We are small business intelligence company and we have a head office and a branch office. I have active directory running on windows 2012 R2 in the head office and another active directory running on windows 2012 in brnach office. Both offices are connected via site to site VPN.

When ever there is connectivity issues between two office or the PDC is down, the seconday AD server goes down as well. It is not configured as a RODC. when I try to check the domain settings under domains and trusts, I get the error

You cannot modify domain or trust information because a Primary Domain Controller (PDC) emulator cannot be contacted. Please verify that the PDC emulator for the current domain and the network are both online and functioning properly.

Users are unable to authenticate and when I try to access users and computers I get the following error below.

Naming information cannot be located because: The specified doamin either does not exist or could not be contacted. Contact your system administrator to verify that your doamin is properly configured and is currently online.

I see both the Domain Controllers are set as GC Servers. I am not an expert in active directory. I am hoping it is a minor issue some one should be able to help me fix it.

  • 2
    Do you have your AD Domain's "sites and services" set up correctly? It sounds like your machines are trying to authenticate against the remote domain controller constantly, instead of using the local DC. – Mark Henderson May 17 '16 at 11:02
  • run dcdiag and dcdiag /e /c /v on your DCs from command line These are two tests that test to see if your domains are setup correctly. – Antoan Bull May 17 '16 at 11:33
  • 3
    Are both domain controllers running the DNS role with a copy of the AD Integrated DNS zones for your domain? Are clients configured to use both DCs as DNS servers (and nothing else)? – MDMarra May 17 '16 at 12:01
  • I ran into this recently and assumed it was by design. To be clear, if one of our domain controllers reboots and can't find the domain naming master when it comes up, it can't start directory services. But if the naming master goes down and the other domain controller stay up, things are fine until the next DC is shut down or reboots or anything like that. Now i'm hoping someone wiser than I will tell us there's a way for DCs to reboot without needing all the FSMO role owners to be up. – Todd Wilcox May 17 '16 at 12:22
  • @ToddWilcox that's not the case. A healthy AD can function just find in most circumstances with all FSMO roles offline for a limited period of time. The Domain Naming Master role is only used during the creation of new domains in the forest. I think you're chasing a red herring. – MDMarra May 18 '16 at 0:16

It sounds to me like you have configuration issues rather than it being an issue with AD.

If the DC holding the FSMO roles (including PDC emulator Role) goes down then things will be a bit tough but if you have a second DC users should be able to authenticate, you should be able to create new users and features like GPOs should still process.

Presuming that the 2nd DC is indeed a global catalogue server I would check the following:

1)Does the 2nd DC have a copy of the DNS zone that contains the SRV entries for your domain 2)Are the Clients and server at your remote site configured to use the 2nd DC as their DNS server? 3)Do you have sites and service configured, it sounds like you would need 2 AD Sites one for HQ and one for Branch, making sure you link the appropriate subnets to them and that the DCs are in the appropriate sites.

Losing the DC with the FSMO roles is a pain, you won’t be able the add new DCs or manage trusts and stuff but you will still be able to manage the Domain partition. You get an error when opening up AD Users and Computers, that’s OK. All you need to do once ADUC is open is right click Active Directory Users and Computers and then select change domain (to make sure you are connecting to the correct domain) and then right click Active Directory Users and Computers and then select change domain Controller and select the working DC that you want to use to administer Your objects.

Losing the Domain Naming master or any other FSMO role shouldn’t impact your network short term. The one to watch out for most though is losing the PDC emulator as (amongst other things) it acts as a time source on your network. If that is an issue at your branch, then you might want to consider setting up an alternate time source.

| improve this answer | |
  • There is good advice in this answer. It's not clear to me from the question here, but it might be similar to the issue that I've had, which is not that secondary actions are not working (e.g., it's not that users can't authenticate for some reason), but instead that the DC(s) that are not FSMO role owners can't start the AD services themselves. Sadly I've decommisioned the DC where I had this problem recently, so I can't go back and get event log entries, but basically the event log would have several events to the effect of, "could not start domain services because..." – Todd Wilcox May 17 '16 at 14:35
  • I seemed to figured out what is causing the issue. I am new in the organistation and from what I learnt is that the PDC was installed first. Later sites where created, subnets were assoicated and the PDC was moved to the appropriate site. To my knowledge that is major cause of the problem. I have tried to uninstall the second DC and reinstall again and still it does not work. Any suggestion as I am unable to uninstall the PDC as all users are associated to the PDC and the second DC doesn't work without PDC. – jack May 20 '16 at 10:09
  • Is the 2nd DC in its own site with subnet objects linked to it? does the 2nd DC have DNS installed and does it have a copy of DNS zone holding the appropriate SRV records? are the hosts in the remote site configured to use the 2nd DC as there preferd DNS Server? when install the 2nd DC in the domain do you receive any errors? what DNS server is the 2nd DC using? – Michael Brown May 20 '16 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.