The system detected a possible attempt to compromise security

I got the above error when trying to access a network share on a workstation. The event log was filled with Cifs and netlogon errors.  In doing some investigation I found that this machine had a manually set DNS entry which pointed to a former DC that had been demoted. What was interesting is that DNS resolution still worked (cached entries) but because it wasn’t authorized in AD the machine was getting cifs errors.