Scheduled tasks fail to start after migrating machines to a new domain controller

Environment

Small office AD domain: 40 Windows 10/11 clients and 3 Windows Server 2019 domain controllers. Migration performed during maintenance window: promoted new DC (dc-new.domain.local) and demoted old DC (dc-old.domain.local). Clients rebooted and joined to new domain controller as part of migration.

Symptoms

Several scheduled tasks on multiple client machines that run under service accounts or domain user accounts fail to start after the migration. Tasks show 'Ready' or 'Queued' but have Last Run Result 0x1 or 0x8007052E (logon failure). Tasks that run 'At system startup' are the most affected.

Observations

Event Viewer on an affected client shows TaskScheduler event ID 101 with 'Execution of task failed' and Security event 4625 'An account failed to log on' for the same timestamp, indicating invalid credentials. The user accounts exist and password hasn't changed. Using 'Run as' with the same credentials manually succeeds when launching a simple program. Time sync appears correct (time drift < 2 seconds). Group Policy shows new DC as domain controller.

Already attempted

Re-entered service account password into Task Scheduler for one affected task — task runs successfully immediately afterward. Verified SPNs and AD replication status (repadmin reports no lingering replication errors). Tested network connectivity to the new DC (ping, LDAP bind) — binds succeed. Cleared cached credentials on one test machine and rebooted; problem recurred for other machines.

Question

Why are scheduled tasks failing to authenticate with domain accounts after a DC migration even though AD binds succeed and the passwords are unchanged, and what steps will reliably identify whether this is a cached credential/LSA secret issue or a replication/kerberos ticket problem?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Task Scheduler's stored credentials (LSA Secrets) on clients are encrypted with a machine key tied to the previous DC's domain controller key and are no longer decryptable after the migration. 85%

Machine account password changes during migration created Kerberos ticket issues; existing scheduled tasks relying on cached Kerberos tickets fail until new tickets are obtained. 25%

Replication of AD account attributes (like 'User must change password at next logon' or 'Account is sensitive') incomplete, causing noninteractive logons to be rejected. 10%

Summary

Symptoms indicate the tasks fail because stored credentials (LSA protected storage) or Kerberos tickets persisted on clients are not being accepted by the new DC, even though manual interactive logons and LDAP binds succeed. Re-entering the password in Task Scheduler resolves the immediate failure, pointing at invalid stored secrets or encryption context mismatch (for example, due to domain controller SID/kerberos key mismatch or a change in the machine account password during migration). Time skew is within tolerance, reducing likelihood of Kerberos time issues.

Suggested Fixes

Diagnostic step 1

On an affected client, open Task Scheduler and re-enter the service account password for a single failing task to confirm this workaround consistently restores execution (non-destructive test).

Diagnostic step 2

Force machines to obtain new Kerberos tickets: run 'klist purge' and then trigger the scheduled task or reboot the client and observe. Capture security events 4625/4769 on both client and DC at failure time for correlation.

Diagnostic step 3

Check AD replication status across DCs (repadmin /replsummary) and verify the user/service account attributes are consistent; resolve any lingering replication errors before proceeding.