Active Directory Domain Controller Error “The target principal name is incorrect” Event ID 3210 and Event ID 5722

My business closed one of their remote branches recently. The ex-employees took their time packing and sending the hardware back to our HQ. The Domain Controller was offline for more than a month. When we finally got it back, I recreated the routing and plugged the server back in so that I could run a DCPROMO and take it down gracefully. However, since the server was offline for so long, when I ran DCPROMO, the server complained that it could not sync up with the Domain Controllers. This is the same thing for other windows hosts that have been offline for 30 days. The Event Viewer showed Event ID 3210 and 5722 related to this issue.

This error is also seen when using the AD sites and services snap in to force a replication between domain controllers. I would get the following error window stating “The Target principal name in incorrect”.

How how to fix it:
From any DC, open command line (CMD) and run

netdom query fsmo

That will list out the servers in your Domain with the Domain roles. Look for the server running the PDC role.

Next, on the server that is having the issues we need to disable Kerberos.
1) Click Start -> Programs -> Administrative Tools -> Services
2) Double click the Kerberos service (KDC) and change the startup type to Disabled.
3) Reboot

When the machine starts back up, get back to a Command Line (CMD) and reset the secure channel to the PDC with the following command:

netdom resetpwd /server:server_name /userd:domain_name\administrator/passwordd:administrator_password

Where server_name is the server holding the PDC role. administrator/administrator_password can be substituted for any account that is a Domain Admin.

Restart the troubled DC. Reset the Kerberos Service back to Automatic Startup.

Everything should now be back to normal.