Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently we had a power outage that was greater than 2 hours. We had to shutdown 8 out of 9 servers. I left 1 server, server6, running because it hosts web services we need 24/7. Once the power was back on, I tried to boot server1 and server2 first, considering server1 is the main operations master and server2 is our DNS server. Both of the systems were stuck at "Loading Network Connections" for about 10-20 minutes. Once the systems were booted, I logged in and the Event Viewer was filled with errors.

Server1 had:

The Security System detected an authentication error for the server LDAP/SERVER1.  The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.

(0xc000005e)".

and

Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.JVS.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

Server2 had:

Dynamic registration or deletion of one or more DNS records associated with DNS domain 'JVS.' failed.  These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).  

and

The Security System detected an authentication error for the server ldap/server2.JVS.  The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.

(0xc000005e)".

I went into Active Directory Sites and Services and tried to connect to the JVS forest numerous times with failed attempts. Finally after about the 8th try, it found the forest and everything went back to normal. This gives me the feeling something is wrong with our domain. Is there any tests I can run to see what is wrong with our domain? Has anyone ever heard of this happening?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Every AD server should have DNS on it too. You probably ended up with a AD server that couldn't connect to the DNS server because the DNS server couldn't find the AD server to authenticate against.

share|improve this answer
1  
@Jacob Not necessarily, but if a domain controller can't contact DNS during boot, it'll take forever to get back up and running as you've just dealt with. Sounds like you've only got one DNS server, you definitely want more than that. –  Shane Madden Mar 14 '11 at 14:08
1  
@Jacob, what do you mean by primary and alternate? MS-DNS AD-Integrated Zones have no master/slave relationship like traditional DNS. –  Chris S Mar 14 '11 at 14:11
1  
If both server do in fact have DNS installed then each server should have itself listed as the first (primary) DNS server in the TCP/IP properties of the NIC. –  joeqwerty Mar 14 '11 at 14:15
1  
@joeqwerty - I actually saw the opposite recommended directly from Microsoft. Each AD server should reference another server for DNS, and reference itself as secondary. –  SpacemanSpiff Mar 14 '11 at 14:18
3  
@Joeqwerty & Chris S - MS Best Practice Analyzer for 2008 R2 DCs will inform you that your DCs should point to an different DNS server for primary and localhost for secondary. (I don't think it would be helpful when all DNS servers are down though...) –  Clint Mar 14 '11 at 15:57
show 9 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.