Dropped LUN connections after domain controller migration

Hello,

When domain controllers are migrated, iSCSI initiators that rely on CHAP authentication but are not domain‑joined can lose their stored credentials because the local target security provider configuration is reset. In this case, the initiator cannot negotiate CHAP with the storage target, which explains the dropped LUN connections.

To restore functionality you need to re‑establish the local security provider entries and reconfigure CHAP credentials using iscsicli. First, confirm that the iSCSI service is running and that the initiator name has not changed (iscsicli ListInitiators). Then, for each target, you must re‑add the CHAP credentials. The command syntax is:

Code

iscsicli AddTargetPortal <TargetPortalAddress>
iscsicli QLoginTarget <TargetIQN>
iscsicli AddPersistentLogin <TargetIQN> <TargetPortalAddress> <InitiatorName> <IsPersistent> <IsBoot> <IsMultipath> <IsRssCapable> <IsRssEnabled> <IsRssLoadBalancePolicy> <IsRssQueueDepth> <IsRssAffinityPolicy> <IsRssAffinityMask> <IsRssAffinityMaskLength> <IsRssAffinityMaskOffset> <IsRssAffinityMaskCount> <IsRssAffinityMaskArray>

Once the persistent login is defined, you can set CHAP credentials with:

Code

iscsicli AddTargetCredentials <TargetIQN> <Username> <Password>

If mutual CHAP is required, use:

Code

iscsicli AddTargetCredentials <TargetIQN> <Username> <Password> <MutualUsername> <MutualPassword>

These entries are stored locally under the iSCSI initiator configuration, independent of Active Directory. After re‑adding them, restart the Microsoft iSCSI Initiator Service (services.msc → Microsoft iSCSI Initiator Service) to ensure the credentials are applied.

If you want to verify that the local target security provider is restored, run iscsicli ListPersistentTargets and iscsicli ListTargetCredentials. This will confirm that the CHAP entries are present and bound to the correct IQN.

In environments with domain controllers recently migrated, it is also important to check that Group Policy has not overridden iSCSI service startup or security settings. If the initiators are non‑domain, they must rely solely on local configuration, so ensure no dependency on domain policies remains.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.