This is a windows 2000 domain issue.

I had an old win2000 PDC that was beginning to fail. So, trying to be pre-emptive, I installed a new BDC, then "demoted" the old PDC and took it off the network.

Now it appears that no member server can "find" the domain anymore. No logins work (for services or a RDP or anything).

What I've tried (based on googling):

  • Verified sysvol is shared on all servers.
  • Used nslookup to verify that DC's are being found.
  • netdiag /fix
  • meta data cleanup routines.
  • verified no firewall issues (port 389 etc)
  • seizing all roles to new PDC (I did that as part of the original promotion).
  • LMHOST file and Netbios settings.

At the moment it seems like I can get the DC's returned but cannot contact them. I'm at a loss.

My latest attempt was to remove a member server from the domain and try to "re-add" it. When I do that I get this message:

The query was for the SRV record for _ldap._tcp.dc._msdcs.cfwebtools.com

The following domain controllers were identified by the query:

However no domain controllers could be contacted.

It then goes on to ask if I've checked my A record and made sure they are running.

Is there a way to force this domain to be seen?

I also shared sysvol (or double checked it) and restarted the dfsr service.

More information. I got looking at sysvol and found it was not shared on 2 of these servers. Only one of them (db-dev1) has a "good" or at least "populated" sys vol store. So I tried doing a "d2" recovery of my PDC against that good sysvol. But it never synchs - or at least it does not seem to synch.

I'm guessing if I could get sysvol and netlogin to kick in and replicate that would fix my issue. I think these DC's aren't responding because they are waiting for replication which is broken somehow.

Would taking down all the DC's except for db-dev1 fix the issue - at least temporarily? I know I can't just copy the sysvol stuff over to the other 2 can I?

  • Which server is hosting the AD DNS zone? Is it the new server? If so, did the zone replicate completely to the new server? Are the clients "pointing" to the new server for DNS? – joeqwerty Jun 21 '12 at 17:43
  • The AD DNS zone is hosted on one of the older BDCs "db-dev1" and I did not make any changes to that. All clients are pointing to the the old db-dev1 ( as their primary DNS server... although the new PDC ( is the secondary and it's set up to receive transfers from the primary. Does that make sense? – Mark A Kruger Jun 21 '12 at 17:49
  • It IS finding them though - it lists all three of my DC's. And I know they can be contacted - I'm able to ping them fine. It's like LDAP is failing or something. – Mark A Kruger Jun 21 '12 at 17:54
  • 1
    Mark: I hear what you're saying but the only way to know for sure what communication is occurring and to/from which DC's and DNS servers is to run a sniffer. – joeqwerty Jun 21 '12 at 20:29
  • 2
    Netmon takes 2 minutes to install. Why spend more time justifying not using it when you can know for sure exactly where the problem is? – MDMarra Jun 21 '12 at 20:51

It turns out that the sysvol shares were missing on all these DCs and the sysvol folder was missing on the new PDC (how did that happen?).

I shared the folders and then set the one that was the most recent to D4, then the others to D2 for a restore - making the one that looked the best authoritative :) It worked and we are back in business!

  • There are no PDCs or BDCs unless you're using an NT4 domain – MDMarra Jun 21 '12 at 21:37
  • Ok then how about "the new server on which I had seized the PDC Emulator role". Does that pass your test for semantics? – Mark A Kruger Jun 22 '12 at 10:59
  • It's not semantics. There is a thing called a PDC. You don't have that thing. If you did, it would make the answer very different. This answer also wouldn't apply to anyone running a real PDC. – MDMarra Jun 22 '12 at 11:02
  • Would you except pedantic or picayune? There is a PDC role to be certain. – Mark A Kruger Jun 22 '12 at 11:04
  • There is a PDC emulator role. This functions very differently than an NT4 PDC. It's not being pedantic. I'd challenge you to hop into chat and post a link to this question and ask any if the dozen SAs in there whether they think I'm being pedantic or not :) – MDMarra Jun 22 '12 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.