0

Before updating to 2012, old DC-name was: SERVER1

Now Primary-DC name is: SERVER2
SERVER1 was added to computer as DNS-CNAME-alias

Then we installed secondary DC: SERVER3 and tried switch SERVER1-name to that by updating DNS-CNAME-alias.

Currently PING-command works, \\[IP], \\SERVER2 and \\SERVER3 works
Problem: \\SERVER1 -disk shares only work, when name is linked to SERVER2

Error-messages when SERVER1 is linked to SERVER3:
- You do not have permission to access \\SERVER1. Contact your network administrator to request access.
- \\SERVER1 is not accessible. You might not have permission to use this network resource.

With Remote Desktop:
- The connection cannot be completed because the remote computer that was reached is not the one you specified.

Connection to \\SERVER1 does work with some computers, and it seems to work if I use login COMPUTER\USER1 instead of DOMAIN\USER1 (same password, naturally).

So it seems, that "AD has somehow identified SERVER1 as name of SERVER2", and it suspects DNS-spoofing etc., when SERVER3 is connected.

We have quite a lot links to SERVER1, so I would appreciate any ideas how to fix this.
(Oh, and SERVER2 is unreliable at the moment - which was reason for SERVER3)

1 Answer 1

0

It seems, that (one) problem was with Kerberos SPN.
The solution was found from page: https://support.microsoft.com/en-us/kb/2706695

Elevated command, which seemed to fix the \\SERVER1 -shares was:
setspn -A cifs/SERVER1 SERVER3

Remote Desktop still does not work, but that is not really an issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .