Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a win 2003 server running a TFS server, and a Win 2008 server acting as a PDC.

A few days ago, I changed my DHCP and DNS server (which used to be the win 2008 server) to a Cisco Router. Since then, I've not been able to log in on my TFS server, which keeps complaining that my domain doesn't exists.

I've run dcdiag from my local Admin account to debug :

dcdiag /v /s:MYPDC /u:MYDOMAIN\Brann /p:*

Which returned me this error:

     * Active Directory LDAP Services Check
         The host 95cb8ce0-ecb1-43e3-87aa-e4ce74fe6._msdcs.MYDOMAIN could not be  resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         ......................... MYPDC  failed test Connectivity

I changed my DHCP server to use MYPDC as the primary DNS server again, and this error stopped appearing

I restarted the server, confident that the issue was solved, but now I'm getting this :

   Starting test: VerifyReferences
      Some objects relating to the DC IDS-SERVER have problems:
         [1] Problem: Missing Expected Value
          Base Object: CN=MYPDC,OU=Domain Controllers,DC=MYDOMAIN
          Base Object Description: "DC Account Object"
          Value Object Attribute Name: frsComputerReferenceBL
          Value Object Description: "SYSVOL FRS Member Object"
          Recommended Action: See Knowledge Base Article: Q312862

      ......................... IDS-SERVER failed test VerifyReferences

I've tried troubleshooting File Replication service as suggested in Q312862, but I'm stuck at the beginning :

C:\Documents and Settings\Administrator>ntfrsutl ds TFS
ERROR - Cannot bind w/authentication to computer, TFS; 000006d9 (1753)
ERROR - Cannot bind w/o authentication to computer, TFS; 000006d9 (1753)
ERROR - Cannot RPC to computer, TFS; 000006d9 (1753)

C:\Documents and Settings\Administrator>ntfrsutl ds MYPDC
ERROR - Cannot RPC to computer, MYPDC; 000006d2 (1746)

Any ideas on what to try next? Btw, other Vista computers on this domain can login just fine.

share|improve this question
    
Moving DNS from a Domain Controller ... I wouldn't think that's a minor change ... –  Joseph Kern Jun 15 '09 at 10:59
add comment

4 Answers

For the record, I eventually left/rejoined the domain and it solved the problem.

I wanted to avoid this solution because my TFS server was a certification authority, thus preventing any domain/name change on it without messing with the installation, but in most scenario it shouldn't be a problem

share|improve this answer
add comment

An obvious test perhaps, but if you fire up a command prompt on the 2003 server and type nslookup does it display something like:

c:\temp>nslookup
Default Server:  mypdc.mydomain.local
Address:  192.168.1.1

and if you now type:

mypdc.mydomain.local

does it correctly resolve the PDC name?

JR

Edit: It looks as if DNS is OK or at least your 2k3 server is correctly using mypdc as the DNS server. Presumably you're logging into the 2k3 server as a local account if the domain account doesn't work. When you're logged in, if you open a command prompt and type:

net use \\mypdc\ipc$ /user:mydomain\administrator

(obviously replace "mydomain" by your domain name) and then feed in the domain administrator password, does this work?

Also is there anything relevant in the Security log on mypdc?

share|improve this answer
    
@renniej : No ! I get a "*** Can't find server name for address 192.168.0.1: Non-existent domain, Default Server: UnKnown, Address: 192.168.0.1" message. –  Brann Jun 15 '09 at 9:25
    
That's a normal error message when you don't have a reverse lookup zone (it's not required, so just ignore it) –  pauska Jun 15 '09 at 9:30
    
Btw, the resolution of MYPDC is then successful to 192.168.0.1, as expected. –  Brann Jun 15 '09 at 9:34
    
As pauska says, the initial error is cosmetic and can be ignored. See the edit for some more ideas, but I must admit I'm flailing around a bit now. –  John Rennie Jun 15 '09 at 11:22
add comment

Active Directory rides DNS, and works best/most completely when the AD server is the DNS server for the domain members.

For some reason, using an alternative DNS server results in some requests not being passed through to the AD server, resulting in incomplete functionality.

share|improve this answer
add comment

I changed my DHCP and DNS server

Just a thought ...

Did you move all of your service records (SRV) when you switched to the new DNS server? Active Directory really needs those records to operate. Without the SRV records you have no way of telling clients where your LDAP and Kerberos servers are (which is your PDC/GC).

Oh ... and was your TFS using DHCP?

share|improve this answer
    
+1, this is definitely the problem. See technet.microsoft.com/en-us/library/cc759550(WS.10).aspx for more details. –  ThatGraemeGuy Jun 15 '09 at 11:11
    
Agreed. Changing DNS, at least, is by no means a "minor" change on any system with directory services running. –  RobM Jun 15 '09 at 11:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.