Change Auditor Deployment tab does not display any Domain Controllers for the domain (4227990)

Consider the following scenarios:

1. Change Auditor Coordinator is installed and running.
2. The Client loads the 'Deployment' tab but no Domain Controllers are visible.
3. The Coordinator log contains the following warning for ALL Domain Controllers in the problem domain(s):

"Invalid serverReference found for: LDAP://CN=NTDS Settings,CN=DomainController1,CN=Servers,CN=Site-Name,CN=Configuration,DC=Domain,DC=COM"

Subsequently, if this problem arose after some time of working normally, the Domain Controller Agents which are trying to connect produce the following warning in the Coordinator log and cannot connect to submit events waiting:

"Request for principal permission failed"

RESOLUTION 1

Ensure the Coordinator computer account has read permissions to the 'Domain Controllers' OU.

Alternatively, the Coordinator can be run under a service account (not recommended) instead of Local System (default). If the Coordinator service is to run under user context, the  'NPRepository4' Service Principal Name (SPN) must be moved from the computer account to the user account specified to run the service to maintain Agent authentication.

Additional information on how to move the Change Auditor SPN can be found here:

How to move the Service Principal Name (SPN) from Computer Object to a Domain User 

https://support.quest.com/kb/97153

RESOLUTION 2

Ensure the following ports are open from the Change Auditor Coordinator computer to one of the Domain Controllers in the non-working Domain:

• Port 88 (Kerberos)
• Port 389 (LDAP)

RESOLUTION 3

Ensure that the operatingSystem attribute on the computer objects for all missing hosts is properly populated.