We have two Windows 2003 server domain controllers in our work network.

The first - dc01 - is the main domain controller and works as expected.

The second - dc02 (surprisingly) - is currently serving as an Exchange 2003 server, and also as a backup domain controller.

There are also 3 other Windows 2003 servers on the network and a number of clients.

dc01 can browse everything.

Other servers can browse everything.

Clients can browse everything.

However, dc02 can not browse (via network shares in Explorer for instance) other computers besides dc01.

If I go into Active Directory Users and Computers on dc01, I can see Users and Computers as expected.

If I go into the same place on dc02, I can see all the domain users, but not the computers...!?

It would seem poor dc02 is not entirely happy in the domain, but I don't know what to look for. Does anyone have any ideas around figuring out what is going on here?



Firstly, there are no BDCs in an AD network.

Anyway, first port of call for any such issue should always be your TCP/IP configuration on the DCs NIC, and your DNS server settings. Double-check these, ensure that they are valid for your domain, correct them if not, then establish whether or not things are still broken.

  • Thanks for your reply! I just got my terminology screwed up, what I meant is that dc02 is an Exchange server first but also a domain controller, while dc01 is only a domain controller. :) I checked the IP settings. DNS resolution is not an issue, I can ping these machines both by IP addresses and host names (fully qualified or not). And other machines can browse dc02, just not the other way around. I've also used wireshark to see if I can find something, but decoding the netbios traffic is hard. ;) – Rune Jacobsen Sep 24 '09 at 11:59
  • Can dc02 resolve itself? In other words, from a cmd on dc02, do nslookup dc02 and ensure that it can resolve it's own hostname to the correct IP address. – Maximus Minimus Sep 24 '09 at 12:37
  • Yep, if I do an nslookup it can find itself, at the correct local IP. – Rune Jacobsen Sep 24 '09 at 12:58

Agree with mh ... check that dc02 can see dc01:

ping dc01.whatever.com
nslookup -type=srv _ldap._tcp.whatever.com

DNS zone for whatever.com look ok? All underscored zone records there?


Any firewalling between them, or installed on them? You could use PortQry(UI) to check that dc02 can see dc01's ports; LDAP, Kerberos, etc:

o   Global Catalog Server TCP 3268
o   LDAP Server TCP 389
o   LDAP Server UDP 389
o   RPC TCP 135
o   Kerberos TCP 88
o   Kerberos UDP 88
o   RPC randomly allocated temporary high TCP ports TCP 1024 – 65535
o   kpasswd TCP 464
o   kpasswd UDP 464
o   NetBIOS Datagram Service UDP 138
o   NetBIOS Name Resolution UDP 137
o   NetBIOS Session Service TCP 139
o   SMB TCP 445

Event viewer saying anything?

  • Hi - pinging is no problem; Works on ip, hostname, and fully qualified hostname (i.e., dc01, and dc01.mydomain.local). The nslookup gave a reply showing both servers (dc01 and dc02). The same query worked fine for _msdcs.mydomain.local too, but returned errors for the other three (_sites, _tcp and _udp). No firewall between or on them - same switch, no VLAN. PortQry is able to talk to most of the ports you listen, but can I test random, temp ports with it when nothing is listening? Does dc02 need to be an FTP server as well? That might be an oversight. – Rune Jacobsen Sep 24 '09 at 12:30
  • Nope, no FTP required. – Maximus Minimus Sep 24 '09 at 12:38
  • Argh, I am brain damaged today - I meant DNS, not FTP. :( – Rune Jacobsen Sep 24 '09 at 12:58
  • Right ... can't test random ports ... lol ... my bad! Check the whole DNS zone; there should be records under all underscored sections for both DC's. And event viewer? – James Risto Sep 24 '09 at 14:22

Ok, sorry for the slow update here, but I finally figured it out by following the clues and abusing the server in every way possible.

The following helped me get it to work:

Microsoft KB article

So I'll leave this here in case someone gets the same obscure problem in the future!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.