Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having issues migrating my current Active Directory objects to my new Domain using ADMT. I have gone to a lot of resources to resolve this issue and they seem to point to DNS. Is there a tool or command or something that can validate my DNS configuration is functioning correctly? The DNS server is a Win server 2000 and is the primary Domain Controller.

share|improve this question
Are you migrating within the same forest, or to a different forest? – Izzy Dec 9 '09 at 23:46
what error are you getting when using ADMT? You are migrating from Windows 2000 to which version? Cheers – Nasa Dec 10 '09 at 10:40
migrating to 2k8 r2. – TechGuyTJ Dec 10 '09 at 15:01
this would be an interforest migration. – TechGuyTJ Dec 10 '09 at 15:05
thanks, what error are you getting? – Nasa Dec 11 '09 at 8:56
up vote 1 down vote accepted

Men & Mice have a tool called DNS Expert that I've used in the past and was impressed by.

It's whole function is to hep you identify problems with your DNS infrastructure, and they have a specific module for AD DNS too.

The product page is here

share|improve this answer

Can't say that I have a huge amount of experience with W2K AD domains, but if this was W2K3 then my first port of call would be the netdiag command. This will do some basic tests of your configuration including DNS.

I highly recommend using the netdiag /q command which reduced the level of output to only warnings and failures.

share|improve this answer
running the netdiag /q gives the following after the interface results and os Patches <code>Global results: [WARNING] You don't have a single interface with the <00> 'WorkStation Servi ce', <03> 'Messenger Service', <20> 'WINS' names defined. DNS test . . . . . . . . . . . . . : Passed PASS - All the DNS entries for DC are registered on DNS server '' and other DCs also have some of the names registered. IP Security test . . . . . . . . . : Passed </code> – TechGuyTJ Dec 10 '09 at 14:53

Since DNS is platform-independent at the protocol level, I wonder if you have a Unix/Linux box somewhere you can run commands on?

You're after "doc", which does DNS audits by wandering around the zone, looking at records. It's somewhat old, and it won't tell you it's leaving a log in log.<zone>, but it works. It assumes that you have dig, from bind9, which you probably will, on any modern Unix. ftp site

Another diagnosis tool is dnswalk, which is a sourceforge hosted project; since I can only post one hyperlink, I'll let you find that one.

share|improve this answer

Does your new domain run WIndows Server 2008 R2? In that case you can use the built-in AD Best Practices Analyzer tool (find it under the AD role in Server Manager) to report on non-standard configuration.

Otherwise, you should go through ALL your DNS configuration, and try to draw it up on a piece of paper. Try to do nslookup's both ways, and put down your results on paper, the problem should materialize itself.. :) (some variant of "reverse-sudoku-solving".. :))

When you give up, you can call me and I will solve the issue for you, at $190/hour.. :)

share|improve this answer
First, the OP said he's working with W2K, the W2K8 AD BPA is not going to help him in the W2K source domain. Second, it's obvious that if he was able to go through DNS to find the problem on his own he wouldn't be posting his question here. – joeqwerty Dec 9 '09 at 22:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.