So I have a new environment that I'm setting up with two different data center locations: one in Seattle, and one in LA. In Seattle, I currently have DC1 (primary domain controller) and around 15 servers, and in LA, I have around 5 servers in the domain. None of the servers in the domain are having issues, and all have their time set properly. DC1 gets it's time from the NTP Pool while the domain members get their time from DC1.

For the last day, I've been trying to add a secondary domain controller for redundancy: DC2. However, every time that I try to add it (and I've done this 5 times, provisioning a fresh Win2012R2 server each time, and also deleting the old server from ActiveDirectory and it's DNS records from the DNS zones), the promotion to a domain controller stalls and sticks at "Creating the NTDS settings object ..." stage. I've let it sit for as long as 6 hours, and it never budges.

Looking in the Event Logs, the only errors/warnings are:

NtpClient was unable to set a domain peer to use as a time source because of failure in establishing a trust relationship between this computer and the 'corp.XXXXXXXXXXX.XXX' domain in order to securely synchronize time. NtpClient will try again in 30 minutes and double the reattempt interval thereafter. The error was: The interface is unknown. (0x800706B5)

  • Running a dcdiag picks up no issues, and if I do a dcdiag /s:dc1 from DC2, it * comes back clean with no connection issues.
  • I've verified that Computer Browser, IP Helper, Netlogin, and so on are all running.
  • Firewall is disabled on both servers.
  • Verified before starting that the time is correct, down to the second, for both servers.
  • Made sure the local admin password and domain admin password are different.
  • Am using a separate, domain administrator account as credentials to join DC2 to the domain (same one that has worked on all the other servers)
  • Have tried joining DC2 to the domain FIRST, and then promoting it, and doing a promotion without it joined to the domain ... same results.

Anyone got any thoughts?

  • 1
    What are the DNS server settings on the network adapter for DC1 and DC2? – longneck Aug 30 '16 at 15:37
  • 1
    Also, does DNS resolve corp.XXXXXXXXXXX.XXX correctly to the IP address of DC1? – longneck Aug 30 '16 at 15:38
  • DC1 points to itself for DNS. DC2 points to DC1 as it's primary and itself as it's secondary. And yes, corp.XXXXXXXXXXX.XXX resolves correctly to the IP address of DC1, both internally and externally (within the network and also with the authoritative DNS). – CrainBramp Aug 30 '16 at 22:03
  • And if not made clear when I said that dcdiag turned up no issues with connectivity, DC1/DC2 can ping each other. Remember that I can even join DC2 to the domain ... it's ONLY when I try to promote it to a domain controller that the issue happens. – CrainBramp Aug 30 '16 at 22:05
  • Take a netmon/wireshark capture to identify what traffic is timing out. If it is NTP you'll know the destination that the server needs to communicate with. – user2320464 Sep 2 '16 at 1:00

Every DC is a time server; but it won't become one if it can't sync time from other DCs. Focus on the NTP problem. If you're running a VM, make sure you disabled time sync between the VM and the host. Check your Windows Time service settings: w32tm /query /configuration

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.