Can't add client machine to windows server 2008 domain controller

Question

A bit of background before I dive into the gritty details: I have a single server running Windows 2003 Server where I host my ASP.net website and SQL Server + Reports. I've been creating ordinary windows user accounts to authenticate my users, and I enabled integrated windows authentication with impersonation. I've set up a bunch of user groups which correspond to certain roles (admin, power user, normal user, etc) and I test membership to enable or disable certain features. Overall, I'm pretty happy with the solution, it was quick to setup and I don't have to worry about messing around storing passwords and whatnot.

Well, what I'm trying to do now is set up a new environment with 3 servers (Web, SQL, Reports) and I'd like these three servers to share common user accounts. I understand that I could add these three machines to a domain, which means installing Active Directory on one of the machines.

I am barking up the wrong tree here? Would you suggest an alternative configuration?

Assuming that I stick with AD, I have a couple of questions regarding DNS. To be honest, I'd rather not fiddle around with the DNS settings because my ISP already has their own DNS server which works just fine. It would appear however that DNS and AD are intertwined.

Firstly, if I am to create a new domain in called mycompany.net, do I actually need to be the registered owner of that domain name and ensure the DNS entry points to the IP address of the machine hosting AD?

Secondly, for the two other machines that I am trying to add to the domain, do I need to fiddle with their DNS settings? I've tried setting the preferred DNS Server IP address to that of my newly installed AD, but no luck.

At this point, I can't add the two other machines to the domain.

Here are some diagnostics that I have run based on a few suggestions I read on forums (sorry they're in French, although I could translate if needed). I ran nltest, which seems to indicate that the client can discover the domain controller. When I run dcdiag, the call to DsGetDcName fails with error 1722, not really sure what that means.

Any suggestions? Thanks!

C:\Users\Administrator>nltest /dsgetdc:mycompany.net
           Contrôleur de domaine : \\REPORTS.mycompany.net
      Adresse : \\111.111.111.111
     GUID dom : 3333a4ec-ca56-4f02-bb9e-76c29c6c3832
     Nom dom : mycompany.net
  Nom de la forêt : mycompany.net
 Nom de site du contrôleur de domaine : Default-First-Site-Name
Nom de notre site : Default-First-Site-Name
        Indicateurs : PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS
_FOREST CLOSE_SITE FULL_SECRET
La commande a été correctement exécutée


C:\Users\Administrator>dcdiag /s:mycompany.net /u: mycompany.net \pcollins /p:somepass

Diagnostic du serveur d'annuaire

Exécution de l'installation initiale :
   * Forêt AD identifiée.
   Collecte des informations initiales terminée.

Exécution des tests initiaux nécessaires

   Test du serveur : Default-First-Site-Name\REPORTS
      Démarrage du test : Connectivity
         ......................... Le test Connectivity
          de REPORTS a réussi

Exécution des tests principaux

   Test du serveur : Default-First-Site-Name\REPORTS
      Démarrage du test : Advertising
         Erreur irrécupérable : l'appel DsGetDcName (REPORTS) a échoué ; erreur
         1722
         Le localisateur n'a pas pu trouver le serveur.
         ......................... Le test Advertising
          de REPORTS a échoué
      Démarrage du test : FrsEvent
         Impossible d'interroger le journal des événements
         File Replication Service sur le serveur REPORTS.mycompany.net. Erreur
         0x6ba « Le serveur RPC n'est pas disponible. »
         ......................... Le test FrsEvent
          de REPORTS a échoué
      Démarrage du test : DFSREvent
         Impossible d'interroger le journal des événements DFS Replication sur
         le serveur REPORTS.mycompany.net. Erreur 0x6ba
         « Le serveur RPC n'est pas disponible. »
         ......................... Le test DFSREvent
          de REPORTS a échoué
      Démarrage du test : SysVolCheck
         [REPORTS] Une opération net use ou LsaPolicy a échoué avec l'erreur
         53, Le chemin réseau n'a pas été trouvé..
         ......................... Le test SysVolCheck
          de REPORTS a échoué
      Démarrage du test : KccEvent
         Impossible d'interroger le journal des événements Directory Service
         sur le serveur REPORTS.mycompany.net. Erreur 0x6ba
         « Le serveur RPC n'est pas disponible. »
         ......................... Le test KccEvent
          de REPORTS a échoué
      Démarrage du test : KnowsOfRoleHolders
         ......................... Le test KnowsOfRoleHolders
          de REPORTS a réussi
      Démarrage du test : MachineAccount
         Impossible d'ouvrir le canal avec [REPORTS] : échec avec l'erreur 53 :
         Le chemin réseau n'a pas été trouvé.
         Impossible d'obtenir le nom de domaine NetBIOS
         Échec : impossible de tester le nom principal de service (SPN) HOST
         Échec : impossible de tester le nom principal de service (SPN) HOST
         ......................... Le test MachineAccount
          de REPORTS a réussi
      Démarrage du test : NCSecDesc
         ......................... Le test NCSecDesc
          de REPORTS a réussi
      Démarrage du test : NetLogons
         [REPORTS] Une opération net use ou LsaPolicy a échoué avec l'erreur
         53, Le chemin réseau n'a pas été trouvé..
         ......................... Le test NetLogons
          de REPORTS a échoué
      Démarrage du test : ObjectsReplicated
         ......................... Le test ObjectsReplicated
          de REPORTS a réussi
      Démarrage du test : Replications
         ......................... Le test Replications
          de REPORTS a réussi
      Démarrage du test : RidManager
         ......................... Le test RidManager
          de REPORTS a réussi
      Démarrage du test : Services
         Impossible d'ouvrir IPC distant à [REPORTS.mycompany.net] : erreur 0x35
         « Le chemin réseau n'a pas été trouvé. »
         ......................... Le test Services
          de REPORTS a échoué
      Démarrage du test : SystemLog
         Impossible d'interroger le journal des événements System sur le
         serveur REPORTS.mycompany.net. Erreur 0x6ba
         « Le serveur RPC n'est pas disponible. »
         ......................... Le test SystemLog
          de REPORTS a échoué
      Démarrage du test : VerifyReferences
         ......................... Le test VerifyReferences
          de REPORTS a réussi


   Exécution de tests de partitions sur ForestDnsZones
      Démarrage du test : CheckSDRefDom
         ......................... Le test CheckSDRefDom
          de ForestDnsZones a réussi
      Démarrage du test : CrossRefValidation
         ......................... Le test CrossRefValidation
          de ForestDnsZones a réussi

   Exécution de tests de partitions sur DomainDnsZones
      Démarrage du test : CheckSDRefDom
         ......................... Le test CheckSDRefDom
          de DomainDnsZones a réussi
      Démarrage du test : CrossRefValidation
         ......................... Le test CrossRefValidation
          de DomainDnsZones a réussi

   Exécution de tests de partitions sur Schema
      Démarrage du test : CheckSDRefDom
         ......................... Le test CheckSDRefDom
          de Schema a réussi
      Démarrage du test : CrossRefValidation
         ......................... Le test CrossRefValidation
          de Schema a réussi

   Exécution de tests de partitions sur Configuration
      Démarrage du test : CheckSDRefDom
         ......................... Le test CheckSDRefDom
          de Configuration a réussi
      Démarrage du test : CrossRefValidation
         ......................... Le test CrossRefValidation
          de Configuration a réussi

   Exécution de tests de partitions sur mycompany
      Démarrage du test : CheckSDRefDom
         ......................... Le test CheckSDRefDom
          de mycompany a réussi
      Démarrage du test : CrossRefValidation
         ......................... Le test CrossRefValidation
          de mycompany a réussi

   Exécution de tests d'entreprise sur mycompany.net
      Démarrage du test : LocatorCheck
         Avertissement : l'appel DcGetDcName(GC_SERVER_REQUIRED) a échoué ;
         erreur 1722
         Serveur de catalogue global introuvable - Les catalogues globaux ne
         fonctionnent pas.
         Avertissement : l'appel DcGetDcName(PDC_REQUIRED) a échoué ; erreur
         1722
         Contrôleur principal de domaine introuvable.
         Le serveur contenant le rôle PDC ne fonctionne pas.
         Avertissement : l'appel DcGetDcName(TIME_SERVER) a échoué ; erreur
         1722
         Serveur de temps introuvable.
         Le serveur contenant le rôle PDC ne fonctionne pas.
         Avertissement : l'appel DcGetDcName(GOOD_TIME_SERVER_PREFERRED) a
         échoué ; erreur 1722
         Serveur de temps introuvable.
         Avertissement : l'appel DcGetDcName(KDC_REQUIRED) a échoué ; erreur
         1722
         Centre de distribution de clés introuvable : les centres de
         distribution de clés ne fonctionnent pas.
         ......................... Le test LocatorCheck
          de mycompany.net a échoué
      Démarrage du test : Intersite
         ......................... Le test Intersite
          de mycompany.net a réussi

Update 1 :

I am under the distinct impression that the problem is caused by some security settings. I have read elsewhere that the client needs to be able to access the fileshare sysvol. I had to enable Client for Microsoft Windows and File and Printer Sharing which were previously disabled. When I now run dcdiag the Advertising test works, which I suppose is forward progress. It currently chokes on the Services step (unable to open remote IPC).

  Démarrage du test : Services
     Impossible d'ouvrir IPC distant à [REPORTS.locbus.net] : erreur 0x35
     « Le chemin réseau n'a pas été trouvé. »
     ......................... Le test Services
      de REPORTS a échoué

The original English version of that error message : Could not open Remote ipc to [server]

Update 2 :

I attach some more diagnostics :

Netsetup.log (client):

09/24/2009 13:27:09:773 -----------------------------------------------------------------
09/24/2009 13:27:09:773 NetpValidateName: checking to see if 'WEB' is valid as type 1 name
09/24/2009 13:27:12:773 NetpCheckNetBiosNameNotInUse for 'WEB' [MACHINE] returned 0x0
09/24/2009 13:27:12:773 NetpValidateName: name 'WEB' is valid for type 1
09/24/2009 13:27:12:805 -----------------------------------------------------------------
09/24/2009 13:27:12:805 NetpValidateName: checking to see if 'WEB' is valid as type 5 name
09/24/2009 13:27:12:805 NetpValidateName: name 'WEB' is valid for type 5
09/24/2009 13:27:12:852 -----------------------------------------------------------------
09/24/2009 13:27:12:852 NetpValidateName: checking to see if 'MYCOMPANY.NET' is valid as type 3 name
09/24/2009 13:27:12:992 NetpCheckDomainNameIsValid [ Exists ] for 'MYCOMPANY.NET' returned 0x0
09/24/2009 13:27:12:992 NetpValidateName: name 'MYCOMPANY.NET' is valid for type 3
09/24/2009 13:27:21:320 -----------------------------------------------------------------
09/24/2009 13:27:21:320 NetpDoDomainJoin
09/24/2009 13:27:21:320 NetpMachineValidToJoin: 'WEB'
09/24/2009 13:27:21:320     OS Version: 6.0
09/24/2009 13:27:21:320     Build number: 6002
09/24/2009 13:27:21:320     ServicePack: Service Pack 2
09/24/2009 13:27:21:414     SKU: Windows Server® 2008 Standard
09/24/2009 13:27:21:414 NetpDomainJoinLicensingCheck: ulLicenseValue=1, Status: 0x0
09/24/2009 13:27:21:414 NetpGetLsaPrimaryDomain: status: 0x0
09/24/2009 13:27:21:414 NetpMachineValidToJoin: status: 0x0
09/24/2009 13:27:21:414 NetpJoinDomain
09/24/2009 13:27:21:414     Machine: WEB
09/24/2009 13:27:21:414     Domain: MYCOMPANY.NET
09/24/2009 13:27:21:414     MachineAccountOU: (NULL)
09/24/2009 13:27:21:414     Account: MYCOMPANY.NET\pcollins
09/24/2009 13:27:21:414     Options: 0x25
09/24/2009 13:27:21:414 NetpLoadParameters: loading registry parameters...
09/24/2009 13:27:21:414 NetpLoadParameters: DNSNameResolutionRequired not found, defaulting to '1' 0x2
09/24/2009 13:27:21:414 NetpLoadParameters: status: 0x2
09/24/2009 13:27:21:414 NetpValidateName: checking to see if 'MYCOMPANY.NET' is valid as type 3 name
09/24/2009 13:27:21:523 NetpCheckDomainNameIsValid [ Exists ] for 'MYCOMPANY.NET' returned 0x0
09/24/2009 13:27:21:523 NetpValidateName: name 'MYCOMPANY.NET' is valid for type 3
09/24/2009 13:27:21:523 NetpDsGetDcName: trying to find DC in domain 'MYCOMPANY.NET', flags: 0x40001010
09/24/2009 13:27:22:039 NetpDsGetDcName: failed to find a DC having account 'WEB$': 0x525, last error is 0x79
09/24/2009 13:27:22:039 NetpDsGetDcName: status of verifying DNS A record name resolution for 'KING.MYCOMPANY.NET': 0x0
09/24/2009 13:27:22:039 NetpDsGetDcName: found DC '\\KING.MYCOMPANY.NET' in the specified domain
09/24/2009 13:27:30:039 NetUseAdd to \\KING.MYCOMPANY.NET\IPC$ returned 53
09/24/2009 13:27:30:039 NetpJoinDomain: status of connecting to dc '\\KING.MYCOMPANY.NET': 0x35
09/24/2009 13:27:30:039 NetpDoDomainJoin: status: 0x35
09/24/2009 13:27:30:148 -----------------------------------------------------------------

ipconfig /all (on client):

Configuration IP de Windows

   Nom de l'hôte . . . . . . . . . . : WEB
   Suffixe DNS principal . . . . . . :
   Type de noeud. . . . . . . . . .  : Hybride
   Routage IP activé . . . . . . . . : Non
   Proxy WINS activé . . . . . . . . : Non

Carte Ethernet Connexion au réseau local :

   Suffixe DNS propre à la connexion. . . :
   Description. . . . . . . . . . . . . . : Intel 21140-Based PCI Fast Ethernet
Adapter (Emulated)
   Adresse physique . . . . . . . . . . . : **-15-5D-A1-17-**
   DHCP activé. . . . . . . . . . . . . . : Non
   Configuration automatique activée. . . : Oui
   Adresse IPv4. . . . . . . . . . . : **.***.163.122(préféré)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Passerelle par défaut. . . . . . . . . : **.***.163.2
   Serveurs DNS. . .  . . . . . . . . . . : **.***.163.123
   NetBIOS sur Tcpip. . . . . . . . . . . : Activé

ipconfig /all (on server):

Configuration IP de Windows

   Nom de l'hôte . . . . . . . . . . : KING
   Suffixe DNS principal . . . . . . : mycompany.net
   Type de noeud. . . . . . . . . .  : Hybride
   Routage IP activé . . . . . . . . : Non
   Proxy WINS activé . . . . . . . . : Non
   Liste de recherche du suffixe DNS.: locbus.net

Carte Ethernet Connexion au réseau local :

   Suffixe DNS propre à la connexion. . . :
   Description. . . . . . . . . . . . . . : Intel 21140-Based PCI Fast Ethernet
Adapter (Emulated)
   Adresse physique . . . . . . . . . . . : **-15-5D-A1-1E-**
   DHCP activé. . . . . . . . . . . . . . : Non
   Configuration automatique activée. . . : Oui
   Adresse IPv4. . . . . . . . . . . : **.***.163.123(préféré)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Passerelle par défaut. . . . . . . . . : **.***.163.2
   Serveurs DNS. . .  . . . . . . . . . . : 127.0.0.1
   NetBIOS sur Tcpip. . . . . . . . . . . : Activé

nslookup (on client):

Serveur :  *******.***.com
Address:  **.***.163.123

Nom :    mycompany.net
Addresses:  ****:****:a37b::****:a37b
          **.****.163.123

Answer 1

You are correct-- Active Directory has strong dependencies on DNS.

To make this easy, you should install the Microsoft DNS server onto the domain controller computer and configure it to use itself for DNS. Your ISP's DNS servers probably don't support the dynamic updates that would make life w/ Active Directory easy (and they probably won't configure a zone for your AD domain's name anyway).

You can optionally configure your ISP's DNS server as a "Forwarder" in the DNS server you run to allow queries your DNS server can't answer to be sent on to your ISP, but the Microsoft DNS server will resolve queries to the root DNS servers in its "stock" configuration. Not using your ISP's DNS server really isn't a big deal, though.

Configure the machines that you'd like to join your domain to use your domain controller's DNS server as their only DNS server. Don't specify any other DNS servers on any of the machines. They should be using your Microsoft DNS server's IP address as their exclusive DNS server.

That'll get you over the problem of not being able to join your other machines to the domain. Be sure, when you try to join the domain from these machines, that you specify the fully-qualified domain name (and, if necessary, check with "nslookup" to see that they can resolve the domain's name to an "A" record that refers to the domain controller computer). If you've tried several times and it's still not working you may want to flush the DNS cache on the machine you're trying to join by running an "ipconfig /flushdns" from an elevated command-prompt.

---

You can use whatever name you want for your Active Directory domain's DNS name. Only your servers will be using a DNS server that "knows about" your domain, so you can choose any name you want. Bear in mind that your DNS server is going to be "authoritative" for that domain. If you choose "microsoft.com" as your Active Directory domain name, for example, your domain-member computers won't be able to resolve "real" names in the "microsoft.com" namespace (since your DNS server will think that it "owns" the "microsoft.com" domain).

I recommend that you either use a subdomain of a domain name you already own, like "ad.company.com", or that you use a domain with the ".local" suffix (some people say that using ".local" isn't "proper" since no RFC calls it out as being reserved). I prefer the "ad.company.com" style names. It looks like you've already installed AD, though, so your name choice is somewhat "set". (It's possible to rename a domain, and not really too difficult, but in this case it might be better to uninstall and reinstall AD.)