4

I've installed Windows Server 2016 Datacenter on a physical machine called LOKI. It is allocated the static IP 192.168.1.77 by the router. It is also set manually in TCP/IPv4 on the NIC. The gateway is set to 192.168.1.1 (the router). The Primary DNS Server is set to 127.0.0.1. The Secondary DNS Server is blank. When adding the Active Directory Domain Services, and DNS roles - I chose to create a new forest: acme.com (I'm using this as the example, but it is actually set to a valid domain that I own). The NetBIOS domain name was set to ACME.

I've tried joining a physical server (BALDER) to the domain, as well as VM's running on BALDER. I have BALDER's Primary DNS Server in TCP/IPv4 set to 192.168.1.77. It has a static IP assigned by the router of 192.168.1.75. I've also tried setting it manually in TCP/IPv4 with a gateway of 192.168.1.1.

When joining the domain, I'm using the full domain, with the TLD: acme.com.

Occasionally I'm prompted for credentials. I've tried the following users:

  • acme\administrator
  • acme.com\administrator
  • acme\db
  • acme.com\db

(where db is an Enterprise Admin). Upon entering any credentials, I get:

---------------------------
Computer Name/Domain Changes
---------------------------
The following error occurred attempting to join the domain "acme.com":

The specified domain either does not exist or could not be contacted.
---------------------------
OK   
---------------------------

...but most of the time I immediately get this error message, without being prompted for credentials:

Note: This information is intended for a network administrator.  If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "acme.com":

The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.acme.com

Common causes of this error include the following:

- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:

192.168.1.77

- One or more of the following zones do not include delegation to its child zone:

acme.com
com
. (the root zone)

I've ran dcdiag /fix on LOKI. All tests pass.

I've ran the following:

nslookup
set type=all
_ldap._tcp.dc._msdcs.acme.com

On LOKI (the DC) I get:

Server:  UnKnown
Address:  ::1

_ldap._tcp.dc._msdcs.acme.com   SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = LOKI.acme.com
LOKI.acme.com   internet address = 192.168.1.77
LOKI.acme.com   AAAA IPv6 address = 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c
LOKI.acme.com   AAAA IPv6 address = fdc6:f573:1ff9:0:8dce:ebee:6510:b61c

On BALDER I get:

Server:  UnKnown
Address:  fdc6:f573:1ff9:0:7250:afff:fe35:beec

*** UnKnown can't find _ldap._tcp.dc._msdcs.acme.com: Non-existent domain

I've tried running this on LOKI, which completes succesfully:

dcdiag /test:registerindns /dnsdomain:acme.com /v

I've also restarted the DNS server, and restarted the NetLogon service.

I've tried running ipconfig /flushdns on both LOKI and BALDER.

I can successfully ping the DC (LOKI) from BALDER, as well as my VM's. I don't know if it matters that it's replying with an IPv6 address rather than an IPv4 addess. IPv6 addresses are set dynamically by DHCP on the router. Either way, it's successfully resolving the FQDN.

C:\Windows\system32>ping loki

Pinging loki.acme.com [2a02:c7d:894d:6d00:8dce:ebee:6510:b61c] with 32 bytes of data:
Reply from 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c: time=1ms
Reply from 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c: time<1ms
Reply from 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c: time<1ms
Reply from 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c: time<1ms

Ping statistics for 2a02:c7d:894d:6d00:8dce:ebee:6510:b61c:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

The machines are connected by a single GigE switch (running this on BALDER):

C:\Windows\system32>tracert loki

Tracing route to loki.acme.com [2a02:c7d:894d:6d00:8dce:ebee:6510:b61c]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  LOKI [2a02:c7d:894d:6d00:8dce:ebee:6510:b61c]

Trace complete.

Per Greg's comment, I have ran this command:

nltest /dsgetdc:acme.com

The output appears to be the same from the DC and a joining server.

Here is the output from LOKI (the DC):

           DC: \\LOKI.acme.com
      Address: \\2a02:c7d:894d:6d00:8dce:ebee:6510:b61c
     Dom Guid: b0408a6c-7960-4908-9fbf-1b4ca506a31e
     Dom Name: acme.com
  Forest Name: acme.com
 Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10
The command completed successfully

Here is the output from BALDER (a joining server):

           DC: \\LOKI.acme.com
      Address: \\2a02:c7d:894d:6d00:8dce:ebee:6510:b61c
     Dom Guid: b0408a6c-7960-4908-9fbf-1b4ca506a31e
     Dom Name: acme.com
  Forest Name: acme.com
 Dc Site Name: Default-First-Site-Name
Our Site Name: Default-First-Site-Name
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE FULL_SECRET WS DS_8 DS_9 DS_10
The command completed successfully

Just to mix it up a bit, I ran PortQueryUI from a different server - ODIN (a VM on BALDER). I entered LOKI in the Destination IP/FQDN to query field, and left the rest of the options as the defaults (Service to query: Domains and Trusts).

My post is exceeding the char limit, so I've uploaded the results to Pastebin.

I've ran ipconfig /all on a couple of joining servers — a physical server (BALDER) and a VM (ODIN). Here are the results.

BALDER:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : BALDER
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : Home

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : QLogic BCM5708C Gigabit Ethernet (NDIS VBD Client) #50
   Physical Address. . . . . . . . . : 00-22-19-61-D7-D3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter vEthernet (INTERNET):

   Connection-specific DNS Suffix  . : Home
   Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter
   Physical Address. . . . . . . . . : 00-22-19-61-D7-D1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2a02:c7d:894d:6d00:15f2:deb5:93d3:460d(Preferred)
   IPv6 Address. . . . . . . . . . . : fdc6:f573:1ff9:0:15f2:deb5:93d3:460d(Preferred)
   Link-local IPv6 Address . . . . . : fe80::15f2:deb5:93d3:460d%17(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.75(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : 12 June 2017 23:05:03
   Lease Expires . . . . . . . . . . : 13 June 2017 23:05:02
   Default Gateway . . . . . . . . . : fe80::7250:afff:fe35:beec%17
                                       192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 335553049
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-AD-3F-C1-00-22-19-61-D7-D3
   DNS Servers . . . . . . . . . . . : fdc6:f573:1ff9:0:7250:afff:fe35:beec
                                       192.168.1.77
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:146b:3e88:3f57:feb4(Preferred)
   Link-local IPv6 Address . . . . . : fe80::146b:3e88:3f57:feb4%15(Preferred)
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 201326592
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-AD-3F-C1-00-22-19-61-D7-D3
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Reusable ISATAP Interface {8620C56F-EB4F-484B-A9DA-5C135F83D4F6}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : Home
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{91D42D6A-0FF8-4541-AF50-FE8AB4C11F3D}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

ODIN:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : ODIN
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
   Physical Address. . . . . . . . . : 00-15-5D-01-4C-05
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2a02:c7d:894d:6d00:6912:438f:9808:ad47(Preferred)
   IPv6 Address. . . . . . . . . . . : fdc6:f573:1ff9:0:6912:438f:9808:ad47(Preferred)
   Link-local IPv6 Address . . . . . : fe80::6912:438f:9808:ad47%10(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.85(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::7250:afff:fe35:beec%10
                                       192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 50337117
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-BF-D2-65-00-15-5D-01-4C-05
   DNS Servers . . . . . . . . . . . : fdc6:f573:1ff9:0:7250:afff:fe35:beec
                                       192.168.1.77
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:c7e:2db:fd81:f39(Preferred)
   Link-local IPv6 Address . . . . . : fe80::c7e:2db:fd81:f39%15(Preferred)
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 134217728
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-20-BF-D2-65-00-15-5D-01-4C-05
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Reusable ISATAP Interface {16673442-3677-41AD-94B2-86C728C55B62}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

I've also tried setting the DNS suffix to acme.com, but this didn't help.

What is preventing me from joining any machines to the domain?

Improve this question
3
  • You need to provide the output of the following command from both the domain controller and the computer you want to join to the domain: nltest /dsgetdc:acme.com. You also need to run PortQueryUI on the computer that you want to join to the domain and provide the output.
    – Greg Askew
    Jun 12, 2017 at 14:08
  • 1
    In ipconfig /all on the computer joining the domain, does it have the domain controller specified as the DNS server in the IPV6 properties?
    – Greg Askew
    Jun 12, 2017 at 16:52
  • If you have IPV6 enabled, the clients need to have valid IPV6 DNS server addresses configured. As a test, you could disable IPV6 on the domain controller. Registry key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters] Value: "DisabledComponents"=dword:000000ff
    – Greg Askew
    Jun 12, 2017 at 23:24

2 Answers 2

Reset to default
3

If IPV6 is enabled, the clients must have valid domain controller DNS entries in the network adapter properties.

Improve this answer
6
  • IPv6 was enabled on the router by default. I disabled it on the router, and then on the joining server unchecked IPv6 on the Properties of the NIC. Which worked! Thanks a lot for your help mate!
    – Danny Beckett
    Jun 13, 2017 at 12:59
  • As an fyi unchecking the ipv6 box on the nic is unsupported.
    – Jim B
    Jun 13, 2017 at 13:12
  • @JimB What's the correct way of doing this? Editing the reg key that Greg commented with, for each machine that I want to join to the domain?
    – Danny Beckett
    Jun 13, 2017 at 13:42
  • @DannyBeckett: The registry setting is simpler to manage than network adapter properties.
    – Greg Askew
    Jun 13, 2017 at 13:48
  • Cheers @GregAskew!
    – Danny Beckett
    Jun 13, 2017 at 15:51
-3

Set your static up manually on the server to use the Domain Controller machine as the Gateway and set the DNS manually as well probably the same up as the domain controller. Then try to join the domain.

Set these back to dynamic after you join the domain.

Improve this answer
4
  • I already tried using the DC IP for the Gateway. It didn't help.
    – Danny Beckett
    Jun 12, 2017 at 2:29
  • Did you set DNS as well?
    – tekFranz
    Jun 12, 2017 at 2:31
  • Yes. (I did write that in the beginning of my question)
    – Danny Beckett
    Jun 12, 2017 at 2:38
  • Hmmm...the only other trick I can think of is either omitting or adding the DNS suffix for example try with just straight Acme instead of Acme.com. Not sure if this works on .com but sometimes it helps on .local.
    – tekFranz
    Jun 12, 2017 at 3:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .