PCNSSVC EventID 6025

Question

I have this problem with one (and only one) account of my AD. It autolocks for some reason after some time (tipically one minute). It happens only with that user. In the event viewer I have this error:

Password Change Notification Service received an RPC exception attempting to deliver a notification because OLD domain controller SRVDC.ASHA.local has been demoted.

The password change notification target could not be contacted. User Action: The target server may not be running. Verify that the target server is running. Additional Details:

Thread ID: 5792 Tracking ID: 7353f7a0-3a8c-4420-a5fe-2010c1fc3af5 User GUID: 3ece162f-ad27-4e3e-ad95-01614cc53066 User: ASHA\AAD_9cb24269d758 Target: ESSENTIALS_PWD_SYNC_SRVDC Delivery Attempts: 973 Queued Notifications: 4 0x000006D9 - There are no more endpoints available from the endpoint mapper.

ProcessID is 4156 System Time is: 1/28/2025 9:19:48:724 Generating component is 2 Status is 1753 - There are no more endpoints available from the endpoint mapper. Detection location is 501 Flags is 0 NumberOfParameters is 4 Unicode string: ncacn_ip_tcp Unicode string: SRVDC.ASHA.local Long val: -647262927 Long val: 382312662

I have performed metadata cleanup several times with no luck. I have tryed as workaround to create a DNS record pointing the new DC, but unsuccesfully. Waiting that it stops, not worked ;-) So I have to modify that string someway... any suggestion on how to do it? I know that in AD, you can search for objects using tools like QueryAD or even PowerShell. There are specific containers where this information resides? How can I do the search?

Answer 1

Hi ,
Have you de promoted the DC properly..?
if the user logged in from any system, this is the behaviour ?

or only in particular machine you getting the error ?