot of Outlook issues are caused by various add-ins. So, disabling all add-ins is a useful step and should be the first step for Outlook troubleshooting.

Please note every add-in will be a subkey under the following subkeys.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins

HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Extensions

HKEY_CURRENT_USER\Software\Microsoft\Exchange\Client\Extensions

So, to disable all add-ins thoroughly, we can follow the steps below.

1.    Click start -> Run… -> Type "regedit" (without quotation mark) and Click OK

2.    Locate the following subkey

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins

3.    Backup and Delete all subkeys under above subkey

4.    Repeat step 1-3 for the remain 3 subkeys

HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins

HKEY_LOCAL_MACHINE\Software\Microsoft\Exchange\Client\Extensions

HKEY_CURRENT_USER\Software\Microsoft\Exchange\Client\Extensions

Now, all add-ins are disabled. If the issue disappears, it means the root cause is a conflict between Outlook and some add-in. We can restore the registry back and delete them one by one to find out which one cause the issue.