Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Have a domain running at ent.website.com, the domain is running Windows Server 2012 R2, WSUS Server, the DNS Server, and the Remote Access VPN server. In HyperV we have another Windows Server 2012 R2 installation running a Remote Access DirectAccess server.

At home I set up a VirtualMachine running Windows 7 Enterprise, connected to the VPN, joined the domain, and updated all the policies and downloaded Windows Updates from the remote WSUS Server.

After this was tested and working, I disconnected from the VPN to test out DirectAccess. DirectAccess worked and I was able to perform group policy updates and access NetworkShares. Rebooted a couple times to test -- worked fine. The next day everything stopped working.

Aside from troubleshooting DirectAccess which no longer works, when I connect via the VPN I am unable to perform group policy updates. I have the network shares working now by manually specifying the domain controller's local IP address (1.1.1.5).

Domain Server IP: 1.1.1.5
FQDN: server-host.ent.website.com

From the client machine while connected via VPN:

ping 1.1.1.5 ... success
ping server-host ... success (resolves to 1.1.1.5)
ping ent.website.com ... Ping request could not find host ent.website.com. Please check the name and try again.
nslookup ent
  Server: UnKnown
  Address: 1.1.1.5

  Name: ent.website.com
  Address: 1.1.1.5

nslookup server-host
  Server: UnKnown
  Address: 1.1.1.5

  Name: server-host.ent.website.com
  Addresses: 1.1.1.240
    1.1.1.5

Can anyone help troubleshoot why this suddenly stopped working? Now within the office there is at least one user who cannot update GPOs, but for the most part things are working while within the office.

I've been searching and trying anything I can find, but still not resolutions. I have flushed dns, stopped the dns client service, disabled ipv6 on the client, etc.

Client Computer ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : NAME-HOME
   Primary Dns Suffix  . . . . . . . : ent.website.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : ent.website.com

PPP adapter SPI Test:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Test
   Physical Address. . . . . . . . . : 
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 1.1.1.244(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.255
   Default Gateway . . . . . . . . . : 0.0.0.0
   DNS Servers . . . . . . . . . . . : 1.1.1.5
   Primary WINS Server . . . . . . . : 10.20.2.11
   Secondary WINS Server . . . . . . : 10.20.3.29
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Desktop Adapter
   Physical Address. . . . . . . . . : 08-00-00-00-F5-00
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.0.0.26(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, May 15, 2014 2:20:19 PM
   Lease Expires . . . . . . . . . . : Thursday, May 29, 2014 2:20:19 PM
   Default Gateway . . . . . . . . . : 10.0.0.1
   DHCP Server . . . . . . . . . . . : 192.168.88.1
   DNS Servers . . . . . . . . . . . : 1.1.1.5
                                       8.8.8.8
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{04A26238-27A8-4477-A0D5-5B301FB26C41}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : **hidden** (Preferred) 
   Link-local IPv6 Address . . . . . : **hidden** (Preferred) 
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{5155AA83-E6D5-4458-BDF7-4C37C874E4F4}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter iphttpsinterface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : iphttpsinterface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Ok so I have this figured out now. Fortunately there was another issue with a piece of software we have called AMS360 which led me to look at other settings. Still haven't fully resolved DirectAccess problems, but we added Domain Computers to the DirectAccess group which resulted in numerous problems. The Domain Computers group was only part of the DirectAccess group for a few hours so only some machines received the update and those machines had the issue.

The resolution is to not add Domain Computers to DirectAcess, and to instead add each machine individually. Once removed, the machines had to be rejoined to the machine. The issues I personally was experiencing and posted here are now resolved after rejoining the domain and including only the machine name in the DA group, however AMS360 does not like not being connected to the network either physically or over VPN. As a result, in order to use AMS360 a VPN needs to be used at this time.

The test parameter to look for is whether the machine is connected to the Domain Firewall, and this only happens after rejoining the domain if the Group Setting I mentioned was in place. I'm sort of off on a tangent now, but hopefully I've put in enough keywords for if someone else has this issue they can respond and I can respond to them more clearly.

share|improve this question

migrated from superuser.com May 19 at 6:09

This question came from our site for computer enthusiasts and power users.

    
Something's telling me that an IP of 1.1.*.* isn't actually reserved for internal use... I think you're violating the assumptions of the tools with this weird setup. –  Riking May 16 at 1:41
    
I masked all of the actual IP addresses, they are something else for internal use. Anyways I can't imagine anyone arriving at the solution I have now from the information provided -- going to update my post with the answer. –  akevit May 16 at 5:42
    
Don't update your post with the answer -- write an answer! Self-answered questions are explicitly encouraged. –  Riking May 16 at 5:43
    
I will do so, however the question I posed turns out to be a contingency of a more important problem that I eventually found out about. Anyways my slight issue was solved, and a major issue is now slightly resolved by rejoining the domain and using a VPN instead of DirectAccess. –  akevit May 16 at 5:50
add comment

1 Answer 1

Ok so I have this figured out now. Fortunately there was another issue with a piece of software we have called AMS360 which led me to look at other settings. Still haven't fully resolved DirectAccess problems, but we added Domain Computers to the DirectAccess group which resulted in numerous problems. The Domain Computers group was only part of the DirectAccess group for a few hours so only some machines received the update and those machines had the issue.

The resolution is to not add Domain Computers to DirectAcess, and to instead add each machine individually. Once removed, the machines had to be rejoined to the domain. The issues I personally was experiencing and posted here are now resolved after rejoining the domain and including only the machine name in the DA group, however AMS360 does not like not being connected to the network either physically or over VPN. As a result, in order to use AMS360 a VPN needs to be used at this time.

The test parameter to look for is whether the machine is connected to the Domain Firewall, and this only happens after rejoining the domain if the Group Setting I mentioned was in place. I'm sort of off on a tangent now, but hopefully I've put in enough keywords for if someone else has this issue they can respond and I can respond to them more clearly.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.