a Flo + a Blog = a Flog my ブログ

eventid 5719

I have recently removed an old domain DC. The current domain is somehow keeping record of this old domain and generate eventid 5719

System 2006-11-27 02:44:04 5719 NETLOGON This computer was not able to set up a secure session with a domain controller in domain XXX-CAN due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.

However, there is no trust anymore between those 2. So I guess there is some records of this somewhere on the DCs.

I searched the entire registry on the problem server and I found only one entry referring to the old domain. Here is the location and info that I found.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DomainCache
Default REG_SZ (value not set)
OldDomain REG_SZ
NewDomain REG_SZ NewDomain.local

Of course I would not recommend enough to export the registry key before deleting it. Once done, I hope this ghost domain will disappear!