I have Samba 4 DC(DC1) and recently i added another DC2(Windows 2008 R2). I plan to demote DC1 and then add another Win DC. FSMO roles was transferred to DC2 server and DC2 works fine. Dcdiag and repadmin tests passed successfully.

At this moment DC2 configured to use DC1 DNS server as primary. I want to be sure that after i demote DC1 there will be no DNS errors so i set primary DNS of DC2 to its local DNS server. Everything still works, various tests passed against new primary DNS but after i reboot DC2 it seems can't locate anything related to domain at statup. The symptoms is long logon time and various dns related errors in logs such:

Name resolution for the name "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.domain.local" timed out after none of the configured DNS servers responded.

Im 100% sure that its not firewall/connectivity problem because before reboot everything works fine. It seems netlogon doing queries before DNS service actually starts. I know that having two or more DC's is a requirement but is there any way to make single DC works as AD+DNS? At least temporarily.

  • You could avoid a lot of headache by deploying your third DC, THEN demoting your samba box. Is there some reason you're avoiding this?
    – Spooler
    Nov 11 '17 at 18:20
  • No reason at all. I'm kind of newbie in everything related to windows servers but i always thought that there's shouldn't be a problem with just a single DC holding AD+DNS. I'm not saying about redundancy and reliability tho.
    – u.ser
    Nov 11 '17 at 19:38

I found an answer. Here it is https://support.microsoft.com/en-us/help/2001093/troubleshoot-dns-event-id-4013-the-dns-server-was-unable-to-load-ad-in

The problem is so-called initial sync of DC's at startup that causes such DNS issues. As far as i understand init sync starts when DC is not a single directory holder in a forest. Maybe if i will demote my DC1 then there will be no init sync. Who knows. But im not willing to check this :) Better to deploy third DC as SmallLoanOf1M suggests and then demote DC1.

  • 1
    This is spot on, it's part of the GlobalCatalog stuff, but there is a registry key to disable that check, it's just not recommended to leave it, it's for troubleshooting or restoration in the event of a full forest failure. This will sound strange but the DC should refer to itself for DNS first to avoid this. This is what MS taught me at an engagement with my company. In absence, then HKLM\SYSTEM\CurrentControlSet\services\NTDS\Parameters and set 'Repl Perform Initial Synchronization' to 0, which will cause it to not wait for initial replication but just start. The reason its.... cont
    – Kyp
    Nov 18 '17 at 20:20
  • doing this is to prevent a DC from coming online with bad data and thus exposing your domain to conflicts and other stuff to clean up if the DC has been offline for a while.
    – Kyp
    Nov 18 '17 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.