I'm helping a (devops) client move their technology stack (VMware, Windows AD, Ubuntu Linux) from their old co-location facility to a new environment. Rather than move the hardware and systems outright, I've built a parallel environment in the new data center...
One thing I need to establish in the new site is Active Directory. There's an existing AD comprised of a single domain controller at their old site (2008 R2). While the new facility has a Cisco ASA firewall, their old site does not. Their current systems are exposed to the web with no firewalling; including the domain controller! A site-to-site VPN tunnel does not seem to be an option.
I'd like to build another domain controller at the new site; basically joining a domain over the internet. This is necessary for the VMware Virtual Center, DNS and a few other things I need to proceed with the new environment. I built a new Windows 2008 R2 server and took the following steps:
- Successfully joined it to the domain (over the internet, limiting the new site to the old site's source addresses).
- Added a new AD site for the old and new subnets (they're different).
- Verified what I could of DNS.
- Installed the AD binaries.
- Ran
dcpromo
under a domain Administrator account.
The dcpromo
step fails a few minutes into the process with:
The operation failed because:
Active Directory Domain Services could not create the NTDS Settings object for this Active Directory Domain Controller CN=NTDS Settings,CN=DC2,CN=Servers,CN=ServerCentral,CN=Sites,CN=Configuration,DC=hire-a-sysadmin,DC=com on the remote AD DC PEDC.hire-a-sysadmin.com. Ensure the provided network credentials have sufficient permissions.
"The RPC server is unavailable."
I did notice that the old domain controller I'm trying to replicate from is multi-homed. Since the client does not have a firewall at their old co-location site, their servers all seem to have public IPs and default gateways that point to the web, and a second interface slated for internal communication on a 10.10.10.0/24 subnet. I could see that being an issue, as it just seems like a bad practice.
How can I complete the dcpromo
process on this new domain controller?
Edit - I ran Port Query, as recommended below. The only port with a non-zero status was port 42 - TCP port 42 (nameserver service): NOT LISTENING
. I believe that's only for WINS resolution.