Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am getting these two error in the DNS Event log (errors at end of question). I have confirmed I do have duplicate zones. I am wondering which ones to delete. The DomainDNSZone contains all of our DNS records but it does not have the _msdcs zone.... that is in the ForestDNSZone with the duplicates that are not in use.

3 Questions. I understand the advantages of having DNS in the ForestDNSZone.

so...

  1. Why is DNS using the DomainDNSZone and is that acceptable considering _msdcs... is in the ForestDNSZone?

  2. If so, should I just delete the DC=1.168.192.in-addr.arpa and DC=supernova.local from the ForestDNSZone? Or should I try to get those to be the ones in use? What are those steps? I understand how to delete. That is simple but if i must move zones some info would be appreaciated there.

  3. Just to confirm. from my understanding. I can delete the two duplicates in the ForestDNSZone and leave the _msdcs.supernova.local as thats required there. This will resolve the erros I see.

Just fyi when I look in those folders from the ForestDNSZone they have just 2 and 1 entries respectively. So obviously not in use compared to the others. I am pretty sure I understand the steps to complete this. But if you would like to provide that info, bonus points!

Event Type: Warning
Event Source:   DNS
Event Category: None
Event ID:   4515
Date:       1/4/2011
Time:       2:14:18 PM
User:       N/A
Computer:   STANLEY
Description:
The zone 1.168.192.in-addr.arpa was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible. 

If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server. 

If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict. 

To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00               %..   

AND

Event Type: Warning
Event Source:   DNS
Event Category: None
Event ID:   4515
Date:       1/4/2011
Time:       2:14:18 PM
User:       N/A
Computer:   STANLEY
Description:
The zone supernova.local was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible. 

If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server. 

If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict. 

To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00               %..    

UPDATE: Suggestions to improve this question so I can get a response would be appreciated.

UPDATE 2:

Our AD consists of 3 DCs

Server at 192.168.1.100 is our Exchange and a DC(unfortunately) It is also our fileserver. OS:Server 2003 R2

Server Stanley.DOMAIN.LOCAL is our GC and holds the shcemas but I will be moving them to the DNS server soon. OS Server 2003 R2

The DNS Server at 192.168.1.103 is our new 2008 R2 Box. It now hosts DNS and DHCP and well is a GC and going to be the PDC once I transfer schemas over.

I wanted to get this DNS issue resolved first.

In an attempt I removed DNS from all other servers and it is only running on the new 2008 R2 box. I have not seen our 2008 R2 Server (Stanley) DNS log produce the event error since the 11th. Stanley used to be the DNS but it is now turned off. Could this be why I have not seen the error since then? Here is the net diag. It was run on the exchange server as it is still 2003 R2. NETDIAG:

....................................

    Computer Name: SERVERNAME
    DNS Host Name: SERVERNAME.DOMAINNAME.local
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 6 Model 15 Stepping 6, GenuineIntel
    List of installed hotfixes :
        KB2079403
        KB2115168
        KB2160329
        KB2183461-IE8
        KB2229593
        KB2286198
        KB923561
        KB924667-v2
        KB925398_WMP64
        KB925876
        KB925902-v2
        KB926122
        KB926139-v2
        KB927891
        KB929123
        KB930178
        KB932168
        KB933854
        KB936357
        KB938127
        KB941569
        KB942830
        KB942831
        KB943055
        KB943460
        KB943729
        KB944338-v2
        KB944653
        KB945553
        KB946026
        KB948496
        KB950760
        KB950762
        KB950974
        KB951066
        KB951748
        KB952004
        KB952069
        KB952954
        KB953298
        KB954155
        KB954550-v5
        KB955069
        KB955759
        KB956572
        KB956744
        KB956802
        KB956803
        KB956844
        KB958469
        KB958644
        KB958869
        KB959426
        KB960225
        KB960803
        KB960859
        KB961063
        KB961118
        KB961501
        KB967715
        KB967723
        KB968389
        KB968816
        KB969059
        KB969883
        KB969947
        KB970238
        KB970430
        KB970483
        KB971032
        KB971468
        KB971513
        KB971657
        KB971737
        KB971961
        KB971961-IE8
        KB972270
        KB973037
        KB973354
        KB973507
        KB973540
        KB973687
        KB973815
        KB973825
        KB973869
        KB973904
        KB973917-v2
        KB974112
        KB974318
        KB974392
        KB974571
        KB975025
        KB975254
        KB975467
        KB975560
        KB975562
        KB975713
        KB976323
        KB976662-IE8
        KB977165-v2
        KB977290
        KB977816
        KB977914
        KB978037
        KB978251
        KB978262
        KB978338
        KB978542
        KB978601
        KB978695
        KB978706
        KB979306
        KB979309
        KB979482
        KB979559
        KB979683
        KB979907
        KB980182
        KB980182-IE8
        KB980195
        KB980218
        KB980232
        KB980302-IE8
        KB980436
        KB981332-IE8
        KB982214
        KB982381-IE8
        KB982666
        Q147222


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : Local Area Connection 2

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : SERVERNAME
        IP Address . . . . . . . . : 192.168.1.100
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 192.168.1.1
        Dns Servers. . . . . . . . : 192.168.1.103


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '192.168.1.103' and other DCs also have some of the names registered.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Passed
    Secure channel for domain 'SUPERNOVA' is to '\\stanley.DOMAINNAME.local'.


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

    Note: run "netsh ipsec dynamic show /?" for more detailed information


The command completed successfullylution.

I also just ran a DC Diag on Weir. THis is the 2008 R2 box It failed this test. Though Just looked into this a little more and realise its if I did not do adprep /rodcprep. Considering I am not planning on a RODC MS says this can be ignored.

  Starting test: NCSecDesc
     Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
        Replicating Directory Changes In Filtered Set
     access rights for the naming context:
     DC=ForestDnsZones,DC=DOMAINAME,DC=local
     Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
        Replicating Directory Changes In Filtered Set
     access rights for the naming context:
     DC=DomainDnsZones,DC=DOMAINAME,DC=local
     ......................... WEIR failed test NCSecDesc
share|improve this question
    
Where is @Evan Anderson when you need him ;) –  Campo Jan 6 '11 at 21:52

2 Answers 2

up vote 2 down vote accepted
+50

Sometimes this happens when changing the replication scope in the 2003 DNS snapin. What I would to to resolve this is:

  1. Stop DNS Server on all servers except one the 2008 server. (you've removed it which is just as good)
  2. On that one, turn off AD integration for all forward or reverse zones for which EventID 4515 appears.
  3. Restart the DNS Server service on the one server.

  4. Check the DNS log - all occurrences of EventID 4515 should be gone. If not make sure AD Integration is off and restart the service again until it starts without any 4515 warnings.

  5. Enable AD integration. Remember to set the replication scope and turn on secure updates.**

  6. Force AD replication to all DCs running DNS.

  7. Start DNS Server service on the other DNS servers. Once the replication is complete, the 4515 warnings will be gone.

** NOTE If there are other zones on other DNS servers that are not replicated to the server you chose in step 1, stop the DNS Server service on the machine you've been working on, and repeat steps 1 through 5 for zones on a DNS server that hosts the remaining, conflicting zones.

share|improve this answer
    
OK this is interesting indeed. Right now those events have stopped since stopping DNS on other servers. (Some still have DNS installed but it is not running like you suggested) Basically we are going to try to get the 2008 DC to fix it itself then replicate to the other ones. I get that. What I do not see is how it will magically decide which zone to take and which to leave. Looks like my _msdcs.domainname.... is forest wide and the other's, DOMAINNAME and DOMAINNAME.LOCAL are domain wide. (This is from checking properties of each zone) Maybe this added info is helpful? –  Campo Jan 19 '11 at 19:18
    
I get this when I restart Stanley DNS after following your directions. "The DNS server could not signal the service "NAT". The error was 1168. There may be interoperability problems between the DNS service and this service." Thanks for the help –  Campo Jan 19 '11 at 19:39
    
OK I completed these steps defnitily looking better now. We have _msdcs.domainname.... in the Domain DNS Zone. I still see the DOMAINNAME.LOCAL zone and the 1.168.192.in-addr.arpa (reverse lookup zone) inside the FroestDNSZones in ASDIEDIT. Should these be deleted now? Feel like they are from an old DNS server or something. There are only the nameserver records inside them. –  Campo Jan 19 '11 at 20:03
    
Error coming up again :( Think I may just have to delete the other zones? –  Campo Jan 19 '11 at 20:20
    
Replication worked. Everything looks good but we still have the duplicate zones. I feel like if I repeat your steps but move everything to the ForestDNSzone this should resolve the conflict. I am going to attempt now :) –  Campo Jan 19 '11 at 21:42

Is this domain one that was upgraded from Windows 2000 to 2003, but possibly not done correctly/completed? Very detailed instructions on how to perform such an upgrade, including how to cleanup _msdcs subdomains can be found here:

http://support.microsoft.com/kb/817470

To help improve the question I might provide the following:

1) A description of the AD/DNS infrastructure. 2) Diagnostic logs of the naming services (such as netdiag) to confirm that everything in (1) is working as anticipated for name/resource resolution.

share|improve this answer
    
Will do this later today. Thanks! I will follow up –  Campo Jan 18 '11 at 16:00
    
I asked about the domain being upgraded. Our VP of tech said it was not. He is pretty confident with that. I have added the rest of your questions in an update. –  Campo Jan 19 '11 at 15:27
    
Added rest of info. Thanks for the help. If I could resolve this today that would be spectacular. –  Campo Jan 19 '11 at 15:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.