Broken delegated domain _msdcs.domain.local (demoted last 'legacy' DC)

Hi,
We just decommissioned the last of our Windows 2003 domain controllers (replaced them with Windows 2012 DCs)
All DNS zones are AD integrated including the delegated _msdcs.domain.local zone
When I ran DCDIAG DNS tests afterwards I get :              
                  TEST: Delegations (Del)
                  Error: DNS server: W2K3DC.domain.local. IP:x.x.x.x
                  [Broken delegated domain _msdcs.domain.local.]
The last W2K3 DC to go also happened to be the first DC that was ever installed i.e when the domain.local domain and the delegation for _msdcs were created.
It turns out that the NS record in the _msdcs.domain.local delegation only listed this server and no others.
I have now added one of our W2K12 domain controllers as a name server in the NS record. I believe that I should now remove the old , demoted server from the NS record now in order to get rid of the error message from DCDIAG.
Just wanted some second opinions before I did this...
Thanks for any help with this

Just make sure that all existing DC/DNS servers are added under Name Servers
tab in your zone properties. Also, remove your old DC/DNS servers from there.
After that, just run dcdiag again to make sure that everything is okay.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Similar Messages

  • Error (2931) VMM is unable to complete the request. The connection to the VMM agent on the virtualization server (host.domain.local) was lost.

    Experts,
    kindly advice for this error when create vm from a templates, while i'm not having this issue when create the vm to another host from the same templates,
    firewall is disabled and no antivirus on the host.
    The network and the ping is very stable, and the WS-Management service is running on the host,
    Host  : windows server 2012 R2
    VMM : 2012 R2 3.2.7895.0
    VMM updated from RU2 to RU5
    Error (2931)
    VMM is unable to complete the request. The connection to the VMM agent on the virtualization server (host.domain.local) was lost.
    Unknown error (0x80338029)
    Recommended Action
    Ensure that the Windows Remote Management (WS-Management) service and the VMM agent are installed and running and that a firewall is not blocking HTTPS traffic.
    This can also happen due to DNS issues. Try and see if the server (ms-lab-01.eccsolutions.local) is reachable over the network and can be looked up in DNS. You can ping the virtualization server from VMM management server and make sure that the
    IP address returned matches the IP address locally obtained from the virtualization server.
    If the error still persists, restart the virtualization server, and then try the operation again.
    Ahmad Samir | MCSE 2003, MCSE 2012 Private Cloud | MCTS: SCOM 2007, Lync 2010, Exchange 2010.

    Ok  I will try another template,
    and the drop happen in the customization after deploying the VHDX file as my first image.
    I had this answer from partner forum. but i didn't try it yet
    Backup your VMM database and then check the
    tbl_VMM_Lock table in the
    VMM database to see if it has any locks listed, do this after stopping the System Center Virtual Machine Manager Service.
    If there are locks listed in the tbl_VMM_Lock
    table you can clear them by executing the prc_VMM_ReleaseAllLocks
    stored procedure.
    Ahmad Samir | MCSE 2003, MCSE 2012 Private Cloud | MCTS: SCOM 2007, Lync 2010, Exchange 2010, Server Virtualization.

  • Domain local groups with members from other (same forest) domains?

    I'm confused about granting access to a share via a domain local group that contains members from other domains. Consider this scenario:
    Joe Smith logs into his own domain (DALLAS.CORP.COM) and his token gets the DALLAS\sales global group.
    A share (named sales) in a different domain within the same forest (FORTSMITH.CORP.COM) assigns ntfs modify on its DACL via the FORTSMITH\sales_modify domain local group, which contains the DALLAS\sales global group.
    Joe goes to access the sales share...what happens, exactly?
    Since Joe logged into a DC in the DALLAS domain (outside the replication scope of the sales_modify group), his token does not contain sales_modify, right? So when he goes to access the sales share, that file server in FORTSMITH checks his token, doesn't
    see FORTSMITH\sales_modify in his token, and boom: access denied...right?

    Universal group is ok within the same forest but different domain.
    Domain local is ok between separate forest (Trust should be in place).
    Global is ok for same domain.
    See this for more details.
    http://msmvps.com/blogs/acefekay/archive/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy.aspx 
    Written by Ace Fecay-DS MVP.
    Regards~Biswajit
    Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights.
    MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, MCTS, Enterprise Admin
    MY BLOG
    Domain Controllers inventory-Quest Powershell
    Generate Report for Bulk Servers-LastBootUpTime,SerialNumber,InstallDate
    Generate a Report for installed Hotfix for Bulk Servers

  • DNS: Client can't connect because .local domain isn't in DNS. How can I connect over the WAN to server.domain.local?

    So my 2012 server is set up on the LAN with a .local domain name. 
    Remote Desktop Services are set up and remoteapp stuff works fine on the LAN.
    I've set up port forwarding so I can connect to the server over the WAN too, but remoteapp stuff is a bit different. I can connect to the server by specifying the correct IP address. Giving a Web browser the address
    https://serverIPAddress/RDWeb
    lets me get the login screen and see the range of apps for me to run. I select one, the connectoid is downloaded correctly (in Chrome) and I click on the downloaded connectoid. 
    Unfortunately, rather than pursuing the sensible IP-address approach that I started with, the connectoid has been given the server's name on the LAN:  server.domain.local. Clearly, the client machine tries to look this up but DNS hasn't heard of
    it because it's a .local address. 
    I cannot be the only one to have come across this apparent oversight on Microsoft's part. Any ideas as to how this can sensibly be overcome? Obviously, I could put the IP address translation into every client's hosts file (and I've done this and shown it
    works) but I've got too many clients to mess about like this. Anybody know 'the Microsoft way' to fix this?
    Thank you for checking this out -- I am confident the details of the problem are completely specified in this query but, if I'm wrong, please ask.
    Many thanks again,
    Biffo

    Hi,
    I would like to suggest you to follow the checklist.
    Checklist: Make RemoteApp Programs Available from the Internet
    http://technet.microsoft.com/en-us/library/cc772415.aspx
    Thanks.
    Jeremy Wu
    TechNet Community Support

  • ADMT share domain local groups access denied

    Hi,
     I have encountered strange behavior when migrating share with permissions. This is the situation:
    1) We have migrated groups from source domain(these groups are used for defining access to shares, users are directly members of these, no nested groups), groups are domain local
    2) We have migrated share and reapplied and verified ACLs, ok so far
    The problem is that users from source domain cannot access share migrated to new domain, accordin to ACL they have access BUT when they try access the share it only shows access denied. But when the groups are converted to Global in source domain(no need
    to convert in target domain) access is permitted according to ALC).
    Can someone explain that please? Thank you.
    Pete
    sfs

    Hi,
    Member permissions in domain local group can be assigned only within the same domain as the parent domain local group.
    Domain local groups can contain users from any domain. They are used to assign permissions to resources. When you restructure domains, you must migrate domain local groups when you migrate the resources to which they provide access, or you must change the
    group type to universal group.
    For more detail information, you could refer to:
    http://blog.thesysadmins.co.uk/admt-series-7-group-account-migration-wizard.html
    Regards.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Unable to access sysvol using path \\domain.local\sysvol

    Hi,
    We found that our newly configured workstations were unable to read/apply GPOs. Upon checking, we are able to access the path \\domain.local. However, when trying to open sysvol folder (or any other shared folder on the domain controller), we receive the
    following error:
    We cannot also access the folders when using domain netbios name. Strangely enough, when using IP address or DC name, we can successfully map the sysvol folder.
    Have also tried running DCdiag and the test
    NCSecDesc fails with error:
    Hope anyone can shed some light on what went wrong.
    Thank you.

    Hi,
    Based on your description, please make sure that TCP/IP NetBIOS Helper, Netlogon, and the Remote Procedure Call (RPC) services are started and set to Automatic.
    If the issue persists, we can also try disjoining and rejoining the workstation.
    The following thread focused on the similar issue and can be referred as reference.
    Cannot access
    \\domain\sysvol
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/c58600d7-5c7b-4cbb-9da4-4c98e3fa2997/cannot-access-domainsysvol?forum=windowsserver2008r2general
    Best regards,
    Frank Shen

  • ZTIDomainJoin has attempted to join to domain [Domain.LOCAL] too many times. Count = 4_ZTIDomainJoin_25-6-2013 13:06:20_0 (0x0000)

    Hello,
    in my invironment the domain-join isn`t working well.
    In the log : ZTIDomainJoin has attempted to join to domain [Domain.LOCAL] too many times. Count = 4 ZTIDomainJoin 25-6-2013 13:06:20 0 (0x0000)
    What can i do to fix this issue permanent?
    Thx

    The log you actually want to look at is %SystemRoot%\Debug\NetSetup.log.  As Keith said, this file will tell you why a Domain Join is failing and should point you in the right direction to understand what's wrong.  There's a
    good (but old) primer on debugging the issues here: http://technet.microsoft.com/en-us/library/cc961817.aspx
    David Coulter | http://DCtheGeek.blogspot.com |
    @DCtheGeek

  • Can not login as administrator on domain.local (2003 server)

    dears.
    i am using 2003 server. i have 30 users connected to domain.local.
    1 user is using windows XP i am not able to login as an administrator on same domain. i have to install few applications but i still tried a lot.
    same admin user n password is working on all other users.
    even i have given admin rights to same user but still on that XP machine it is login inn but not as administrator.
    i treid same user on other XP machine it works fine as administrator.
    would you please help out?

    Hi:
    Any workstation has a local administrator, perhaps but not necessarily a local user, and can be logged on to by any local user/administrator.  In addition a station should be accessible by domain users and domain administrators.  In XP there may
    be a drop down for selecting a domain vs. a local logon, whereas in Windows 7 and later you must type in the station or the domain name in this format:  domain\user or station\user followed by the password.
    I cannot tell from your post if you are attempting to logon to the XP station in question as a local admin or a/the domain admin.  In any case, please try both the local admin and the domain admin and let us know the results.
    Larry Struckmeyer[SBS-MVP] If your question is answered, please mark the response as the answer so that others can benefit.

  • Domain.local proxyAddress and Email Address Policies!

    Hi,
    I have inherited an Exchange 2007 organization.
    The organization has several public domains (Different departments require different domains) with one overarching domain.
    The default Email Address Policy is the only email address policy set up which has the following:
    [email protected] (PRIMARY)
    [email protected]
    Therefore all users are getting these two addresses. For the users who require another domain email address Helpdesk staff are going into their accounts in EMC and manually adding the email address required and setting it to primary (Leaving the
    Automatically update email address based on recipient policy ticked...)
    I have a few issues here:
    Issue 1: Office 365 DirSync Readiness Check is complaining that I have proxyAddresses that are not publically routable (domain.local). How do I go about resolving this? Does editing a Email Address Policy cause everything to be re-evaluated? I am thinking
    I could go in and remove the domain.local entry (I am assuming it is not needed?) but then would simply applying it cause issues?
    Issue 2: I am assuming if I/or anyone were to re-apply the Email Address Policy it would set all users primary smtp address to
    [email protected] It would not delete the extra email addresses manually added as it is only an additive function?
    Issue 3: Is there a dynamic way of dealing with the situation of users who require the different email addresses? I am aware I could create several Email Address Policies which would work if a new user were to be created with matching criteria, but how would
    I design this so that if a user moves from one department to another their email address policy would be re-evaluated and the new address would be added and set as primary? Can I use OU or an attribute etc.?
    Any help would be appreciated...

    Hi,
    Here are my answers you can refer to:
    1. As far as I know, the name domain.local cannot be published externally by any CA. Then I recommend you create a accepted domain for example domain.com and a related Email Address policy.
    2. We can add multiple email addresses for one mailbox and set one email address as the primary address.
    3. Based on my knowledge, we can manually select the primary email address.
    Thanks,
    Angela Shi
    TechNet Community Support

  • Members of Domain Local Groups not showing up through net group command

    Hello,
    I am trying to get the list of members in a Domain Local Group using "NET GROUP" command, but unable to get the member list.
    I get the message "group not found", whereas members of Global Groups  are visible.
    Thank you in advance !

    Unfortunately your post is off topic here, in the TechNet Site Feedback forum, because it is not Feedback about the TechNet Website or Subscription. 
    This is only one forum among the many that are on the TechNet Discussion Forums, and given your post, you likely chose the wrong forum. 
    This is a standard response I’ve written up in advance to help many people (thousands, really.) who post their question in this forum in error, but please don’t ignore it. 
    The links I share below I’ve collected to help you get right where you need to go with your issue.
    For technical issues with Microsoft products that you would run into as an
    end user of those products, one great source of info and help is
    http://answers.microsoft.com, which has sections for Windows, Hotmail, Office, IE, and other products. Office related forums
    are also here: http://office.microsoft.com/en-us/support/contact-us-FX103894077.aspx
    For Technical issues with Microsoft products that you might have as an
    IT professional (like technical installation issues, or other IT issues), you should head to the TechNet Discussion forums at
    http://social.technet.microsoft.com/forums/en-us, and search for your product name.
    For issues with products you might have as a Developer (like how to talk to APIs, what version of software do what, or other developer issues), you should head to the
    MSDN discussion forums at http://social.msdn.microsoft.com/forums/en-us, and search for your product or issue.
    If you’re asking a question particularly about one of the Microsoft Dynamics products, a great place to start is here:
    http://community.dynamics.com/
    If you really think your issue is related to the subscription or the TechNet Website, and I screwed up, I apologize! 
    Please repost your question to the discussion forum and include much more detail about your problem, that could include screenshots of the issue (do not include subscription information or product keys in your screenshots!), and/or links to the problem
    you’re seeing. 
    If you really had no idea where to post this question but you still posted it here, you still shouldn’t have because we have
    a forum just for you!  It’s called the Where is the forum for…? forum and it’s here:
    http://social.msdn.microsoft.com/forums/en-us/whatforum/
    Moving to off topic. 
    Thanks
    MSDN and TechNet Subscriptions Support
    Did Microsoft call you out of the blue about your computer?
    No, they didn't.

  • Expand a Domain Local group as an administrator from a different domain

    Hi experts,
    I have a multi-domain single-forest environment where there are two domains - A and B. There is also working two-way shortcut trust relationship between those. All objects I'm going to mention are domain A members except some Admins that are members of domain
    B. There is DOM_A\User1 - member of domain A Global Security group "GA". There is also Domain Local security  group "DLA" in domain A and a resource (published desktop in this case - member of domain A). DOM_A\User1 is member of GA.
    GA is member of DLA. DLA has full access to the published desktop therefore DOM_A\User1 has full access to the published desktop. Until here everything works with no problem.
    There is also a web application on an IIS server in domain A that can list resources available to users. When an admin from domain A lists resources for DOM_A\User1 - the published desktop is displayed BUT when an admin from domain B does the same - no resource
    is displayed. When I convert DLA (Domain Local Security) to Universal security group - everything works for the domain B admin. It seems to be an issue with expanding AD groups for the user DOM_A\User1 as this is exactly what the IIS application does i.e.
    it should find all groups the user is member of and compare this list with the resource access list for published resources. Now the question is whether:
    1) It should work with the Domain Local security group - I have a permission and/or another issue there
    2) This wouldn't work with the Domain Local security group as the admin comes from another domain and having Universal security group is the correct solution as per Microsoft best practices
    Thank you.

    Global - Members should be within same domain
    Universal - Members should be within same forest
    Domain local - No boundry.
    See this as well.
    http://blogs.msmvps.com/acefekay/2012/01/06/using-group-nesting-strategy-ad-best-practices-for-group-strategy/
    Regards,
    Biswajit
    MCTS, MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, Enterprise Admin, ITIL F 2011
    Blog:
      Script Gallary:
      LinkedIn:
    Note: Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights..

  • Managing membership of local group - Domain Local groups not permitted?

    Hi all
    I would like to populate the membership of the local Administrators group on certain member servers using the "Local users and groups" feature of GPP.  The object picker does not let me choose groups with Domain Local scope. 
    Does anyone know the reason for this?  Is there any workaround?
    I can add domain local groups to the membership of the Adminstrators group manually, so it seems strange I can't do it via GPO.
    Alexei

    > I would like to populate the membership of the local Administrators
    > group on certain member servers using the "Local users and groups"
    > feature of GPP.  The object picker does not let me choose groups with
    > Domain Local scope.
    I cannot confirm. I can add both DL and GG. What OS are you using? Here:
    Win 7 Enterprise 32 bit.
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • Direct Access: domain.LOCAL supported?

    Hi,
    Our domain was configured using company.local.  I am now trying to deploy Direct Access on a Windows Server 2012 R2 server using a single NIC deployment.
    Do we have to change our domain name to company.com in order to deploy Direct Access? If not - are there any special considerations when deploying using the .local domain?
    We have a forward lookup zone for domain.com in addition to the domain.local on our DNS servers. We intend to use "da.domain.com" as the "public name used by clients to connect to the Remote Access server".

    Hi,
    You do not have to change.
    With a single NIC, I suppose your server is behind a NAT device.
    For your reference:
    Step-By-Step: Enabling DirectAccess in Windows Server 2012 R2
    http://blogs.technet.com/b/canitpro/archive/2014/01/06/step-by-step-enabling-directaccess-in-windows-server-2012.aspx
    STEP 6: Test DirectAccess Client Connectivity from Behind a NAT Device
    http://technet.microsoft.com/en-us/library/hh831524.aspx
    Hope this helps.

  • Broken root domain without a valid backup. Any chance to get it back to work properly ?

    Hi guys,
    i came across the following issue:
    Imagine a standard enterprise environment with a forest. The root domain is called contoso.com and there is a subdomain called company.contoso.com. There are also subdomains of company.contoso.com, but they are not important for the problem description.
    The functional level of the forest is Windows 2003-interim & the domain level of the root domain is Windows 2003, as is the domain level of all subdomains. All Domain Controllers are Windows 2003 SP2.
    There have been people in the environment with too many rights, that used to promote DCs and then also just decommission them without properly demoting them. This left several unreachable domain controllers in both the root domain & the subdomain.
    I cleared all those DCs that are no longer available, which made company.contoso.com stable and reliable. All DCs within the subdomain are properly talking to each other and replicating fine.
    Then i discovered the main issue here. The replication in the root domain is broken. The is only one domain controller left in the root domain, nevertheless the server is suffering from USN rollback. Digging deeper i found out that the domain controllers
    have been virtualized years ago, but no one ever cared about the root domain. So i found out that replication stopped in 2006 when obv. the last healthy domain controller was removed from the root domain.
    So i have basically a crippled root domain with a crippled domain controller. I am not able to set the forest level to 2003 native, as the domain controller says that the domain contoso.com is still Windows 2000. This is not correct, i have checked msDS-Behaviour-Version
    and nTMixedDomain. They are properly set to 2 & 0.
    My idea was to introduce a new installed 2003 server and promote it to a DC. Then get rid of the broken one. Unfortunately the broken DC is not replicating. Due to USN rollback the netlogon service goes constantly to paused state & of course both inbound
    & outbound replication are disabled. Even when i reenable the replication it is just a matter of seconds before they get disabled again. I also tried to introduce a new 2012R2 DC, but that fails of course due to the forest level not beeing 2003.
    So i am a little stuck here. Any thoughts about how to continue to troubleshoot ?
    I have a final idea:
    Install a new forest with the same name contoso.com and set up a trust with company.contoso.com.
    The question would be, how can i convince company.contoso.com that the new installed forest and domain are its parent ?

    > Install a new forest with the same name contoso.com and set up a trust
    > with company.contoso.com.
    > The question would be, how can i convince company.contoso.com that the
    > new installed forest and domain are its parent ?
    You cannot. Sad, but true. If the forest root domain is dead, the forest
    is dead. In addition, you have no Naming Master and no Schema Master
    FSMOs. The only reliable solution is creating a new forest and new
    subdomains, then migrating all objects...
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • How to make domain local to a model

    We know domains are stored in \types\defaultdomains.xml. That makes em truly global, every model in the future will see ALL PAST domains.
    Sometimes, you need a domain only for a specific model. Is there an option to do this?

    I found this solution quite bugged.
    DM 3.0 production
    pre-condition:
    bug1 -------------------
    how to reproduce:
    - move the defaultdomains.xml to {design}/domains/local_domains.xml
    - fix the element <filename> as suggested
    - open the design
    - Open domain admin
    - Add a new domain, testDomain
    - Apply
    - Save
    what happened
    - keep in mind you have a local domains file + the global one
    - the domain was generated inside the global domains!
    - But this design had a local domain in domains/local_domain.xml.
    - Now I'm forced to go inside defaultdomains.xml, get the domain in xml and cut-paste it in the local file.
    What should happen
    - At least, ask me where to save the new domain.
    bug2 -----------------
    - move the defaultdomains.xml to {design}/domains/local_domains.xml
    - fix the element <filename> as suggested
    - open the design
    - Open domain admin
    - select the local file using the DOMAINS FILE option.
    - add a domain (this time you're sure to add it locally)
    - specify logical type = CHAR
    - specify size = 2
    - Apply
    - Save
    - close
    - open domain admin
    - look at your new domain
    what happened
    - you local domain get lost. It is arbitrary renamed to "domain_XX"
    - the type is lost (now is unknown)
    - the size is lost (now is nothing)
    what should happen
    - do not destroy each new domain that lives in the local file
    Edited by: T. on May 26, 2011 2:42 AM

Maybe you are looking for