Event error 5723 for non-existent comp account

I keep getting this error about a computer account that is not located in
ADUC. I am not sure where the remnants are coming from. Can I use ADSIedit,
to find this account or if it has been renamed to something else.

TIA,
Altria

BTW, 2003 and winxp3 clients

Thanks Meinolf for your fast reply!

No that is the problem, it is not needed in the domain but most likel;y it
was once attached. The account does not show up in AD (using
find>computers). Yet, it is getting consistently logged in the event viewer.
I want to know where the account exists or if it has been renamed to
something else so I can locate and disjoin. It seems that someone may not
have disjoined properly.


TIA,
Altria

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news: .com...
> Hello Altria,
>
> Is that machine used in your domain or not? If yes, rejoin it to the
> domain. Any firewall enabled on the clients?
>
> Also see here:
> http://www.eventid.net/display.asp?e...TLOGON&phase=1
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> I keep getting this error about a computer account that is not located
>> in ADUC. I am not sure where the remnants are coming from. Can I use
>> ADSIedit, to find this account or if it has been renamed to something
>> else.
>>
>> TIA,
>> Altria
>> BTW, 2003 and winxp3 clients
>>
>
>

Hello Altria,

Check on all DCs that it is not listed in AD UC, maybe a replication problem
exist. Within adsiedit you can check, have a look in CN=LostandFound. The
lostAndFound container is where objects that are orphaned during Active Directory
database replication are placed. It is also where you find objects that have
been moved to a new location that is missing after the server is replicated.
For example if an object is created after a replication cycle runs and that
object is then removed or deleted before the next replication cycle is initiated
the object is then sent to the LostAndFound container.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks Meinolf for your fast reply!
>
> No that is the problem, it is not needed in the domain but most
> likel;y it was once attached. The account does not show up in AD
> (using
>
find>> computers). Yet, it is getting consistently logged in the event
find>> viewer.
find>>
> I want to know where the account exists or if it has been renamed to
> something else so I can locate and disjoin. It seems that someone may
> not have disjoined properly.
>
> TIA,
> Altria
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
> news: .com...
>
>> Hello Altria,
>>
>> Is that machine used in your domain or not? If yes, rejoin it to the
>> domain. Any firewall enabled on the clients?
>>
>> Also see here:
>> http://www.eventid.net/display.asp?e...=106&source=NE
>> TLOGON&phase=1
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> I keep getting this error about a computer account that is not
>>> located in ADUC. I am not sure where the remnants are coming from.
>>> Can I use ADSIedit, to find this account or if it has been renamed
>>> to something else.
>>>
>>> TIA,
>>> Altria
>>> BTW, 2003 and winxp3 clients

Hello Meinolf,

I tried to look into the LF container but nothing is present. Also, it is
not a replication issue since I have been checking the DCs on a regular
basis with no luck.

Any other suggestion to track down missing objects in AD....

TIA,

Altria

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news: .com...
> Hello Altria,
>
> Check on all DCs that it is not listed in AD UC, maybe a replication
> problem exist. Within adsiedit you can check, have a look in
> CN=LostandFound. The lostAndFound container is where objects that are
> orphaned during Active Directory database replication are placed. It is
> also where you find objects that have been moved to a new location that is
> missing after the server is replicated. For example if an object is
> created after a replication cycle runs and that object is then removed or
> deleted before the next replication cycle is initiated the object is then
> sent to the LostAndFound container.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Thanks Meinolf for your fast reply!
>>
>> No that is the problem, it is not needed in the domain but most
>> likel;y it was once attached. The account does not show up in AD
>> (using
>>
> find>> computers). Yet, it is getting consistently logged in the event
> find>> viewer.
> find>>
>> I want to know where the account exists or if it has been renamed to
>> something else so I can locate and disjoin. It seems that someone may
>> not have disjoined properly.
>>
>> TIA,
>> Altria
>> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
>> news: .com...
>>
>>> Hello Altria,
>>>
>>> Is that machine used in your domain or not? If yes, rejoin it to the
>>> domain. Any firewall enabled on the clients?
>>>
>>> Also see here:
>>> http://www.eventid.net/display.asp?e...=106&source=NE
>>> TLOGON&phase=1
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> I keep getting this error about a computer account that is not
>>>> located in ADUC. I am not sure where the remnants are coming from.
>>>> Can I use ADSIedit, to find this account or if it has been renamed
>>>> to something else.
>>>>
>>>> TIA,
>>>> Altria
>>>> BTW, 2003 and winxp3 clients
>
>

Hello Altria,

The only idea i have that the machine is still running somewhere with the
old name, even if removed from the domain. Have you tried to ping it when
the entries occur?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hello Meinolf,
>
> I tried to look into the LF container but nothing is present. Also, it
> is not a replication issue since I have been checking the DCs on a
> regular basis with no luck.
>
> Any other suggestion to track down missing objects in AD....
>
> TIA,
>
> Altria
>
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
> news: .com...
>
>> Hello Altria,
>>
>> Check on all DCs that it is not listed in AD UC, maybe a replication
>> problem exist. Within adsiedit you can check, have a look in
>> CN=LostandFound. The lostAndFound container is where objects that are
>> orphaned during Active Directory database replication are placed. It
>> is also where you find objects that have been moved to a new location
>> that is missing after the server is replicated. For example if an
>> object is created after a replication cycle runs and that object is
>> then removed or deleted before the next replication cycle is
>> initiated the object is then sent to the LostAndFound container.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Thanks Meinolf for your fast reply!
>>>
>>> No that is the problem, it is not needed in the domain but most
>>> likel;y it was once attached. The account does not show up in AD
>>> (using
>>>
>> find>> computers). Yet, it is getting consistently logged in the
>> event
>> find>> viewer.
>> find>>
>>> I want to know where the account exists or if it has been renamed to
>>> something else so I can locate and disjoin. It seems that someone
>>> may not have disjoined properly.
>>>
>>> TIA,
>>> Altria
>>> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
>>> news: .com...
>>>> Hello Altria,
>>>>
>>>> Is that machine used in your domain or not? If yes, rejoin it to
>>>> the domain. Any firewall enabled on the clients?
>>>>
>>>> Also see here:
>>>> http://www.eventid.net/display.asp?e...no=106&source=
>>>> NE
>>>> TLOGON&phase=1
>>>> Best regards
>>>> Meinolf Weber
>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>> and
>>>> confers no rights.
>>>> ** Please do NOT email, only reply to Newsgroups
>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>> I keep getting this error about a computer account that is not
>>>>> located in ADUC. I am not sure where the remnants are coming from.
>>>>> Can I use ADSIedit, to find this account or if it has been renamed
>>>>> to something else.
>>>>>
>>>>> TIA,
>>>>> Altria
>>>>> BTW, 2003 and winxp3 clients

"Altria" <> wrote in message
news:...
> Hello Meinolf,
>
> I tried to look into the LF container but nothing is present. Also, it is
> not a replication issue since I have been checking the DCs on a regular
> basis with no luck.
>
> Any other suggestion to track down missing objects in AD....
>
> TIA,
>
> Altria

Altria,

Have you looked at this?
http://eventid.net/display.asp?event...TLOGON&phase=1

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer


For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right
things." - Peter F. Drucker
http://twitter.com/acefekay

"Ace Fekay [Microsoft Certified Trainer]" <>
wrote in message news:...
>
> Altria,
>
> Have you looked at this?
> http://eventid.net/display.asp?event...TLOGON&phase=1


Meinolf, I apologize. You already posted that link.

Cheers!

Ace

Hello Ace Fekay [Microsoft Certified Trainer],

No problem. Still have no additional ideas :-)

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Ace Fekay [Microsoft Certified Trainer]"
> <> wrote in message
> news:...
>
>> Altria,
>>
>> Have you looked at this?
>> http://eventid.net/display.asp?event...&source=NETLOG
>> ON&phase=1
> Meinolf, I apologize. You already posted that link.
>
> Cheers!
>
> Ace
>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news: .com...
> Hello Ace Fekay [Microsoft Certified Trainer],
>
> No problem. Still have no additional ideas :-)

Thanks. Neither do I, other than going through ADSI Edit with a fine toothed
comb looking for any references to that machine.

Ace

Yes I have tried to ping the box, no luck.......

TIA
"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
news: .com...
> Hello Altria,
>
> The only idea i have that the machine is still running somewhere with the
> old name, even if removed from the domain. Have you tried to ping it when
> the entries occur?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello Meinolf,
>>
>> I tried to look into the LF container but nothing is present. Also, it
>> is not a replication issue since I have been checking the DCs on a
>> regular basis with no luck.
>>
>> Any other suggestion to track down missing objects in AD....
>>
>> TIA,
>>
>> Altria
>>
>> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
>> news: .com...
>>
>>> Hello Altria,
>>>
>>> Check on all DCs that it is not listed in AD UC, maybe a replication
>>> problem exist. Within adsiedit you can check, have a look in
>>> CN=LostandFound. The lostAndFound container is where objects that are
>>> orphaned during Active Directory database replication are placed. It
>>> is also where you find objects that have been moved to a new location
>>> that is missing after the server is replicated. For example if an
>>> object is created after a replication cycle runs and that object is
>>> then removed or deleted before the next replication cycle is
>>> initiated the object is then sent to the LostAndFound container.
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Thanks Meinolf for your fast reply!
>>>>
>>>> No that is the problem, it is not needed in the domain but most
>>>> likel;y it was once attached. The account does not show up in AD
>>>> (using
>>>>
>>> find>> computers). Yet, it is getting consistently logged in the
>>> event
>>> find>> viewer.
>>> find>>
>>>> I want to know where the account exists or if it has been renamed to
>>>> something else so I can locate and disjoin. It seems that someone
>>>> may not have disjoined properly.
>>>>
>>>> TIA,
>>>> Altria
>>>> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> wrote in message
>>>> news: .com...
>>>>> Hello Altria,
>>>>>
>>>>> Is that machine used in your domain or not? If yes, rejoin it to
>>>>> the domain. Any firewall enabled on the clients?
>>>>>
>>>>> Also see here:
>>>>> http://www.eventid.net/display.asp?e...no=106&source=
>>>>> NE
>>>>> TLOGON&phase=1
>>>>> Best regards
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> I keep getting this error about a computer account that is not
>>>>>> located in ADUC. I am not sure where the remnants are coming from.
>>>>>> Can I use ADSIedit, to find this account or if it has been renamed
>>>>>> to something else.
>>>>>>
>>>>>> TIA,
>>>>>> Altria
>>>>>> BTW, 2003 and winxp3 clients
>
>