Hello!

I have previously described problems with machine accounts in the DSfW
domain being unable to set their passwords. On OES2SP1, I saw the following
error messages:

Nov 2 19:04:54 delta xadsd: [NETLOGON] Setting account password for object
<cn=MYPC,cn=Computers,dc=mydomain,dc=com>
Nov 2 19:04:54 delta xadsd: [NETLOGON] Setting account password failed:
Access Denied

Yesterday I applied the "November 2009 Scheduled Maintenance Update for
OES2 SP1", where as I understand some issue regarding this was fixed.

Something has changed indeed, because now I get a different error:

Dec 3 16:35:22 delta xadsd: [NETLOGON] Setting account password for object
<cn=MYPC,cn=Computers,dc=mydomain,dc=com>
Dec 3 16:35:22 delta xadsd: [NETLOGON] Setting account password failed:
Password Restriction

So it's "Password Restriction" instead of "Access Denied", but there still
is a problem. I've asked on this forum before whether machine accounts are
subject to Domain Password Policy and received answer that they shouldn't
be. On the other hand, I've had an experience where I tried to install
additional DC into forest root domain and this failed with "Password
restriction" error until I cleared all restrictions in Domain Password
Policy. I haven't tried removing restrictions from Domain Password Policy
now to see whether this clears my problem with machine accounts, but if I
have to do that then it is a rather poor workaround.

--
Toomas