3

I have a windows domain that had a Primary Domain controller that Died (Was a VM with snapshots and the host died). My secondary DC is a physical machine running Server 2008 x32 that really needs to be replaced.

To get the domain back into shape I added a physical Server 2012 and added the AD, DHCP and DNS Roles to it. To get it into the domain I had to delete the PDC from the "Domain Controllers" group in "AD Users and Computers". So now I have 2 domain controllers but I'm starting to have problems with some computers saying "a domain controller cannot be located to service this request".

In Server Manager I am seeing the following error for both DC's:

The File Replication Service is having trouble enabling replication from {dc2} to {dc3} for c:\windows\sysvol\domain using the DNS name {dc2}.{domain}. FRS will keep retrying.

Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name {dc2}.{domain} from this computer.
[2] FRS is not running on {dc2}.{domain}.
[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.

When I run dcdiag on the Server 2012 machine {dc3} that was added, one of the things I see (amongst several other errors about the other DC {dc2} being owner of several things and not responding is the following message:

A Primary Domain Controller could not be located.
The server holding the PDC role is down.
......................... {domain} failed test LocatorCheck

So the question is where do I start?

  1. promote the Server 2012 to PDC
  2. Attempt to resolve the replication issue.
  3. Something Else
| improve this question | |
  • OK, first, stop using the term "PDC" to refer to your domain controllers. PDC/BDC terminology to refer to the servers went away with Windows 2000. What does remain of that terminology is the "PDC Emulator" role, which is one of the FSMO roles that get distributed among your domain controllers. In Active Directory, you have Domain Controllers, and a variety of roles that get assigned to one or more of those DCs. – EEAA Jan 10 '16 at 19:49
  • Question: did your domain controller that survived have a Global Catalog replica? – EEAA Jan 10 '16 at 19:50
  • Broadly, you'll need to sieze/recover the FSMO roles that were held by the broken DC and then you can forcibly remove that server's records from your directory. – EEAA Jan 10 '16 at 19:51
  • First of all apologies for not using correct terminology, I'm outside my area of expertise. I know that PDC/BDC were supposed to go away but they are still mentioned everywhere, even in dcdiag messages. There is also still a clear "primary" role of some sort because I couldn't even add another domain controller until I forcibly removed the dead domain controller from "AD Users and Computers/{domain}/Domain Controllers". I don't know if Global Catalog replica is on surviving DC. How can I tell? – RonnBlack Jan 10 '16 at 20:56
  • The only remaining "PDC" thing is the "PDC Emulator" role I mentioned above. – EEAA Jan 10 '16 at 20:57
4

You'll need to use ntdsutil to seize the FSMO roles to another DC and to remove the failed server from AD. Additionally, you'll need to make sure you have at least one Global Catalog server, if you don't then designate one in Active Directory Sites and Services. You'll also need to make sure that you've updated your DNS client settings on all domain members (including the Domain Controllers) to use the new DC/DNS server for DNS.

You'll also need to sync the new PDCe with an external timesource. You an use the following command from the PDCe to do this:

w32tm /config /manualpeerlist:time.windows.com /syncfromflags:MANUAL

you can substitute the time server or servers of your choice in that command.

| improve this answer | |
  • Thanks for the info. Can you tell me which roles I need to seize? I'm a bit clueless since this as all automated when I set it up the first time. – RonnBlack Jan 10 '16 at 21:17
  • You need to seize all of the roles. If you're asking what those roles are then I'd suggest you do a little Googling to learn what they are and how to seize them as well as how to clean the old DC out of AD. – joeqwerty Jan 10 '16 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.