I have a windows server 2003 as a PDC ("server 1"). I am attempting to take it offline once I get several issues cleared up. I have two other windows server 2008 servers that have been promoted as DC's ("server 2" and "server 3").

When I run dcdiag on any of the servers I get failed connectivity to "server 2" and "server 3"

the host guid._msdcs.domain could not be resolved to 
an ip address...although the guid dns name couldnt 
be resolved, the server name resolved to the ip address. 
Check that the ip address is registered correctly with 
the dns server. "server 2" failed test connectivity. 

While there could be several issues preventing replication, I noticed one thing on the pdc ("server 1"). In DNS under the msdcs folder there is an "" folder (along with "dc", "domains", "gc" and "pdc". The "_" folder references "server 2" with the guid thats referenced in the dcdiag connectivity failure.

What does the "_" folder represent? Is that where my problems begin? The pdc has the wrong guid for "Server 2". I need to be able to replicate to "server 2" and "server 3"


Answers to your questions re: the DNS records are certainly something you should know about (and I'd encourage you to look at something like this article from Microsoft for some background on what they do), but I think you're probably interested in a more practical answer here.

What are the "server 2" and "server 3" computers using for DNS servers? I'm guessing that your "server 1" computer is a DNS server (since it's your existing Domain Controller), but it's unclear if you've configured "server 2" and "server 3" to be DNS servers.

I'd configure both "server 2" and "server 3" to be DNS servers, with "server 1" specified as their sole DNS server initially. Once Active Directory replication is working as-expected I'd reconfigure "server 2" to use "server 3" as its primary DNS server and itself as its secondary, and the converse on "server 3". Then you can go about transferring the Floating/Flexible Single-Master Operations (FSMO) roles from the "server 1" computer to either of these new machines, and demote "server 1" to a member server for removal from the network.

  • Server 2 will be replacing server 1 (and server 3 will be the backup dc). Server 2 and 3 use server 1 for dns. Server 2 and 3 are configured to be DNS servers. My concern is that what I think is the extra "_" folder under _msdcs that has a cname with a wrong server guid. – IMAbev Oct 18 '12 at 15:35
  • Obligatory - "I inherited this"...There are numerous problems. I was hoping this issue was the first one I could eliminate that would help gain the most ground. I also have cname records or servers that no longer exist in our domain. – IMAbev Oct 18 '12 at 15:42
  • 1
    You could delete the entire "_msdcs" zone and allow AD to recreate it if you wanted to be sure that it contained all valid data. Each of your DCs will re-register with the DNS server when their "Netlogon" service is restarted. I don't recommend doing this when you've got clients hitting AD, but if you've got some off-hours you certainly could try it. – Evan Anderson Oct 18 '12 at 17:27
  • Can I do this with the PDC as well? – IMAbev Oct 18 '12 at 18:07
  • There are no "PDC" computers in AD. If you opt to delete the _msdcs zone you would do it on the "server 1" machine, since you're having replication problems, and that would eventually replicate to the other two servers once all your DNS problems are cleared up. – Evan Anderson Oct 18 '12 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.