Active Directory: trouble adding new DC

Question

I have a domain with 3 DCs. One is starting to fail so I brought up a new one. All are running Win 2003.

Problem: there appear to be replication issues between the 4 machines but I can't figure out what's causing this. All are registered with the DNS as identically as I can make them.

How do I know there is a problem? Nagios is telling me that the other 3 DCs are having KCCEvent errors and the new machine is reporting "failed connectivity" errors.

Doing dcdiag on the new machine reports: the host could not be resolved to an IP address. This seems crazy as I log into it using the DNS name. I can ping it from the other three machines using this DNS name as well.

repadmin /showreps from the new machine says its seeing the other 3 machines. Doing the same from one of the older machines doesn't show the new machine.

I've tried netdiag /repair numerous times. No luck.

There are no firewalls running on any of the machines.

If I look at Domain info via MMC (on the new machine) it appears that all the information is current. Users, computers, DCs.. its all there.

Im puzzled as to what step(s) I've missed in adding this new machine. Suggestions?

EDIT: dcdiag from non-working:

C:\Documents and Settings\Administrator.BME>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\YELLOW
      Starting test: Connectivity
         The host 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu could
 not be resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         Although the Guid DNS name
         (312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu) couldn't be
         resolved, the server name (yellow.server.edu) resolved to the IP
         address (10.127.24.79) and was pingable.  Check that the IP address is
         registered correctly with the DNS server.
         ......................... YELLOW failed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\YELLOW
      Skipping all tests, because server YELLOW is
      not responding to directory service requests

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : bme
      Starting test: CrossRefValidation
         ......................... bme passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... bme passed test CheckSDRefDom

   Running enterprise tests on : server.edu
      Starting test: Intersite
         ......................... server.edu passed test Intersite
      Starting test: FsmoCheck
         ......................... server.edu passed test FsmoCheck


dcdiag from working:
P:\>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\AD1
      Starting test: Connectivity
         ......................... AD1 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\AD1
      Starting test: Replications
         ......................... AD1 passed test Replications
      Starting test: NCSecDesc
         ......................... AD1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... AD1 passed test NetLogons
      Starting test: Advertising
         ......................... AD1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... AD1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... AD1 passed test RidManager
      Starting test: MachineAccount
         ......................... AD1 passed test MachineAccount
      Starting test: Services
         ......................... AD1 passed test Services
      Starting test: ObjectsReplicated
         ......................... AD1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... AD1 passed test frssysvol
      Starting test: frsevent
         ......................... AD1 passed test frsevent
      Starting test: kccevent
         ......................... AD1 passed test kccevent
      Starting test: systemlog
         ......................... AD1 passed test systemlog
      Starting test: VerifyReferences
         ......................... AD1 passed test VerifyReferences

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : bme
      Starting test: CrossRefValidation
         ......................... bme passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... bme passed test CheckSDRefDom

   Running enterprise tests on : server.edu
      Starting test: Intersite
         ......................... server.edu passed test Intersite
      Starting test: FsmoCheck
         ......................... server.edu passed test FsmoCheck

P:\>

Answer 1

Check that the DNS settings on the new DC; ensure it is querying a local DNS server and can resolve the names of the other servers. That you can resolve its name doesn't imply that it can resolve the names of the other DCs, and chances are this is the issue.

It's possible that it can resolve the names of the other servers using NBNS or WINS but not DNS, or the other way around.

Edit: By the output you've added above, it's clear that the issue is in DNS. Check the logs on your DNS servers for failed updates and such, and ensure the new server has permission to make DNS changes (though as a DC it should be able to do this). The problem isn't that the server's name is not resolving, but that its SRV record isn't working.

You could use dig (ships with BIND, the unix name daemon, but there is a windows version floating around somewhere) to check what you get for IN SRV and IN A 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9._msdcs.server.edu on each of your DNS servers.

Answer 2

Do not bother with dig or nslookup. Just go to the DNS administration tool and look up what records the DNS servers have. Do the following:

• Login using RDP to one of your DCs
• Start the DNS administration tool
• Click on the DC in the list
• Click on "Forward Lookup Zones"
• Click on "_msdcs.(your domain)"

Look at the entries on the right side. You should have one NS record and one CNAME record for each of your DCs.

Verify there is a CNAME record where the name is 312ce6ea-7909-4e15-aff6-45c3d1d9a0d9 and the data is the FQDN of the DC.

From what you are saying, the record is missing from the problematic DC. Confirm the _msdcs.(your domain) zone is set for AD integration in the Properties window.