Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a strange issue with one of my child domains. My environment has a 2008R2 forest with an empty root and three child domains all 2008R2. I know in 2008 this is an old school design, but just go with it. I'll call the child domains ChildA, ChildB and ChildC.

I currently have two DCs in the ChildA domain and things work normally but I was trying to troubleshoot why I cannot get to a desktop when I RDP to a ChildA DC with a ChildC account that is a member of the Administrators group on the ChildA DC. I can RDP to any of the member servers in the ChildA domain from a ChildC account.

Authentication seems fine.
I can add hosts to the ChildA domain with the ChildC account. I can also log into the ChildA DC with a ChildA domain account no problem.

So to troubleshoot I decided to add a third DC (Call it DC3) to ChildA to see if the DCs where the issue or if there was some other config issue. He is what I did:

  • Added DC3 to the ChildA domain using the ChildC account
  • RDPed to DC3 and got a desktop, no problem with the ChildC account
  • Ran DCPromo
  • Got the following Errors:

DNS was successfully queried for the service location (SRV) resource records used to locate a domain controller for domain The Query was for the SRV record for

the following domain controllers were identified by the query
however no domain controllers could be contacted

  • run nslookup on DC3 and get hits on DC1 and DC2
  • run nslookup for domain name and the DNS request times out twice and then resolves. HUH!! What is going on here.

I've run DIG, DNSlint, DCDiag and reviewed all the of _msdcs records by hand still no idea what is going on here.

Tried again with the ChildA admin account, same result

share|improve this question
up vote 0 down vote accepted

The first thing you should be looking at is DNS. Unless you are absolutely 100% positive that it is running and configured correctly, your problem will likely be there or at the very least related.

How is your DNS set up? Are all DNS zones hosted at the forest root or delegated to the child domain's DNS (AD servers). If your zones are hosted at the root, are all child domain DCs properly configured to point to the parent zone's DNS servers for resolution of the other child domains?

If you're using delegation of child zones, are your forwarders properly configured on the child DCs to go to the parent zone DNS servers?

If authentication works from Domain A to Domain B but not from Domain B to Domain A then quickly check that your trusts are in good shape. If there was an error or interruption when you were setting up either domain, the trust may not have been configured properly.

Your event logs are your friend here. Windows Server 2008 (especially R2) gives you a huge amount of information which should give you enough ammunition to resolve your issues.

share|improve this answer
The DNS zones are delegated. I have the child domain forwarders pointing to the parent DNS hosts. I will take a look at the trust. The part that concerns me is that when I do everything with resources local to the domain it still fails. I dig into the event logs and see if there is anything to be found there. Thanks – Tom Seibert Dec 16 '10 at 20:05
Check out some other tools to ensure that your DNS zones are replicating properly along with your AD data. Check out repadmin and replmon Also, do you have separate sites and/or subnets? Replication only occurs across sites every 90 minutes by default so it may be worthwhile droppping the replication interval down while you troubleshoot. repadmin is useful for forcing replication to occur but will also tell you that something is wrong if your DNS configuration is at fault. – Lewis Dec 16 '10 at 20:39
I have one site with multiple subnets. I have added all the subnets to the site. I will look at repadmin/replmon. – Tom Seibert Dec 17 '10 at 16:32
Cross site replication won't be having any impact then so pay close attention to the results coming out of repadmin /force and please let us know if you continue to see issues once you're sure DNS and zone replication is running perfectly. – Lewis Dec 17 '10 at 18:52
Ok we can put this in the fail list. I did not have the new domain controller in the Firewall Rule that allows all the DCs in the forest to talk to each other. DOH! I am back to my original problem so I will add that as another question. Thanks for the help! – Tom Seibert Dec 17 '10 at 21:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.