1

I'm trying to setup AD/DNS on my new server running Windows 2012 R2. I've installed the roles, configured a static ip, made forward and reverse zones, etc. In the events list I see 408, 407, and 404 errors. When running dcdiag it fails on the connectivity test:

Testing server: Default-First-Site-Name\DCName
   Starting test: Connectivity
      The host <numbers>._msdcs.domain.foo could not be resolved to an IP address. Check
      the DNS server, DHCP, server name, etc.
      Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
      ......................... DCName failed test Connectivity

I'm concerned that perhaps the ip address is not configured correctly should the static ip and "DNS server" be the same?

Could it perhaps have something to do with the fact this is running as a virtual machine isolated from the internet?

EDIT

Event Text:
407 The DNS server could not bind a User Datagram Protocol (UDP) socket to <server ip>. The event data is the error code. Restart the DNS server or reboot your computer.

408

The DNS server could not open socket for address <server ip>. 
Verify that this is a valid IP address for the server computer.  If it is NOT valid use the Interfaces dialog under Server Properties in the DNS Manager to remove it from the list of IP interfaces.  Then stop and restart the DNS server. (If this was the only IP interface on this machine and the DNS server may not have started as a result of this error.  In that case remove the DNS\Parameters\ ListenAddress value in the services section of the registry and restart.) 

If this is a valid IP address for this machine, make sure that no other application (e.g. another DNS server) is running that would attempt to use the DNS port. 

For more information, see "DNS server log reference" in the online Help.

404

The DNS server could not bind a Transmission Control Protocol (TCP) socket to address <server ip>.  The event data is the error code.  An IP address of 0.0.0.0 can indicate a valid "any address" configuration in which all configured IP addresses on the computer are available for use. 
Restart the DNS server or reboot the computer.
5
  • At this point this probably sounds like a cliché, but I'd start by checking the DNS client settings on the DC in question.
    – joeqwerty
    Oct 16, 2015 at 23:54
  • It's not cliché for me, but I assume that the 408, 407, and 402 errors would be blocking any client issues right? Oct 19, 2015 at 20:23
  • Without knowing the details of those Event ID's I couldn't say. Can you post the details of those events?
    – joeqwerty
    Oct 19, 2015 at 20:34
  • added as an edit above. Oct 19, 2015 at 23:55
  • 1
    Is there a third party firewall installed on this server? Has the Windows Firewall rules been manually configured? Is the DNS Server service started?
    – joeqwerty
    Oct 20, 2015 at 1:23

2 Answers 2

1

When you run repadmin /showreps, there should be a line that starts with "DSA Object Guid".

In the _msdcs zone for your forest in DNS Manager, there should be a cname for each domain controller's object guid. I would start by checking that the _msdcs zone is replicating to all the dc's, and that you have a cname record for the new dc.

If it is not present, you can try nltest /dsregdns.

Your domain controller network adapter DNS should point to itself and/or another domain controller. (Never an external domain controller like the Internet).

2
  • It has the "DSA Object Guid", there are no cnames seemingly anywhere. Running nltest /dsregdns doesn't create any. (About replicating this is the only DC) Oct 19, 2015 at 20:21
  • 1
    The only resource records that should be in the top level of the _msdcs zone are the CNAME's for the domain controller object guid's. Make sure you are checking the _msdcs zone, and not the _msdcs child delegation that is under your domain's zone. For newer forests, the _msdcs zone will be a top-level zone, and there will be a _msdcs child delegation under your domain zone that points to the _msdcs zone.
    – Greg Askew
    Oct 19, 2015 at 20:33
1

It's solved the solution was to go to open DNS Manager -> Expand Forward Lookup Zones->right click _msdcs.domain.foo-> properties-> Name Servers-> point to itself, then it just worked... previously it had no ip to look at.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .