Clients authenticating to wrong Domain Controllers

Question

In our domain we have 28 sites and each site have its own Domain Controllers and we have one data center where we have 3 DCs.
Domain Controllers run DNS role as well and DNS replication is active directory integrated.
For all clients local DC is configured  as primary DNS and DataCenter DCs configured as secondary DNS.
Problem is, most of the times, client machines are not gettings authentication from local domain controller, most of the times authentication happnes from other location domain controller or data center DCs.
I have done the below troubleshooting steps;
DNS - verified in the DHCP and ensured that local domain controller (DNS) server configured as promary DNS server and data center DCs as secondary
SRV Records- verified and looks fine
Subnets - Verifed and found its configured according to the sites in AD
I can confirm the information in SRV records and AD subnet information is accurate.
Please help me resolving the issue
Mahesh

Answer 1

Problem is, most of the times, client machines are not gettings authentication from local domain controller, most of the times authentication happnes from other location domain controller or data center DCs.
This is usually caused due to one of the following:
AD Sites and subnets are not configured properly: DCs not moved to the correct sites, missing subnets, subnets linked to wrong sites .... Here, netlogon.log on each DC will help you to have more information about this: http://support.microsoft.com/kb/109626
Security filtering: If traffic to local DCs is filtered, client computers will not able to query them and will try to query other DCs. You can use PortQryUI to make sure that all needed ports for authentication are opened: http://technet.microsoft.com/en-us/library/dd772723%28v=ws.10%29.aspx
Wrong DNS records which may cause wrong DNS resolution - Here clients may be redirected to DCs you don't like them to be contacted
For AD sites and subnets, make sure that:
You created an AD site per physical location you have DCs in them
You created all usued subnets (Be careful about subnetting and supernetting) and link to their correct sites - Each subnet will be linked to AD sites containing DCs you would like them to be contacted
For Filtering, use PortQryUI for checks and you can use event logs for more information.
For the DNS system, you can proceed like that to be sure that all DCs were registered correctly and that DNS resolution will be fine:
Make sure that all DCs has one IP address in use and only one NIC card enabled (Other NICs should be disabled)
Make sure that public DNS servers are set as forwarders and not in IP settings
Choose a healthy DC / DNS server and make all DCs point to it as primary DNS server. You can make other DNS servers point to their private IP address as secondary one
Make sure that needed ports for AD replication are opened in both direction: http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx
Once done, run ipconfig /registerdns and restart netlogon on each DC you have. Like that, all DCs will update their records on the chosen DNS server and the changes will be replicated to other DC / DNS servers using AD replication. Of couse,
it will be better to remove manually all obsolete / unused DNS records.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.   
Microsoft Student Partner 2010 / 2011
Microsoft Certified Professional
Microsoft Certified Systems Administrator: Security
Microsoft Certified Systems Engineer: Security
Microsoft Certified Technology Specialist: Windows Server 2008 Active
Directory, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Network
Infrastructure, Configuration
Microsoft Certified Technology Specialist: Windows Server 2008 Applications
Infrastructure, Configuration
Microsoft
Certified Technology Specialist: Windows 7, Configuring
Microsoft
Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
Microsoft Certified IT Professional: Enterprise Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer