1
Diagnostic step 1
On an affected client, open Task Scheduler and re-enter the service account password for a single failing task to confirm this workaround consistently restores execution (non-destructive test).
FULL AI ANALYSIS
Scheduled tasks fail to start after migrating machines to a new domain controller
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms indicate the tasks fail because stored credentials (LSA protected storage) or Kerberos tickets persisted on clients are not being accepted by the new DC, even though manual interactive logons and LDAP binds succeed. Re-entering the password in Task Scheduler resolves the immediate failure, pointing at invalid stored secrets or encryption context mismatch (for example, due to domain controller SID/kerberos key mismatch or a change in the machine account password during migration). Time skew is within tolerance, reducing likelihood of Kerberos time issues.
Possible causes
Task Scheduler's stored credentials (LSA Secrets) on clients are encrypted with a machine key tied to the previous DC's domain controller key and are no longer decryptable after the migration.
85%Machine account password changes during migration created Kerberos ticket issues; existing scheduled tasks relying on cached Kerberos tickets fail until new tickets are obtained.
25%Replication of AD account attributes (like 'User must change password at next logon' or 'Account is sensitive') incomplete, causing noninteractive logons to be rejected.
10%Group Policy or local security policy updated to restrict service logons from specific domain controllers or to require additional authentication (e.g., smartcard), which affects scheduled tasks.
5%Suggested fixes
2
Diagnostic step 2
Force machines to obtain new Kerberos tickets: run 'klist purge' and then trigger the scheduled task or reboot the client and observe. Capture security events 4625/4769 on both client and DC at failure time for correlation.
3
Diagnostic step 3
Check AD replication status across DCs (repadmin /replsummary) and verify the user/service account attributes are consistent; resolve any lingering replication errors before proceeding.
4
Diagnostic step 4
Examine Local Security Policy and Group Policy (Resultant Set) for policies affecting service logons or network authentication; temporarily revert restrictive policies to isolate cause.
5
Diagnostic step 5
If the issue affects many clients, consider resetting the machine account password for a test client (netdom reset or rejoin domain) to see if that clears LSA-protected credentials; do this only after backing up local data and with appropriate change windows. Escalate to AD specialists or Microsoft Support if LSA secrets appear corrupt across multiple clients or if rejoining machines is not feasible at scale.