Machine Accounts Keep Expiring
This problem will occur when the passdb (SAM) files are copied from a central
server but the local BDC is acting as a PDC. This results in the application of
Local Machine Trust Account password updates to the local SAM. Such updates
are not copied back to the central server. The newer machine account password is then
overwritten when the SAM is recopied from the PDC. The result is that the domain member machine
on startup will find that its passwords do not match the one now in the database, and
since the startup security check will now fail, this machine will not allow logon attempts
to proceed and the account expiry error will be reported.
The solution is to use a more robust passdb backend, such as the ldapsam backend, setting up
a slave LDAP server for each BDC and a master LDAP server for the PDC.