dc problemi

The approaches to avoid this problem are:

1. Change the password remotely. Note that currently the user in the context you run the remote password change needs to be able to logon to the target server with the default credentials (or already connected using SMB to the server at the time of the password change already).
2. Change the permissions of the key "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Rpc" to allow anonymous to read the key. If the key does not exist, you may create it and then add the read permissions for the anonymous account.

NOTE For approach 2, in an attempt to recover from an error, it might happen that the group policy service deletes the keys and recreates them using defult permissions. In this case you have to re-apply the permissions.

You can automate setting the permissions on using Registry Security Policy when the machine is member of the domain. For workgroup machines you can import this text as rpc-pol.inf file:

---------------------------

[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Registry Keys]
"MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\rpc",0,"D:PAR(A;CIIO;KA;;;CO)(A;CI;KA;;;SY)(A;CI;KA;;;BA)(A;CI;KR;;;S-1-5-7)(A;CI;KR;;;BU)"
------------------------------

You can apply it using:

secedit /configure /db C:\Windows\security\database\rpc-pol.sdb /cfg rpc-pol.inf /log rpc-pol.log

Note the key must exist so this is successful.