Server 2012 Can't Promote Domain Controller - Can't join domain

Question

Running in to an issue at a new location with promoting a new domain controller. We will call the new server "newserv".

Error is - "An Active Directory domain controller for the domain "mydomain" could not be contacted." -

newserv can ping domain controllers by FQDN (ie DC1.mydomain)
newserv cannot ping domain controller without .mydomain
NSLOOKUP on newserv shows default server as PDC.mydomain
NSLOOKUP set type=all --> _ldap.tcp.dc._msdcs.mydomain shows all SRV service locations, with correct ip addresses.
newserv has static ip, primary and secondary DNS pointing to DC1.mydomain & DC2.mydomain
If I just try to join the domain, the error details state the SRV record query shows all of my domain controllers, however they could not be contacted.

Some things i've tried, other notes;

I've tried setting primary DNS to point to itself.
I've tried adding DNS suffix "mydomain" under advanced DNS settings.
newserv can join different domain no issue.
My domain does not have a suffix. It is just "mydomain" - I've run in to issues with this with joining MAC OS to the domain in the past.
Server is a Virtual Machine running in HyperV which is joined to a different domain.

I'm imagining this might be some kind of DNS issue, but I don't know where to start in addressing it.

Any help greatly appreciated.

mydomain is a single label domain. I'm fairly certain that in Windows Server 2008 R2 and forward that the creation of an SLD is blocked. You must have therefore created this domain with Windows Server 2008 or prior? Is this a production domain? My first inclination is to suggest that you wipe it out and start from scratch, but that may not be possible if this is a production environment. — joeqwerty, Aug 9, 2016 at 15:05
This is a production domain. The domain was created around 2003, but the domain functional level is operating at Windows Server 2012. — notmrb, Aug 9, 2016 at 15:27

Greg Askew · Accepted Answer · 2016-08-09 14:23:12Z

0

That usually means a required port such as UDP/389 are blocked, probably due to a firewall. You can confirm by testing with PortQueryUI:

PortQryUI - User Interface for the PortQry Command Line Port Scanner
https://www.microsoft.com/en-us/download/details.aspx?id=24009

If any of the required ports are blocked, they will show as "filtered".

answered Aug 9, 2016 at 14:23

Greg Askew

36.8k6 gold badges55 silver badges82 bronze badges

Alright, so I ran the PortQry utility on about three machines and i get a runtime error on all three machines, however the query result completes and I can save out a report. I'm going to post the results in a moment, accidentally hit "enter".
– notmrb
Aug 9, 2016 at 15:17
From newserv to DC1.mydomain these are what shows as "filtered"; UDP port 389 (unknown service): LISTENING or FILTERED UDP port 88 (kerberos service): LISTENING or FILTERED UDP port 138 (netbios-dgm service): LISTENING or FILTERED TCP port 42 (nameserver service): NOT LISTENING LDAP Query Response looks good. I see the DC name, ldapservicename, etc. Sorry, looks like formatting is different in comments.
– notmrb
Aug 9, 2016 at 15:32

Add a comment |

Simon MC. Cheng · Accepted Answer · 2016-08-09 16:11:24Z

Windows domain promotion rely heavily on the DNS service, if I were you, I will check if the following configurations are ready:

No windows firewall enabled in between the domain controller
Perform simple network check, such as ping between existing domain controller and new server from both directions.
Then, setup DNS A record for your new server newserv.mydomain
Also, setup DNS PTR record for your new server (if your server IP is 192.168.1.1, you properly have a PTR record as 1.1.168.192.in-addr.arpa
Perform DNS lookup check from your existing domain controller to new server with:

nslookup newserv.mydomain.com

From the new server, perform the similar testing with:

nslookup {domain controller's DNS}

Make sure you have used the user account with Domain Admin / Enterprise Admin of the domain you would like to join. Since your Hyper-V VM is running in different domain, you will have to specify the domain name when inputting your user name:

e.g. mydomain\administrator or [email protected]

Hope it can give you some ideas on how to join the domain.

Thanks for the reply. I've verified steps one thru six - all good. The only thing to mention is if i run nslookup pdc from newserv, it shows dc.mydomain for server / address, but the second set states pdc.mydomain can't find pdc: Server failed. — notmrb, Aug 9, 2016 at 17:45

2 Answers 2