2

I'm helping a (devops) client move their technology stack (VMware, Windows AD, Ubuntu Linux) from their old co-location facility to a new environment. Rather than move the hardware and systems outright, I've built a parallel environment in the new data center...

One thing I need to establish in the new site is Active Directory. There's an existing AD comprised of a single domain controller at their old site (2008 R2). While the new facility has a Cisco ASA firewall, their old site does not. Their current systems are exposed to the web with no firewalling; including the domain controller! A site-to-site VPN tunnel does not seem to be an option.

I'd like to build another domain controller at the new site; basically joining a domain over the internet. This is necessary for the VMware Virtual Center, DNS and a few other things I need to proceed with the new environment. I built a new Windows 2008 R2 server and took the following steps:

  • Successfully joined it to the domain (over the internet, limiting the new site to the old site's source addresses).
  • Added a new AD site for the old and new subnets (they're different).
  • Verified what I could of DNS.
  • Installed the AD binaries.
  • Ran dcpromo under a domain Administrator account.

The dcpromo step fails a few minutes into the process with:

The operation failed because:

Active Directory Domain Services could not create the NTDS Settings object for this Active Directory Domain Controller CN=NTDS Settings,CN=DC2,CN=Servers,CN=ServerCentral,CN=Sites,CN=Configuration,DC=hire-a-sysadmin,DC=com on the remote AD DC PEDC.hire-a-sysadmin.com. Ensure the provided network credentials have sufficient permissions.

"The RPC server is unavailable."

I did notice that the old domain controller I'm trying to replicate from is multi-homed. Since the client does not have a firewall at their old co-location site, their servers all seem to have public IPs and default gateways that point to the web, and a second interface slated for internal communication on a 10.10.10.0/24 subnet. I could see that being an issue, as it just seems like a bad practice.

How can I complete the dcpromo process on this new domain controller?

Edit - I ran Port Query, as recommended below. The only port with a non-zero status was port 42 - TCP port 42 (nameserver service): NOT LISTENING. I believe that's only for WINS resolution.

|improve this question
  • can you post the asa congfig? – user1008764 May 6 '13 at 12:17
  • @user1008764 No. What are you suggesting? – ewwhite May 6 '13 at 12:20
  • I'd go with the firewall blocking an important port. Run through the steps here, it may provide clues: blogs.technet.com/b/abizerh/archive/2009/06/11/… – James Hebden May 6 '13 at 12:28
  • @JamesHebden All of IP is allowed on the Cisco from the source DC to the new DC. – ewwhite May 6 '13 at 12:29
  • Is there any NAT involved, or does the new DC have a public IP? – James Hebden May 6 '13 at 12:44
4

As janky as this is, I ended up establishing a Cisco client VPN from the old DC to the new datacenter's ASA firewall. This allowed replication and the dcpromo to complete.

|improve this answer
  • Oh, @MDMarra You made the problem worse! – ewwhite May 7 '13 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.