Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have one domain and two domain controllers (on Windows Server 2008 Enterprise).

For about a week, we have enormous problems: some users can't log in to Windows (domain could not be contacted). Sometimes restart of Windows helps, but mostly it doesn't.

As administrator, I can't log in to DC0, on DC1 I can. The other administrator for example can log in to both DC.

I attached dcdiag /test:dns for both DC0. DC0:

 Directory Server Diagnosis


 Performing initial setup:

Trying to find home server...

 Home Server = DC0

* Identified AD Forest. 
  Done gathering initial info.


 Doing initial required tests


 Testing server: Default-First-Site-Name\DC0

  Starting test: Connectivity

     ......................... DC0 passed test Connectivity

Doing primary tests


Testing server: Default-First-Site-Name\DC0


  Starting test: DNS



     DNS Tests are running and not hung. Please wait a few minutes...

     ......................... DC0 passed test DNS


 Running partition tests on : ForestDnsZones


 Running partition tests on : DomainDnsZones


 Running partition tests on : Schema


 Running partition tests on : Configuration


 Running partition tests on : our_domain


 Running enterprise tests on : our_domain.si

  Starting test: DNS

     Test results for domain controllers:


        DC: DC0.our_domain.si

        Domain: our_domain.si




           TEST: Records registration (RReg)
              Network Adapter

              [00000006] Intel(R) PRO/1000 MT Network Connection:

                 Warning: 
                 Missing AAAA record at DNS server 193.77.60.214: 
                 gc._msdcs.our_domain.si

           Warning: Record Registrations not found in some network adapters


           DC0                          PASS PASS PASS PASS PASS WARN n/a  
     ......................... our_domain.si passed test DNS

DC1:

 Directory Server Diagnosis
 Performing initial setup:

 Trying to find home server...

 Home Server = DC1

 * Identified AD Forest. 
 Done gathering initial info.


 Doing initial required tests


  Testing server: Default-First-Site-Name\DC1

  Starting test: Connectivity

     ......................... DC1 passed test Connectivity



 Doing primary tests


  Testing server: Default-First-Site-Name\DC1


  Starting test: DNS



     DNS Tests are running and not hung. Please wait a few minutes...

     ......................... DC1 passed test DNS


 Running partition tests on : ForestDnsZones


 Running partition tests on : DomainDnsZones


 Running partition tests on : Schema


 Running partition tests on : Configuration


 Running partition tests on : our_domain


 Running enterprise tests on : our_domain.si

  Starting test: DNS

     Test results for domain controllers:


        DC: DC1.our_domain.si

        Domain: our_domain.si




           TEST: Dynamic update (Dyn)
              Warning: Failed to add the test record _dcdiag_test_record in zone our_domain.si

           TEST: Records registration (RReg)
              Network Adapter

              [00000006] Intel(R) PRO/1000 MT Network Connection:

                 Warning: 
                 Missing AAAA record at DNS server 193.77.60.213: 
                 DC1.our_domain.si

                 Warning: 
                 Missing AAAA record at DNS server 193.77.60.213: 
                 gc._msdcs.our_domain.si

                 Warning: 
                 Missing AAAA record at DNS server 193.77.60.214: 
                 DC1.our_domain.si

                 Warning: 
                 Missing AAAA record at DNS server 193.77.60.214: 
                 gc._msdcs.our_domain.si

           Warning: Record Registrations not found in some network adapters


           DC1                          PASS PASS PASS PASS WARN WARN n/a  
     ......................... our_domain.si passed test DNS

Here are IP's for DC0 and DC1 - they are all right (why there are so many?): DC0 DC1

Here is 'ipconfig /all' on DC0: enter image description here

share|improve this question
    
As a start, please check the following on DC0 Run services.msc and verify that all services who's name starts with "Active Directory" are started and set to automatic. Try to browse to \\dc0 and verify that the SYSVOL and NETLOGON shares are visible. These checks don't necessarily relate to your errors, other than it's mentioned that the sysvol folder may not be available, however they are good initial checks. –  Alex Berry Oct 17 '12 at 8:25
    
Service 'Active Directory Domain Services' is started and set to automatic (only this service starts with Active Directory). –  user1452932 Oct 17 '12 at 8:45
    
and the sysvol and netlogon shares? –  Alex Berry Oct 17 '12 at 8:46
    
When browsing dc0 both shares are visible (also scheduled tasks). –  user1452932 Oct 17 '12 at 8:50
2  
Sorry guys, but this is way past "too many" comments. User: It seems you're in over your head on this one, it might be time to get a local consultant. Alex: if you want to continue the discussion & diagnosis please do so in Server Fault Chat. –  Chris S Oct 17 '12 at 12:58

3 Answers 3

There are a couple of glaring problems here:

  1. Your Domain Controller that you've screen shotted is multi-homed. This is a problem. There is usually not a good reason to do this and there are special consideration to take in regards to DNS registration, etc. Have you followed these? I'm assuming not. Really consider redesigning your network to not multihome your DCs.

  2. Your DCs are using themselves first for DNS resolution. This can lead to a replication island like you're experiencing. They should use each other first and themselves (127.0.0.1) second.

  3. That 193 address that you've provided is a publicly routable IP. There is absolutely no reason that a Domain Controller should be Internet accessible. This in and of itself isn't going to break what you're seeing, but it's a huge security issue that you should fix asap.

share|improve this answer

Ok, so as the comment conversation looked to be going on forever, I will instead post what I believe the problem is:

Although it looks initially like an issue with DC0, it is actually an issue with replication between the two controllers and, as such, the problematic controller is DC1.

The easiest option open to you will be to shutdown DC1 and build a 3rd domain controller, DC2, then change secondary DNS settings on all servers and DHCP scopes to point to this server.

So long as you then have a stable domain I would suggest deleting DC1 from the domain and leaving it at that, any changes you have made on DC1 since it has last replicated will be lost, this includes users' password changes and new user accounts, so it will require some cleanup on your part, but if you can't fix the replication issue yourself (which, no offence meant, I don't believe you're capable of) this is the easiest way to resolve your problems.

If, on the other hand, you add DC2 with DC1 offline and are still having issues, I advise you seek assistance from a local Microsoft Professional.

share|improve this answer
    
We put DC1 offline (power off), but I still can't log in to DC0. When I open DNS on DC0, I get this error: The server DC0 could not be contacted. The error was: the server is unavailable. Would you like it to add it anyway. –  user1452932 Oct 18 '12 at 6:03
    
When I run nslookup in DC0, I get: 'Default server: unknown. ...' –  user1452932 Oct 18 '12 at 6:26
    
OK, I can log in on DC0 (remote control) with typing it's IP; if I type DC0, it doesn't work. I used 'ipconfig /registerdns' and with nslookup i get: 'Default server: unknown. Address: correct IP'. –  user1452932 Oct 18 '12 at 7:24

(This is only a partial answer to one of your side questions...)

For some reason your DCs have 6to4 addresses. If you're sure you aren't using 6to4 (you probably aren't) then you should probably disable it.

netsh interface ipv6 6to4 set state disabled
netsh interface teredo set state disabled
share|improve this answer
    
I did what You said, but ipv6 is still enabled. –  user1452932 Oct 18 '12 at 6:04
    
Of course it is. I didn't advise you to disable IPv6, and I probably never would. –  Michael Hampton Oct 18 '12 at 11:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.