I had a dead PDC and another not so synced domain controller for my domain. using comments here link now the so called secondary domain controller has seized domain controls and I can verify it from dsa.msc that it is a domain controller.

I set up another domain controller (win2003SRV) and about to promote an AD on it as a domain controller for my domain. When I try to join the new domain controller to the domain I face DNS problem. here is some more detail

DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain DOMNAME.A.B: The query was for the SRV record for _ldap._tcp.dc._msdcs.DOMNAME.A.B The following domain controllers were identified by the query: update.DOMNAME.A.B Common causes of this error include: - Host (A) records that map the name of the domain controller to its IP addresses are missing or contain incorrect addresses. - Domain controllers registered in DNS are not connected to the network or are not running. For information about correcting this problem, click Help.

it is worth noting that update.DOMNAME.A.B is the current domain controller to which I'd like to add another controller named PDC.DOMNAME.A.B

Ip address of update.DOMNAME.A.B is and for pdc.DOMNAME.A.B is

querying DNS on both machine return correct results.

Any idea?


The error is telling you that there's still DNS entries for your dead DC in the domain. Specifically, there's probably still an A record for DOMNAME.A.B that points to the IP of the dead DC.

You need to step through the process for completely removing the dead DC from your domain (which is more involved that just turning it off). See here: http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Once you've done that you can probably get through without the error.

Note that your replacement DC should have a different name AND IP to the failed DC, ideally.

  • Chris, thanks a lot for your reply. followed your advise and during the ntdsutil, the only server was update.domainname.A.B (remember the old PDC is completely down), hence, it couldn't delete its own data in the last step ("Remove selected server" command). I seized all the roles to the update.DOMNAME.A.B and trasfered every role to it. in local login, I see this server as the only DC for my domain but I still have the previous joining problem. BTW, I searched for reverse DNS of the old pdc and it didn't return any result. – Hosm Feb 25 '11 at 8:22
  • BTW, dcdiag utility toled me that the replication had an error and it is not complete. BUT I'm sure that user, machine credentials have been replicated and this is sufficient info for me. I don't need anything more. – Hosm Feb 25 '11 at 8:28
  • @Hosm: It's not a metadata problem at this point it's a DNS problem. Did you remove the DNS entries for the failed DC from your AD DNS zone? – joeqwerty Feb 25 '11 at 11:16
  • I removed everything pointing to the old server and made sure of that using reverse dns lookup. using ntdsutil.exe I could only find the second server as the domain controller, I seized and transfered all the roles to it and cleaned up all caches but no use. dcdiag reported that replication had been incomplete. I gave up retrieving data from the old domain and promoted a new one. – Hosm Feb 25 '11 at 16:16

Make sure you cleaned up your DNS, per joequerty's comment. Then run dcdiag with the full DNS tests to make sure nothing is amiss.

  • dcdiag reported that replication had been incomplete. I gave up retrieving data from the old domain and promoted a new one. – Hosm Feb 25 '11 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.