Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a domain with 3 DCs. One is starting to fail so I brought up a new one. All are running Win 2003.

Problem: there appear to be replication issues between the 4 machines but I can't figure out what's causing this. All are registered with the DNS as identically as I can make them.

How do I know there is a problem? Nagios is telling me that the other 3 DCs are having KCCEvent errors and the new machine is reporting "failed connectivity" errors.

Doing dcdiag on the new machine reports: the host could not be resolved to an IP address. This seems crazy as I log into it using the DNS name. I can ping it from the other three machines using this DNS name as well.

repadmin /showreps from the new machine says its seeing the other 3 machines. Doing the same from one of the older machines doesn't show the new machine.

I've tried netdiag /repair numerous times. No luck.

There are no firewalls running on any of the machines.

If I look at Domain info via MMC (on the new machine) it appears that all the information is current. Users, computers, DCs.. its all there.

Im puzzled as to what step(s) I've missed in adding this new machine. Suggestions?

EDIT: dcdiag from non-working:

C:\Documents and Settings\Administrator.BME>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\YELLOW
      Starting test: Connectivity
         The host 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu could
 not be resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         Although the Guid DNS name
         (312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu) couldn't be
         resolved, the server name (yellow.server.edu) resolved to the IP
         address (10.127.24.79) and was pingable.  Check that the IP address is
         registered correctly with the DNS server.
         ......................... YELLOW failed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\YELLOW
      Skipping all tests, because server YELLOW is
      not responding to directory service requests

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : bme
      Starting test: CrossRefValidation
         ......................... bme passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... bme passed test CheckSDRefDom

   Running enterprise tests on : server.edu
      Starting test: Intersite
         ......................... server.edu passed test Intersite
      Starting test: FsmoCheck
         ......................... server.edu passed test FsmoCheck


dcdiag from working:
P:\>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\AD1
      Starting test: Connectivity
         ......................... AD1 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\AD1
      Starting test: Replications
         ......................... AD1 passed test Replications
      Starting test: NCSecDesc
         ......................... AD1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... AD1 passed test NetLogons
      Starting test: Advertising
         ......................... AD1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... AD1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... AD1 passed test RidManager
      Starting test: MachineAccount
         ......................... AD1 passed test MachineAccount
      Starting test: Services
         ......................... AD1 passed test Services
      Starting test: ObjectsReplicated
         ......................... AD1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... AD1 passed test frssysvol
      Starting test: frsevent
         ......................... AD1 passed test frsevent
      Starting test: kccevent
         ......................... AD1 passed test kccevent
      Starting test: systemlog
         ......................... AD1 passed test systemlog
      Starting test: VerifyReferences
         ......................... AD1 passed test VerifyReferences

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : bme
      Starting test: CrossRefValidation
         ......................... bme passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... bme passed test CheckSDRefDom

   Running enterprise tests on : server.edu
      Starting test: Intersite
         ......................... server.edu passed test Intersite
      Starting test: FsmoCheck
         ......................... server.edu passed test FsmoCheck

P:\>
share|improve this question
1  
You don't tell us what steps you HAVE taken. Can you include the full output of dcdiag, both from a working DC and from the new DC ? –  adaptr Apr 13 '12 at 15:31
    
Could you edit and include the dcdiag output from the nonworking server and one working server? –  Falcon Momot Apr 13 '12 at 16:01
    
edited to show results from 'dcdiag' - both working and non- –  ethrbunny Apr 13 '12 at 16:19
    
95% of all AD issues are actually DNS issues. You will do well with AD if you remember to always look there first. –  uSlackr Apr 13 '12 at 17:22

2 Answers 2

up vote 2 down vote accepted

Check that the DNS settings on the new DC; ensure it is querying a local DNS server and can resolve the names of the other servers. That you can resolve its name doesn't imply that it can resolve the names of the other DCs, and chances are this is the issue.

It's possible that it can resolve the names of the other servers using NBNS or WINS but not DNS, or the other way around.

Edit: By the output you've added above, it's clear that the issue is in DNS. Check the logs on your DNS servers for failed updates and such, and ensure the new server has permission to make DNS changes (though as a DC it should be able to do this). The problem isn't that the server's name is not resolving, but that its SRV record isn't working.

You could use dig (ships with BIND, the unix name daemon, but there is a windows version floating around somewhere) to check what you get for IN SRV and IN A 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu on each of your DNS servers.

share|improve this answer
    
It can resolve all the other machines. Likewise, the old machines can resolve the new one. All tests done via 'ping' and 'nslookup'. –  ethrbunny Apr 13 '12 at 15:46
    
ok. I will take this avenue and see where it leads me. thank you. –  ethrbunny Apr 13 '12 at 16:44
    
are you saying that all the other machines can resolve 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu, but the Dc you are adding can't? –  Jim B Apr 13 '12 at 16:47
    
no - only that dcdiag reports this error from the new machine. Oddly enough its reporting that it can't find itself. –  ethrbunny Apr 13 '12 at 16:52
    
It may not be using itself as a resolver and it may be unable to update its own DNS data. –  Falcon Momot Apr 13 '12 at 17:01

Do not bother with dig or nslookup. Just go to the DNS administration tool and look up what records the DNS servers have. Do the following:

  • Login using RDP to one of your DCs
  • Start the DNS administration tool
  • Click on the DC in the list
  • Click on "Forward Lookup Zones"
  • Click on "_msdcs.(your domain)"

Look at the entries on the right side. You should have one NS record and one CNAME record for each of your DCs.

Verify there is a CNAME record where the name is 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9 and the data is the FQDN of the DC.

From what you are saying, the record is missing from the problematic DC. Confirm the _msdcs.(your domain) zone is set for AD integration in the Properties window.

share|improve this answer
    
DNS is run on machines that I don't have full access to. I can add records for my servers (via web) but I don't RDP access to these machines. –  ethrbunny Apr 13 '12 at 17:57
    
Can you install the remote server administration tools on a Windows machine you have access to? With enough permission, that will give you access to the DNS administration tool without RDP access to the DC. –  Tom Ligda Apr 13 '12 at 18:01
    
Not permitted unf. Im thinking that maybe I need to remove my new machine from DNS altogether, wait a day for it all to clear out and try readding it. Maybe I made a mistake somewhere along the way. –  ethrbunny Apr 13 '12 at 18:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.