Cannot create a new domain in an existing active directory forest

Question

I have a domain controller setup on Windows Server 2008 R2 (Forest) and I have another Windows Server 2008 R2 (New Domain) and I want to create a new domain in an existing forest. I get the following error:

An Active Directory domain controller for the domain mackdev.mackenziecarr.com could not be contacted

The error was "no records found for the given DNS query"

The query was for the SRV record for:
_ldap._tcp.dc._msdcs.mackdev.mackenziecarr.com

I've seem to have tried everything even tried adding this record to the DNS server of the primary forest. I even successfully joined this server to the domain without any issues but trying to create a new domain under the existing forest is no luck.

The primary forest I.P. address is 192.168.2.20 the server that I am using to try to make a child domain is 192.168.2.21

My ipconfig are as follows: I.P. Address: 192.168.2.21 Subnetmask: 255.255.255.0 Gateway: 192.168.2.1

Primary DNS: 192.168.2.20

Answer 1

It doesn't sound like you're doing this remotely correctly, so here's the Technet guide:

To install a new child domain by using the Windows interface

1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

2. In Roles Summary, click Add Roles.

3. If necessary, review the information on the Before You Begin page, and then click Next.

4. On the Select Server Roles page, click the Active Directory Domain Services check box, and then click Next.

   On a server that runs Windows Server 2008 R2, you may have to click Add Required Features to install .NET Framework 3.5.1 features before you can click Next.

5. If necessary, review the information on the Active Directory Domain Services page, and then click Next.

6. On the Confirm Installation Selections page, click Install.

7. On the Installation Results page, click Close this wizard and launch the Active Directory Domain Services Installation Wizard (dcpromo.exe).

8. On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next.

9. To get additional installation options, select the Use advanced mode installation check box.

10. On the Operating System Compatibility page, review the warning about the default security settings for Windows Server 2008 and Windows Server 2008 R2 domain controllers, and then click Next.

11. On the Choose a Deployment Configuration page, click Existing forest and Create a new domain in an existing forest, and then click Next.

12. On the Network Credentials page, type the name of any existing domain in the forest where you plan to install a new domain. Under Specify the account credentials to use to perform the installation, click My current logged on credentials or click Alternate credentials, and then click Set. In the Windows Security dialog box, provide the user name and password for an account that can install the new domain. To install a new domain, you must be a member of the Enterprise Admins group. When you are finished providing credentials, click Next.

13. On the Name the New Domain page, type the fully qualified domain name (FQDN) of the parent domain and the single-label name of the child domain, and then click Next.

14. Although Dcpromo.exe in Windows Server 2008 and Windows Server 2003 allows you to create a single-label DNS domain name, you should not use a single-label DNS name for a domain for several reasons. In Windows Server 2008 R2, Dcpromo.exe does not allow you to create a single-label DNS name for a domain. For more information, see http://go.microsoft.com/fwlink/?LinkId=92467.

    15. If you selected Use advanced mode installation on the Welcome page, the Domain NetBIOS Name page appears. On this page, type the NetBIOS name of the domain, if necessary, or accept the default name, and then click Next.

15. On the Set Domain Functional Level page, select the domain functional level that accommodates the domain controllers that you plan to install anywhere in the domain, and then click Next.

16. On the Select a Site page, select a site from the list or select the option to install the domain controller in the site that corresponds to its IP address, and then click Next.

17. On the Additional Domain Controller Options page, select any additional options for the domain controller, and then click Next.

18. The DNS server option is selected by default so that your domain controller can function as a DNS server. A DNS zone and a delegation for that zone will be created automatically for this domain.

19. The Global catalog option is not selected by default. If you select this option, this domain controller will also host the domain-wide operations master roles for the new domain, including the infrastructure master role. Hosting the infrastructure mater role on a global catalog server in a child domain can cause problems unless all the domain controllers in the domain are global catalog servers.

20. If you do not have static IPv4 and IPv6 addresses assigned to your network adapters, a warning message might appear advising you to set static addresses for both of these protocols before you can continue. If you have assigned a static IPv4 address to your network adapter and your organization does not use IPv6, you can ignore this message and click, Yes, the computer will use a dynamically assigned IP address (not recommended).

    We recommend that you not disable the IPv6 protocol.

21. If you selected Use advanced mode installation on the Welcome page, the Source Domain Controller page appears. Select Any writable domain controller or select This specific domain controller to specify a domain controller from which to replicate the configuration and schema directory partitions, and then click Next.

22. On the Location for Database, Log Files, and SYSVOL page, type or browse to the volume and folder locations for the database file, the directory service log files, and the SYSVOL files, and then click Next.

23. Windows Server Backup backs up the directory service by volume. For backup and recovery efficiency, store these files on separate volumes that do not contain applications or other nondirectory files.

24. On the Directory Services Restore Mode Administrator Password page, type and confirm the restore mode password, and then click Next. This password must be used to start AD DS in Directory Service Restore Mode (DSRM) for tasks that must be performed offline.

25. On the Summary page, review your selections. Click Back to change any selections, if necessary.

26. To save the installation settings that you selected to an answer file that you can use to automate subsequent AD DS installations, click Export settings. Type the name for your answer file, and then click Save.

27. When you are sure that your selections are accurate, click Next to install AD DS.

28. On the Completing the Active Directory Domain Services Installation Wizard page, click Finish.

29. You can either select the Reboot on completion check box to have the server restart automatically or you can restart the server to complete the AD DS installation when you are prompted to do so.

Answer 2

You do seem to have a dns problem rather than an ad problem, at least for now.

Have you verified you can make the dns query indicated in your output manually with nslookup? If you can't I would suggest verifying:

1) That your query chain is intact, i.e. that your dns clients point only to your internal dns servers (or two of them at least), and that forwarding/conditional forwarding between dns servers makes your entire internal dns namespace available to each dns server before recursing against internet name servers.

2) Ensuring you allow dynamic updates on each zone which has/will have an ad domain for the same namespace, and that the domain controllers succeed in populating the zone files with srv records.

3) If you are having trouble creating the new dns zone through the dcpromo wizard, create it manually on one of the servers where you wish it to be (I would suggest a dc and choosing to store the dns data in active directory). Choose a replication scope and make sure it allows for dynamic updates. Having the dns zone already in place makes it easier to debug the ad promotion process in my experience, as dns is an independent entity but to which ad has a critical dependency.

4) If you filter subnets internally or have host based firewalls, make sure you are not blocking ad/dns traffic between servers (and between clients and servers). On occasion one can see that problem too.