0

I'm having some real issues getting my users logged on to my domain correctly. I've put a new switch in today and powered off my PDC beforehand; this is the first time it's been booted since we seized some roles to it a couple of weeks ago. We had three DCs - DC1, DC2, and DC3. DC1 held the RID, PDC and Infrastructure Operations masters and we switched these to DC2 (it is also the primary DNS server for the domain). That domain controller became unusable and we switched it off and proceeded to seize its roles and perform a metadata cleanup (which we thought we had done successfully). Today when I've rebooted my workstation after moving DC2, I was unable to access my Qnap drive, and I can't remap the drive either - error is "..organization's security policies block unauthenticated guest access". This lead me to think I wasn't being logged on by the DC, and checking event viewer I have NETLOGON (5719) errors- "This computer was not able to set up a secure session with a domain controller in domain mydomain...We can't sign you in with this credential because your domain isn't available"

Running a 'dcdiag' command on DC2 gives me a whole heap of warnings and errors that I think have appeared since the reboot, this one sticks out like a sore thumb!

Name resolution for the name _ldap._tcp.dc._msdcs.mydomain.co.uk. timed out after none of the configured DNS servers responded.

I thought it was perhaps related to the removal of DC1, so I went back to ntdsutil > metadata cleanup and ran the command 'remove selected server dc1', but this gave me the following error:

Unable to determine the domain hosted by the Active Directory Domain Controller (5). Please use the connection menu to specify it.

If I list servers in site in ntdstuil I can see my domain and DC2 and DC3, DC1 does not appear so I can't go any further with metadata cleanup.

Has anyone any ideas of what I can try next? Many thanks

Improve this question

1 Answer 1

Reset to default
0

Have you gone into the DNS console and checked that you've got actual SRV entries in _ldap._tcp.dc._msdcs.mydomain.co.uk?

Verify with nslookup from each DC for your LDAP SRVs: nslookup -type=SRV _ldap._tcp.dc._msdcs.mydomain.co.uk

If the records are present, but not resolving from one or other DC, what IPs are configured in the DNS client settings on your DCs' network adapters? Perhaps they were pointed to the decommissioned DC. I recommend the following for DNS client config on DCs (ensure your remote DC responds to queries via nslookup from the DC you're configuring, of course):

[Remote DC IP]
[Local DC IP]
127.0.0.1

If the DNS config on the adapter looks ok, but the SRVs are missing, try restarting the Netlogon service.

If the SRVs don't get registered within a few minutes (do nslookup again or make sure you refresh the DNS console), are your DCs in Azure? Are PTR records registered for each DC?

The SYSTEM log System event log will contain entries from the NETLOGON source if the service has an issue registering the SRV and related DNS records. It'll have DNS Client error events if A/PTR record registration is failing.

Finally, to troubleshoot unsuccessful SRV registrations (if you're getting those in the System log), you can enable Netlogon debug logging

  • Run Nltest /DBFlag:2080FFFF to enable debug logging for the netlogon service
  • Restart NETLOGON
  • Check the C:\Windows\debug\netlogon.log file for errors
  • Run Nltest /DBFlag:0x0 to disable debug logging when done and restart the service

If they're Azure-hosted DCs, there are other DNS client configs that might be required.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .