1

Long story short, I had a DC running perfectly but it was on Server 2012 R2 Standard Evaluation. In order to change from Eval. to Full, I had to create a 2nd DC server, transfer Operational Masters, demote the original DC server, remove ADDS, convert the license to Full, activate, reinstall ADDS, Promote Server and transfer FSMO's back.

Everything has worked without issue up to re-promoting the DC server...

When I try I get the error

An Active Directory domain controller for the domain "contoso" could not be contacted. Ensure you have the correct DNS domain name.

I'm using the correct credentials, domain name etc. yet the same procedure I followed to add the 2nd DC server earlier on is now not working for adding the original DC back. I've even gone as far as to remove the DNS roles from the server and point the Primary DNS to the temporary DC server, but this hasn't helped.

What do I do?

7
  • 2
    When you added the 2nd DC you installed the DNS role and allowed this to replicate? Can you ping the Domain or the FQDN of the 2nd temp DC? If not check your static DNS settings are definitely correct and check that the 2nd DC DNS properties are listening on the correct interface. – CharlesH Sep 15 '15 at 10:46
  • I added the DNS role, but didn't do any sort of replication... should I have? there was no mention of DNS roles in the walkthrough I followed for the procedure. I can ping "Server2" but not "Server2.contoso.local"... does this help? – Reece Sep 15 '15 at 10:51
  • It should have replicated itself once it was added to the Domain as an additional DC. Is the original server a member of the Domain or just on a Workgroup at the moment? When on the new DC can you ping its FQDN? – CharlesH Sep 15 '15 at 10:58
  • It looks like all the DNS on the new DC are OK... well, at least all the forward lookup zones are present. from the new DC, it can ping "server2.contoso.local" (but results are IPv6). On the original server I ran dcdiag /test:dns /s:server2 and the tests fail straight away – Reece Sep 15 '15 at 11:03
  • also - the original DC is just on a workgroup at the moment – Reece Sep 15 '15 at 11:12
1

As per my comments above the answer laid within a DNS issue..

"When you added the 2nd DC, did you install the DNS role and allow this to replicate? Can you ping the Domain or the FQDN of the 2nd temp DC? If not, check your static DNS settings are definitely correct and check that the 2nd DC DNS properties are listening on the correct interface"

Glad I could help Reece

0
0

Since this is DNS and not Kerberos that's failing, try using NSLOOKUP from the rebuilt server and also on the temporary server to ensure you are getting the same results. If you do various commands in there, you can see what the DNS is coming back with:

SET TYPE=ANY
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local

This should return a result such as:

Server:  dc1.contoso.local
Address:  10.1.80.1

_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local  SRV service location:
          priority       = 0
          weight         = 900
          port           = 88
          svr hostname   = dc2.contoso.local
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local  SRV service location:
          priority       = 0
          weight         = 100
          port           = 88
          svr hostname   = dc1.contoso.local
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local  SRV service location:
          priority       = 0
          weight         = 100
          port           = 88
          svr hostname   = dc2.contoso.local dc2.contoso.local   internet address = 10.1.80.13 dc1.contoso.local internet address =
10.1.80.1 dc1.contoso.local AAAA IPv6 address = fdaf:fba4:3476:1:0:5efe:10.1.80.1 dc2.contoso.local   internet address
= 10.1.80.13
6
  • both servers are giving the same result: *** can't find address for server TYPE=ANY: non-existent domain > _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local Server: UnKnown Address: 192.168.1.154 Name: _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.contoso.local Oddly - that IP is returned by both and is the IP of my temporary DC – Reece Sep 15 '15 at 11:24
  • I think you are missing the "SET" at the from of TYPE=ANY – netniV Sep 15 '15 at 11:25
  • Also, at the moment, you would only be expecting ONE DC because the other hasn't been promoted yet. – netniV Sep 15 '15 at 11:26
  • By the looks of it, both servers are seeing the DNS correctly from the DC point of view, although you've not posted about retrying with a full ANY style as I did so that you can see the SRV records are definitely being returned. The other thing I would suggest is seeing if you still have any references to the demoted DC in your DNS under the _msdcs branch. If you do, it wasn't fully removed and could be an issue. – netniV Sep 15 '15 at 21:54
  • I copy/pasted your SET TYPE=ANY and just modified to suit my domain name. What I posted in my above comment is exactly what both servers returned. I verified this by doing it again. I mentioned in my reply comments addressed to CharlesH that there was a number of leftover DNS records in the DNS of the temporary DC. These must've been throwing the resolution for the original server when I was trying to re-promote it. After removing these then restarting the DNS service, I was able to promote to DC and resume FSMO ownership. – Reece Sep 15 '15 at 22:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.