1

Good Afternoon,

We two virtual DC and one local physical read only DC. When we moved our data center offsite with a warm backup site we p to v our DC’s and DC1 was the master schema. While troubleshooting another issue we found an issue with our Main DC (DC1). When I was attempting to modify a group policy it gave me an error and could not find our domain.

When I check the Operational Master is stated ERROR and list (DC1). When I run a netdom querry fismo the result points to (DC2). On DC2, the Operation Master is DC2.

When I ran a dcdiag on dc1:

 Directory Server Diagnosis

Performing initial setup: Trying to find home server... Home Server = AOBVADC001 * Identified AD Forest. Done gathering initial info.

Doing initial required tests

Testing server: Col-DC\AOBVADC001 Starting test: Connectivity ......................... AOBVADC001 passed test Connectivity

Doing primary tests

Testing server: Col-DC\AOBVADC001 Starting test: Advertising Warning: AOBVADC001 is not advertising as a time server. ......................... AOBVADC001 failed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.

Running enterprise tests on : swaco.org Starting test: LocatorCheck Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355 A Primary Domain Controller could not be located. The server holding the PDC role is down. Warning: DcGetDcName(TIME_SERVER) call failed, error 1355 A Time Server could not be located. The server holding the PDC role is down. Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355 A Good Time Server could not be located. ......................... swaco.org failed test LocatorCheck Starting test: Intersite ......................... swaco.org passed test Intersite

On the second DC the dcdaig

Directory Server Diagnosis

Performing initial setup: Trying to find home server... Home Server = AOBVADC002 * Identified AD Forest. Done gathering initial info.

Doing initial required tests

Testing server: Col-DC\AOBVADC002 Starting test: Connectivity ......................... AOBVADC002 passed test Connectivity

Doing primary tests

Testing server: Col-DC\AOBVADC002 Starting test: Advertising ......................... AOBVADC002 passed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. Starting test: SystemLog Contact the administrator to install the driver before you log in again. A warning event occurred. EventID: 0x000016AF Time Generated: 11/25/2014 08:15:40 Event String: During the past 4.24 hours there have been 145 connections to this D omain Controller from client machines whose IP addresses don't map to any of the existing sites in the enterprise. Those clients, therefore, have undefined site s and may connect to any Domain Controller including those that are in far dista nt locations from the clients. A client's site is determined by the mapping of i ts subnet to one of the existing sites. To move the above clients to one of the sites, please consider creating subnet object(s) covering the above IP addresses with mapping to one of the existing sites. The names and IP addresses of the c lients in question have been logged on this computer in the following log file ' %SystemRoot%\debug\netlogon.log' and, potentially, in the log file '%SystemRoot% \debug\netlogon.bak' created if the former log becomes full. The log(s) may cont ain additional unrelated debugging information. To filter out the needed informa tion, please search for lines which contain text 'NO_CLIENT_SITE:'. The first wo rd after this string is the client name and the second word is the client IP add ress. The maximum size of the log(s) is controlled by the following registry DWO RD value 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Paramete rs\LogFileMaxSize'; the default is 20000000 bytes. The current maximum size is 20000000 bytes. To set a different maximum size, create the above registry valu e and set the desired maximum size in bytes. ......................... AOBVADC002 failed test SystemLog

I believe I know what I need to do with DC1, but have not done this since College.

I believe I will have dcpromo down DC1, then dcpromo back up. If I want I can transfer FSMO back to DC1, but really I don't care.

Any thoughts on my issue?

  • 1
    Shameless marketing: You're well within driving distance for me. >smile< I'd be more than happy to negotiate the terms of an on-site visit. – Evan Anderson Nov 25 '14 at 21:55
  • 1
    @EvanAnderson unless you know this man already, I'm scared to think how you deduced his location with the information given. Are you secretly running anon without our knowledge? – TheCleaner Nov 25 '14 at 22:02
  • How did you p2v DC1? – Greg Askew Nov 26 '14 at 5:17
  • @Greg Askew Our previous System Administration did the migration to the two data center. There are a ton of products like VMware that can do this vmware.com/products/converter. – James O'Keeffe Nov 26 '14 at 13:17
  • 1
    Were the resulting VMs from the P2V run in an isolated environment, or were they able to communicate to the existing network? (I feel like, if it were a disaster recovery exercise, they would be run in an isolated environment. That would be the norm, at least.) – Evan Anderson Nov 26 '14 at 14:10
3

It looks to me like you've got a DNS problem. I don't think there's anything FSMO-related really happening. Start by making sure that the AOBVADC001 machine is getting good DNS resolution for the domain.

  • I not seeing the DNS issue because I can ping from the main DC AOBVADC001 to outside and inside the organization. NSLOOKKUP are resolving as well for inside and outside. – James O'Keeffe Nov 26 '14 at 14:03
  • It still sounds like a DNS problem to me. What does the output for nslookup -type=SRV _ldap._tcp.pdc._msdcs.swaco.org look like on the AOBVADC001 machine? What DNS servers are specified on that machine? – Evan Anderson Nov 26 '14 at 14:09
  • You correct. Non-existent domain. I ran that on DC2 and same the results. The DNS server are the ip address 10.101.9.30 (DC1) and 10.101.9.40 (DC2). – James O'Keeffe Nov 26 '14 at 14:31
  • Thx for you help. I now gotta figure out how this happen. I was not thinking DNS when ping, tracert, and the basic nslookup commands did not error out. – James O'Keeffe Nov 26 '14 at 14:44
  • @JamesO'Keeffe - You may well have been getting broadcast NetBIOS name resolution when you tried those commands. – Evan Anderson Nov 26 '14 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.