Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've never seen anything like this. At a potential customer site, I noticed that the PC's were all unable to locate the domain controller and netlogon was failing. I fixed the DNS entries on the client PC's so the AD server was DNS server and tried to rejoin the domain. The PC was unable to locate the domain controller.

On the server, I checked the DNS settings and while there is the high level AD folder, every single entry related to Active Directory appears to have been completely deleted.

There are no backups from what I can tell and this has been happening for 6 months at least. Does anyone have any recommendations for repairing this? Thanks.

share|improve this question
    
Is DNS in Active-Directory-Intergrated mode? dcdiag /fix doesn't work? –  Bret Fisher Mar 17 '11 at 16:03
    
Is it a single DC in the domain? Make sure if the AD DC also has DNS Server running locally, that it is pointing to itself for DNS only. –  Bret Fisher Mar 17 '11 at 16:04

1 Answer 1

Here's a step-by-step to get the records back. It's not too painful at all:

  • If the forward lookup zone for the Customer's domain is still there make sure it's configured as an Active Directory integrated zone that allows secure dynamic updates. If the zone is gone re-created it and configured as I described. If it's there but not configured as Active Directory integrated or to allow only secure dynamic updates then configure it as such.

  • Make the same checks and changes, if necessary, for the "_msdcs.domain.com" DNS zone (where "domain.com" is the Customer's domain).

  • Make sure the DC is configured to use itself as its DNS server (and not configured to use any others).

  • Stop and restart the "Netlogon" service to cause the DC to re-register its SRV records, etc.

share|improve this answer
    
Awesome! I'm hoping to try this this week. I'll keep you posted. –  Jim Smith Mar 21 '11 at 22:01
    
So I ended up winning this contract and Evan your answer was perfect. The one step I missed however was I didn't check the name of the integrated zone. I created a new active directory zone called 'domain.local' in dns, deleted the non-syncing one and then ran dcdiag/fix and restarted the network logon service. Everything went as planned. Thanks for your help. –  Jim Smith Apr 20 '11 at 16:09
    
@Jim Smith: I'm glad I could help you out. –  Evan Anderson Apr 20 '11 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.