I have a strange issue with one of my child domains. My environment has a 2008R2 forest with an empty root and three child domains all 2008R2. I know in 2008 this is an old school design, but just go with it. I'll call the child domains ChildA, ChildB and ChildC.
I currently have two DCs in the ChildA domain and things work normally but I was trying to troubleshoot why I cannot get to a desktop when I RDP to a ChildA DC with a ChildC account that is a member of the Administrators group on the ChildA DC. I can RDP to any of the member servers in the ChildA domain from a ChildC account.
Authentication seems fine.
I can add hosts to the ChildA domain with the ChildC account. I can also log into the ChildA DC with a ChildA domain account no problem.
So to troubleshoot I decided to add a third DC (Call it DC3) to ChildA to see if the DCs where the issue or if there was some other config issue. He is what I did:
- Added DC3 to the ChildA domain using the ChildC account
- RDPed to DC3 and got a desktop, no problem with the ChildC account
- Ran DCPromo
- Got the following Errors:
DNS was successfully queried for the service location (SRV) resource records used to locate a domain controller for domain ChildA.parent.net. The Query was for the SRV record for _ldap._tcp.dc._msdcs.ChildA.parent.net
the following domain controllers were identified by the query
however no domain controllers could be contacted
- run nslookup on DC3 and get hits on DC1 and DC2
- run nslookup for domain name childa.parent.net and the DNS request times out twice and then resolves. HUH!! What is going on here.
I've run DIG, DNSlint, DCDiag and reviewed all the of _msdcs records by hand still no idea what is going on here.
Tried again with the ChildA admin account, same result