We have six AD Windows servers (I believe they are all 2008 R2, running at a functional 2008 R2 domain)

All six servers have the AD role and DNS role. We have about 1200 workstations in our environment and we have been experiencing extremely slow intermittent logins for a handful of workstations(mostly older machines). When we had this issue, the GPO had 'always wait for the network at computer startup and logon' enabled. It was decided to disable the setting. We now have users reporting issues with their logon scripts not running and/or not connecting to the domain. It's like they are logging into a temp account, because their NIC does not initialize before it tries to contact the domain (this mostly occurs with the faster workstations).

I was thinking their may be an issue with the DNS servers, I ran the command dcdiag /test:DNS /e /v >dnsTest.txt and noticed a lot of incorrectly configured NIC settings for the servers preferred/secondary DNS settings. Please see image below for overview. I included what I think the proper change should be (also in image)

DC5 has it's preferred DNS set to a random workstation, secondary is another random workstation, and third is a random server, and fourth is back to itself.

I'm not a Windows Admin, but I'm trying to research the issue because we are getting no where.

DNS Settings

TLDR : Can incorrectly configured NIC settings on the DNS server cause issues to the users bootup times? Or what issues would these incorrect settings cause?

  • DC5 is clearly misconfigured, but it's difficult to say if that is the cause. – Greg Askew Dec 11 '15 at 20:36
  • Are these DC's all in the same physical location? Which DNS servers are you assigning to domain clients? – joeqwerty Dec 11 '15 at 20:40
  • I know all 6 are in the DNS records as a name server, so I'd think a user has a 1 in 6 chance of getting DC5. I'm just not sure if this would even affect the user. – TroggleDorf Dec 11 '15 at 20:41
  • DC1-4 are in one location, and DC5-6 are in another location. I'd say about 200 users may have DC5 set as their preferred DNS in their NIC (We use static IPs). – TroggleDorf Dec 11 '15 at 20:44
  • So DC's 5 and 6 are in a different physical location? And domain clients are also in that location? Do you have Active Directory Sites and Services configured for each Site and Subnet and are the correct DC's in each site? – joeqwerty Dec 11 '15 at 21:05

We usually set a DNS server to look at itself first for DNS. Do you also have Sites and Services setup correctly? Make sure you add any subnets and assign them to the correct Sites. If there are different sites, try to have a DC configured as a Global Catalog server in each site, and make sure they're setup as a bridgehead server on each.

We also just had an issue with Dell Optiplex 9020 with the Intel I217-LM nics behaving strangely and dropping connections, a bios and nic driver update might be something to try (it worked in that case)

  • We usually set a DNS server to look at itself first for DNS - That's an incorrect configuration. Current MS best practice is for a DC/DNS server to use a partner DC/DNS server for Primary DNS, not itself. – joeqwerty Dec 11 '15 at 21:19

Each DC should point to the following:

  1. Another DC
  2. Itself

You have the right idea with your diagram. DCs should point to other DCs for DNS, ideally in the same site (if you have multiple sites). Your workstations should then be pointing to a DC in their site for DNS resolution. You will see slow logons as a symptom of DNS issues. Just about every problem with AD tends to be DNS related, at least in my experience... it's always the first place to check!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.