Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two domain controllers (Windows 2003) in one site where most of the department I support resides. There is another building (at another site) where my department resides as well, but they have no DC.

This probably a classic question of whether to install an additional DC when a company is spread out over multiple sites.

We've been experiencing various issues like login scripts not mapping drives and users failing to login several times before being let in (even though they're typing the right password).

I'm getting different errors on the clients. Some of them are :

Netlogon, 5719, This computer was not able to set up a secure session with a domain controller in domain domain.com due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator.

GroupPolicy, 1055, The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

On the servers I keep getting these errors:

Netlogon, 5722, The session setup from the computer SOMEPCNAME failed to authenticate. The name(s) of the account(s) referenced in the security database is SOMEPCNAME$. The following error occurred: Access is denied.

*(this above error keeps repeating for the same computer. Probably just need to re-add this to domain. ) *

NTDS Replication, 1864, This is the replication status for the following directory partition on the local domain controller. Directory partition: CN=Schema,CN=Configuration,DC=domain,DC=com

This last one looks like it has to do with a DC that wasn't completely removed. When I ran dcdiag, it showed that we are trying to replicate with a server that doesn't exist anymore. I don't think this would cause us to have all these logon problems though.

I'm wondering if we should install another DC or try something else. Our clients run mostly windows 7, but there some XP and Vista clients as well.

The bandwidth looks to be 37.4 Mbs between PCs on the different sites (just verified with this utility iperf).

Any help is appreciated.

share|improve this question
    
Anything over 10Mb with reasonable latency should be plenty fast enough that you don't "need" a DC at the other location. I'd check for problems in the network first, but you may want a DC there for a variety of reasons anyway. –  Chris S Feb 10 '12 at 14:33
    
Thanks for the input. I feel that this bandwidth is more than adequate but something (most likely the network) keeps interfering with the logon process. –  James Feb 10 '12 at 15:00
    
If you can't authenticate across the connection I suspect replication across the connection would be an equally difficult challenge. –  Jim B Feb 10 '12 at 16:31

3 Answers 3

up vote 2 down vote accepted

@gWaldo has a good idea in terms of increasing reliability and updating your outdated DC, but it's a "guess" as to if it'll fix the issue. @Chris-S is correct in comment that bandwidth (at first glance) doesn't sound like it's the issue either.

First you should ensure that WAN connection is reliable, has no packet loss, and has ample available bandwidth throughout the day.

Also a DC not being available will not prevent a Windows client login (assuming default GPO's) because cache credentials on a domain let you in. It would help if you posted the actual errors the users are getting.

For mapped drives, if they are done by login script then you have little to no ability to see any logs about that info, but I would move that functionally to Group Policy Preferences which will let you map drives, make them persistent, and also log to the client event logs on any issues. Your mapping issues could be either they can't get the script, or they can't access the drive... but hard to tell without logging.

Again, keeping DC's current and having one at remote site is "better" but is just throwing darts at the wall of this specific issue. I've had 70-100 remote sites on much lower WAN speeds with no remote DC's act just fine as long as connection was reliable and had available bandwidth.

share|improve this answer
1  
Thanks for your insights. I keep getting NTDS kcc, netlogon and group policy errors as described above. We are running the domain in 2000 mixed mode. It sounds like it's time to upgrade. –  James Feb 14 '12 at 18:05
    
If your oldest DC is running 2003 then you can upgrade the forest and domain mode to 2003 native right now. 2000 Mixed mode is generally bad as it allows for NT 4 domain controllers which is insecure and not meant for modern networks. –  Bret Fisher Feb 14 '12 at 22:50
    
Could there be any possibility of users not being able to login or exchange 2003 getting messed up if I switch to native 2003? Exchange will probably be happier in native, but just checking. Thanks. –  James Feb 15 '12 at 14:03
    
nothing is certain but no the only reason I can think of to stay 2000 mixed is NT4 DC's. Your forest/domain version is not related (directly) to how things authenticate... it's related to how DC's talk to each other and new features of Active Directory. –  Bret Fisher Feb 16 '12 at 0:55

There is a lot of room in your question for other problems to be causing problems, but on the surface (if you are fairly certain that everything else is working as expected) you sound like you may be a good case for a Read-Only Domain Controller (RODC).

This would necessitate upgrading to Server 2008 for your DCs (which is a good idea, anyway; 2003 is nearing end-of-life), and a little care in setting up the RODC, but it could solve your problems well.

Yes, you could just set up another 2003 DC in the remote office, but it sounds like there isn't an IT presence there, so a RODC may be 'safer'. RODCs are good where you may not have an IT staff, especially if you don't have a safe and secure area for the server (no server room / lockable racks, shady neighborhood, etc)

Also keep in mind that the mapping of drives over the network is going to eat up bandwidth, and by itself could be a major cause of your problems. It may be worthwhile to investigate a local implementation of a storage solution (such as DFS or CIFS servers).

If you haven't already, separating your organization based on location (whether by Sites or just OUs) could also help you with managing traffic and user experience.

share|improve this answer
    
This sounds like a really good idea. Upgrading to a 2008 domain seems like a bigger project then I was hoping for. Thanks for the suggestion! –  James Feb 10 '12 at 14:55
    
Actually, Upgrading AD is less of a big deal than upgrading Windows to 2008; it's pretty simple, though I recommend reading the docs and making a checklist before starting it. Likewise with the RODC; it's not hard, but there is a procedure to follow. –  gWaldo Feb 10 '12 at 15:01
2  
@gWaldo mainstream support ended last year for windows 2k3 - it's not just near EOL it's already in the extended support phase. –  Jim B Feb 10 '12 at 15:17
    
Thanks; I didn't feel like looking up it's support status. #lifeistooshort –  gWaldo Feb 10 '12 at 16:31

I would definitely put another dc at the remote site to provide some redundancy should the connection between the sites fail.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.