How to fix error error-ds-dra-secrets-denied in Windows 11

Solution Steps

1. 1 Open Command Prompt as Administrator (Win+X, then 'Terminal (Admin)'). We'll use repadmin and nltest to diagnose.
2. 2 Check replication status: Type 'repadmin /showrepl' and press Enter. Look for errors related to the affected DC. Note the error code.
3. 3 Verify the machine account password: Type 'nltest /sc_query:yourdomain.com' and press Enter. Replace yourdomain.com with your domain. If it fails, the secure channel is broken.
4. 4 Reset the machine account password: Type 'netdom resetpwd /server: /userd:yourdomain.com\administrator /passwordd:*' and press Enter. Follow the prompts. This resets the password for the machine account, which often fixes the issue.
5. 5 If netdom is not available, use PowerShell: Open PowerShell as Admin and run 'Reset-ComputerMachinePassword -Server -Credential (Get-Credential)'. This does the same thing.
6. 6 Check time synchronization: Type 'w32tm /query /status' and press Enter. Ensure the time is within 5 minutes of the other DCs. If not, run 'w32tm /resync' to force sync.
7. 7 If the issue persists, check the Krbtgt account: In Active Directory Users and Computers, locate the krbtgt user, right-click, and reset the password twice (once for each DC). This is a last resort and should be done carefully.
8. 8 Restart the Kerberos Key Distribution Center service: Type 'net stop kdc' then 'net start kdc' in an elevated command prompt. This restarts the service that handles authentication.