If another user logged in on that same machine, no errors appeared and all policies were applied.It turned out that there was a stored password on the machine when this specific user was logged in.The problem was corrected by updating the Intel Gigabit NIC driver on the server.

dhcp not updating dns reverse lookup zones-39

Added the end user to the local Administrators group, reboot and logged back in to the domain.

Went back to" User Accounts" in Control Panel and there was another entry for his domain account.

Rebooted the workstation and he was able to log in to the domain and access domain resources once again.

The key was adding the end user's domain account to the local administrators group to see the remaining entry for his "Manage Passwords" entries.

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.

In regedit HKLM\System\Current Control Set\Services\Tcpip\Parameters\Interface\ the Dhcp Name Server had two entries, one correct and one an external IP address which ping -a came back as the 40961 code. Windows XP SP2 was getting application Event IDs 4226, 40961, 40960 for one end user only.

The end user stated this all happened when it was time for him to change his domain password. The end user's domain account was not a privileged account on the workstation.

Based on info in this link and others we checked the "User Accounts" in Control panel and found one entry for his domain account. We removed the workstation from the domain and re-joined with no luck.

This article is not related to this problem, but it has a newer version of kerberos.dll, which appears to be the culprit.