Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two domain controllers set up something like this:

ServerA.mydomain.local: (Windows Server 2008)
ServerB.mydomain.local: (Windows server 2008 R2)

For login scripts and the like, I use the path: \\mydomain.local\netlogon

This seems to always default to ServerB. If I turn off or restart ServerB (a process which takes several minutes), attempting to visit \\mydomain.local does not flip to ServerA. If I ping mydomain.local, it always returns the IP address of ServerB, even when it has been turned off.

I thought this was supposed to be a round-robin system.

Why am I seeing this behavior, and how can I fix it?

share|improve this question
By "domain servers" do you mean "domain controllers"? and can you navigate to \\serverA\netlogon? – MDMarra Jun 1 '12 at 14:02
Yes, I can reach the server by its direct name. – Force Flow Jun 1 '12 at 14:04
A couple of things to check here... First, do both controllers run DNS? Second, are both domain controllers listed as the SOA and NS for the domain? Third, are all of your clients configured to use both DNS servers? Last, what does "nslookup mydomain.local" return? – Brent Pabst Jun 1 '12 at 14:05
Both servers are running DNS. ServerA lists ServerA as the SOA, and ServerB lists ServerB as the SOA. NS records list both server names on both servers. No, clients are only configured for nslookup returns "unknown" for and "mydomain.local" for – Force Flow Jun 1 '12 at 14:11
On serverA, If I add to DHCP's DNS entries, it is added. On serverB, If I add to DHCP's DNS entires, I get the error after verification: "The IP address is not a valid DNS address, do you still want to add it?" – Force Flow Jun 1 '12 at 14:21
up vote 3 down vote accepted

There's not really enough information here to answer your question, but hopefully some of this can give you a better understanding of how Active Directory functions and maybe you'll be pointed on the right path.

For login scripts and the like, I use the path: \\mydomain.local\netlogon

mydomain.local is a DNS zone that lives on the DNS servers for your Active Directory. By default, new domain controllers register A records for themselves in this zone and they also register A records for the zone name itself as their IP. The records should be in the mydomain.local zone and look like this:

(Same as parent folder) Host(A) <timestamp>
(Same as parent folder) Host(A) <timestamp>

If you do nslookup mydomain.local the DNS server should return a list of all domain controllers. If not, you're missing an A record at the very least.

If one of those is missing, you should re-create it manually and do some root-cause analysis to find why it's missing. When a client tries to look up \\mydomain.local in this case, it is doing it by the A record.

You should also check the _msdcs zone and make sure that both servers are listed there where they should be. If you can log on while serverB is offline, then this zone is likely OK.

You should use dcdiag.exe just to make sure that both domain controllers are in fact healthy and functioning properly.

Also, if you're not running DNS on both DCs, you should and your clients should use both servers for DNS.

Also, the DCs should use each other as the primary server for name resolution and themselves as secondaries to prevent replication issues. Just to clarify, this means:

Primary DNS
Secondary DNS

Primary DNS
Secondary DNS

If you don't do this, you run the risk of breaking replication in certain situations.

share|improve this answer
The A records already exist. ServerA passes dcdiag.exe. On serverB, everything passed except for the ServerLog. There was a whole list of error log entries for DNS for "the dynamic registration of the DNS record failed". In the ServerB event logs, there are multiple errors and warnings. The errors give the message event ID 408: "The DNS server could not open socket for address " – Force Flow Jun 1 '12 at 14:33
So, when you run nslookup mydomain.local serverA.mydomain.local and nslookup mydomain.local serverB.mydomain.local they both return both server IPs? And are your domain controllers configured as I suggested? This would resolve any replication or resolution issues. – MDMarra Jun 1 '12 at 14:35
Yes. Each server should be the secondary for the other. As you add more DNS servers you keep adding DNS servers to the list. This gives you round-robin DNS searches. – Brent Pabst Jun 1 '12 at 15:09
@BrentPabst this is the link that I usually give. – MDMarra Jun 1 '12 at 17:02
@MDMarra +1, Thanks. Good info. I guess I could see how this could happen. Surprised its able to though. Better solution, just use the externally bound IPs whenever possible. – Brent Pabst Jun 1 '12 at 17:06

Based on the fact that DHCP is complaining when you try to add the server IP address I suggest you check the following:

At a Prompt:

C:\> nslookup
C:\> server servera
C:\> mydomain.local

Run this for both Server A & B. If you don't get a response from either of them you may have two issues:

  1. DNS Service is not running or enabled
  2. Firewall may be blocking traffic to the server

Let us know if the commands both come back properly.

share|improve this answer
nslookup for ServerA returns "server: unknown, address:, name:ymca.local, address:" nslookup for ServerB returns "DNS request timed out". ServerB has the DNS running and the services are in the "Started" state. The firewall has the auto-added firewall rules for DNS enabled. – Force Flow Jun 1 '12 at 14:41
OK, neither server appear to have PTR records, but thats ok. However, I see two other problems, first, ymca.local should have returned two IPs, one for server a and another for server b, check your DNS A records again. Second, You need to do some checking with Server B as the request is getting lost somewhere between your keyboard and the server. You can check to see if its a DNS problem by simply running the Server B test again but swap in the IP address instead of the DNS name on the second command. – Brent Pabst Jun 1 '12 at 14:46
using the IP address instead of the server's name still results in a timeout. – Force Flow Jun 1 '12 at 15:00
Yea, check the connection, service, and allowed ports, something isn't right there. – Brent Pabst Jun 1 '12 at 15:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.