Domain Controller require ADC to sync before DC come online

Hi,
I have an urgent query that my domain controller I think might not working properly. The reason for this if I restart my DC and ADC and when try to open Active Directory console it gives error until the ADC comes online completely. I don't know why DC is
doing such behavior that depend on ADC. The all FSMO roles are on DC and ADC is only DNS and GC.
Kindly suggest what is the cause of this issue.
Please help

Hello,
What is the error message says ? what is the error you see in event viewer ?
Thanks
Dishan M. Francis
MVP – Directory Services
Dishan M. Francis www.rebeladmin.com

Similar Messages

  • Questions About Adding First 2012 R2 domain controller to an existing 2008 Domain

    Our current domain controllers are all running Server 2008 and are VMs in our local office.  We plan to add a new domain controller and also create a new AD site.  This new domain controller will be the only domain controller in the new remote
    site.  It will also be a VM on a new 2012 R2 Hyper-V server at the new remote site.
    There is currently only one site (the default first site).
    The steps planned are to create a new site to represent the remote location in AD configured with the subnets that apply to the remote site.  (Computers in our local office should continue to use the domain controllers in our office and remote PCs should
    start using the new domain controller.)
    Then build the new domain controller VM, join to the domain as a member server and then promote it to domain controller of the new site.
    Are any steps missing?
    Do we need to do anything special with time sync settings on Hyper-V or will both the Hyper-V host and the domain controller guest just automatically sync time with the PDC domain controller across a WAN connection at the main site?
    Is there a way to prepare the domain/schema for the new 2012 R2 domain controller in advance so that the new domain controller can be installed later without needing Schema Admin or Enterprise admin permissions during the installation?

    > Where can I find what is correct for 2012 R2 domain controllers running
    > on Hyper-V 2012 R2 hosts?
    There's no "one fits all" advice on this topic, but I agree with Ahmed:
    Within a domain, the DCs provide a hierarchical time source, and since
    clients are required to be in sync with DCs, this is a "must be".
    If your HV hosts are member of the domain they are hosting, things can
    easily go crazy if you do not disable host time sync.
    Greetings/Grüße,
    Martin
    Mal ein
    gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me -
    coke bottle design refreshment (-:

  • Script for synchronizing the clock with Domain Controller

    Hi Everyone,
    In our environment, we have Mac machines which are joined to window's domain. Once in while machine will not log on to domain because the OS clock had a different time than the domain controller and sooner you fix the clock, machine will start communicating with domain controller.
    I was wondering if there is an easier way to do this using script which can run every few hours to force the OS clock to synchronize with the domain controller.
    Thanks,

    You don't need an Applescript to do that.
    Enable the NTP server on the Windows Domain Controller (perhaps start here: http://technet.microsoft.com/en-us/library/cc773013.aspx).
    Then setup the Macs to use NTP (Network Time) to sync to the domain controller.

  • WLC redirect was working fine, now it is going to the domain controller

    WLC was going to https://1.1.1.1/login.html?redirect=google.com/ and worked beautifully for years.
    All of a sudden the web browser is now going to:  https://(my domain controller name/login.html?redirect=google.com/
    I have to manually put in the 1.1.1.1 instead of my domain controller name to get them to the authentication page.
    How do I fix?

    First I'd check the WLC and make sure the VIP DNS name hasn't been changed.
    Secondly it's possible a proxy was out in place, so I'd see of that happened as well
    Steve
    Sent from Cisco Technical Support iPhone App

  • What is the best practice and Microsoft best recommended procedure of placing "FSMO Roles on Primary Domain Controller (PDC) and Additional Domain Controller (ADC)"??

    Hi,
    I have Windows Server 2008 Enterprise  and have
    2 Domain Controllers in my Company:
    Primary Domain Controller (PDC)
    Additional Domain Controller (ADC)
    My (PDC) was down due to Hardware failure, but somehow I got a chance to get it up and transferred
    (5) FSMO Roles from (PDC) to (ADC).
    Now my (PDC) is rectified and UP with same configurations and settings.  (I did not install new OS or Domain Controller in existing PDC Server).
    Finally I want it to move back the (FSMO Roles) from
    (ADC) to (PDC) to get UP and operational my (PDC) as Primary. 
    (Before Disaster my PDC had 5 FSMO Roles).
    Here I want to know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
    In case if Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
    Example like (FSMO Roles Distribution between both Servers) should be……. ???
    Primary Domain Controller (PDC) Should contains:????
    Schema Master
    Domain Naming Master
    Additional Domain Controller (ADC) Should contains:????
    RID
    PDC Emulator
    Infrastructure Master
    Please let me know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles.
    I will be waiting for your valuable comments.
    Regards,
    Muhammad Daud

    Here I want to know the best practice
    and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
    There is a good article I would like to share with you:http://oreilly.com/pub/a/windows/2004/06/15/fsmo.html
    For me, I do not really see a need to have FSMO roles on multiple servers in your case. I would recommend making it simple and have a single DC holding all the FSMO roles.
    In case if
    Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
    No. This is not true. Each FSMO role is unique and if a DC fails, FSMO roles will not be automatically transferred.
    There is two approaches that can be followed when an FSMO roles holder is down:
    If the DC can be recovered quickly then I would recommend taking no action
    If the DC will be down for a long time or cannot be recovered then I would recommend that you size FSMO roles and do a metadata cleanup
    Attention! For (2) the old FSMO holder should never be up and online again if the FSMO roles were sized. Otherwise, your AD may be facing huge impacts and side effects.
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Server 2008 Domain Controller won't sync with domain for time

    Hi,
    I have a Windows Server 2008 Domain Controller, a physical machine. When I run w32tm /query /status it shows the source as: Local CMOS clock. What ever I seem to try I cannot get it to look at the PDC to sync for time. Using RsOP I can see the correct policy
    is in place, pointing to the correct server. I have checked the registry key and the correct server is in there under \HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Paramaters.
    I have tried various w32tm commands such as seeting the /manualpeerlist to the correct server, /syncfromflags:DOMHIER. I have also used w32tm /config /update, making sure to restart the w32time service.
    But whatever I do I cannot get it to sync from the network, it always shows Local CMOS clock. The time on the server is starting to drift now. When I use w32tm /resync /rediscover I get an error message:  "The computer did not resync because no time
    data was available". There is no firewall between the 2 servers blocking port 123.
    Any ideas why this is happening?
    Thanks

    see:
    http://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-1/
    http://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-2/
    http://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-3/
    http://jorgequestforknowledge.wordpress.com/2010/09/26/configuring-and-managing-the-windows-time-service-part-4/
    <o:p></o:p>
    Cheers,<o:p></o:p>
    (HOPEFULLY THIS INFORMATION HELPS YOU!)
    Jorge de Almeida Pinto | MVP Identity & Access - Directory Services
    * This posting is provided "AS IS" with no warranties and confers no rights!
    * Always evaluate/test yourself before using/implementing this!
    * DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/
    ################# Jorge's Quest For Knowledge ###############
    ###### BLOG URL: http://JorgeQuestForKnowledge.wordpress.com/ #####
    #### RSS Feed URL: http://jorgequestforknowledge.wordpress.com/feed/ ####
    -------------------------------------------------------------------------------------------------------<o:p></o:p>
    "akira251" wrote in message news:[email protected]...
    Hi,
    I have a Windows Server 2008 Domain Controller, a physical machine. When I run w32tm /query /status it shows the source as: Local CMOS clock. What ever I seem to try I cannot get it to look at the PDC to sync for time. Using RsOP I can see the correct policy
    is in place, pointing to the correct server. I have checked the registry key and the correct server is in there under \HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Paramaters.
    I have tried various w32tm commands such as seeting the /manualpeerlist to the correct server, /syncfromflags:DOMHIER. I have also used w32tm /config /update, making sure to restart the w32time service.
    But whatever I do I cannot get it to sync from the network, it always shows Local CMOS clock. The time on the server is starting to drift now. When I use w32tm /resync /rediscover I get an error message:  "The computer did not resync because no time
    data was available". There is no firewall between the 2 servers blocking port 123.
    Any ideas why this is happening?
    Thanks
    Jorge de Almeida Pinto [MVP-DS] (http://jorgequestforknowledge.wordpress.com/)

  • Hardware Requirements for a Windows Server 2012 Domain Controller.

    Hi,
    I have a secondary office with 10 users with a domain controller that has reached its end of life.  We like to upgrade the current hardware to serve as a domain controller and potentially as an onsite file server that will sync with head office during
    off peak business hours.
    Any recommendations for a low cost yet reliable hardware for the above solution ?

    Hi,
    Thanks for your post.
    I think you need to meet the requirement for upgrading to windows server 2012r2.
    http://technet.microsoft.com/en-us/library/hh994618.aspx#BKMK_SysReqs
    And you could refer to the following article about windows server 2012r2 domain controller configuration
    Building Your First Domain Controller on 2012 R2
    http://social.technet.microsoft.com/wiki/contents/articles/22622.building-your-first-domain-controller-on-2012-r2.aspx
    Regards.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Error while configuring ADC (Additional Domain Controller)

    Hello Experts,
    I am configuring ADC (Additional Domain controller) in a member server which is in workgroup. while configuring ADC on that server, I got a window saying "additional information for this domain controller", where there were three options, i.e.
    DNS server, Global Catalog, RODC (Read only Domain controller) and bydefault first two options(DNS & Global Catalog) were checked. I kept that setting and clicked on next. Now this is showing I need to give a static IP to my adapter, but I have already
    given a static IP. when I unchecked the DNS button from that window it was not giving such error. Now my question is if I continue without checking the DNS, will it give me trouble in future. Please suggest. I am using MS2008 R2.
    Swaprakash..

    Ensure that you don't have another NIC in your server that is set to obtain IP address from DHCP. However, even if you proceed with this warning, you will probably not have any errors later, as long as you're sure that you have static IP assigned to your
    internal NIC.
    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you. Thank you! Damir

  • [Forum FAQ] How to sync time with a Domain Controller for a standalone server

    As we all known, if a computer belongs to an Active Directory domain, it will sync the time automatically by using the Windows Time service that is available on Domain Controllers.
    While a standalone server will synchronize with its local hardware time and Windows time server. (Figure 1)
    Figure 1.
    Under some circumstances, a standalone server is necessary in a product environment. We can sync the time of this standalone server with the Domain Controller using
    the steps below:
    1. Modified the value of the AnnounceFlags:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
    Under this entry we can see the default value of AnnounceFlags is 10 (Decimal), we configure the value as 5 (Decimal). (Figure 2)
    Figure 2.
    2. Confirm the value of the registry key below is set to 0:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer 
    Figure 3.
    3. Configure the standalone server to synchronize with a specific time source (Domain Controller).
    In our test, we configured our Domain Controller (192.168.10.200) as the time source. Used the following commands:
    w32tm /config /syncfromflags:manual /manualpeerlist:192.168.10.200
    4. Sync the time with the Domain Controller using the command below:
    w32tm /config /update
    From the figure below (Figure 4), you can see the after we did all the steps above, the time on the standalone server was synced with the Domain Controller.
    Figure 4.
    (Note: Peerlist is a separated list of DNS servers, or IP Addresses for the time servers)
    More information:
    Windows Time Service Tools and Settings
    http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx#w2k3tr_times_tools_dyax
    Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

    Thank you for the instruction! I am sure it is one of the scenarios that majority of administrators will run into. So I suggest to write a wiki about it and publish it for this month's TechNet Guru in Windows Server section. This month's TechNet Guru can
    be found here:
    Calling All Wise Men! Windows
    Server Gurus Needed! Apply Within! No One Turned Away!
    Thanks for your informative post. :)
    Regards.
    Mahdi Tehrani   |  
      |  
    www.mahditehrani.ir
    Please click on Propose As Answer or to mark this post as
    and helpful for other people.
    This posting is provided AS-IS with no warranties, and confers no rights.
    How to query members of 'Local Administrators' group in all computers?

  • Version number for GPO's not in sync with the version number for GPO's on the Baseline domain controller

    Hi
    I accidentally removed one of our domain controller's hyper-v image (DC-02) from the hyper-v manager and to bring it back online launched a new virtual machine using the same virtual hard drive. This brought back the domain controller machine and I set the
    original IP address to the same assuming that everything would just working fine.
    Sadly, that wasn't the case as when I tried to open the group policy manager on that machine I started getting "Access is denied" error. I was then presented with an option to open the group policy manager with the first available DC which I did
    and was able to open it with showing the same machine as the baseline domain controller under the status tab (DC-01 is actually the baseline DC). I then clicked Detect now and noticed it was showing 1 DC under replication in progress with problems in GPO version.
    I then did the same thing on the primary DC (DC-01) and even there it was showing this only (images attached).
    So I started exploring over the internet going through various articles but couldn't find a solution which I could apply without worrying about corrupting something somewhere. I also went to the SYSVOL folder on both the DC's to check the version number
    in GPT.ini files which are mentioned below:
    \\CC-DC01\sysvol\cloudchowk.lab\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
    [General]
    Version=3
    \\CC-DC01\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
    [General]
    Version=5439513
    \\cc-dc02\SYSVOL\cloudchowk.lab\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
    [General]
    Version=3
    \\cc-dc02\SYSVOL\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
    [General]
    Version=5308439
    Could anyone please help me sort this out? I am no system admin and whatever knowledge I have of setting up DC, AD etc is from following one article or the other over the internet.
    Regards
    Sajat Jain

    Hi
    Apologies for responding late. I followed through all the points mentioned by Frank and even did a non-authoritative restore synchronization but still no luck.
    I am attaching the output from the dcdiag /q and the from the event viewer after doing to non-authoritative restore synchronization.
    DCDIAG /Q
    There are warning or error events within the last 24 hours after the
    SYSVOL has been shared. Failing SYSVOL replication problems may cause
    Group Policy problems.
    ......................... CC-DC03 failed test DFSREvent
    Unable to connect to the NETLOGON share! (\\CC-DC03\netlogon)
    [CC-DC03] An net use or LsaPolicy operation failed with error 67,
    The network name cannot be found..
    ......................... CC-DC03 failed test NetLogons
    An error event occurred. EventID: 0x0000164A
    Time Generated: 01/18/2015 17:52:17
    Event String:
    The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
    An error event occurred. EventID: 0x0000164A
    Time Generated: 01/18/2015 17:54:12
    Event String:
    The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 17:54:41
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 17:55:42
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 17:59:41
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 18:04:42
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x0000164A
    Time Generated: 01/18/2015 18:05:10
    Event String:
    The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 18:09:42
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 18:14:42
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 18:19:43
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    An error event occurred. EventID: 0x00000422
    Time Generated: 01/18/2015 18:24:43
    Event String:
    The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
    ......................... CC-DC03 failed test SystemLog
    EVENT VIEWER LOGS
    The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and is waiting to perform initial replication. The replicated folder will remain in the initial synchronization state until it has replicated with its partner CC-DC01.cloudchowk.lab. If the server was in the process of being promoted to a domain controller, the domain controller will not advertize and function as a domain controller until this issue is resolved. This can occur if the specified partner is also in the initial synchronization state, or if sharing violations are encountered on this server or the synchronization partner. If this event occurred during the migration of SYSVOL from File Replication service (FRS) to DFS Replication, changes will not replicate out until this issue is resolved. This can cause the SYSVOL folder on this server to become out of sync with other domain controllers.
    Additional Information:
    Replicated Folder Name: SYSVOL Share
    Replicated Folder ID: 4689406D-D6D8-49E0-8079-2B1D4AE61BC6
    Replication Group Name: Domain System Volume
    Replication Group ID: 6B162096-2EFA-4D4C-BF13-62CC5B112B97
    Member ID: 566943F9-D2FB-4304-823D-10DC972F831A
    Read-Only: 0
    Should I just start over again by removing DC03 and setting up another DC?
    Regards
    Sajat Jain

  • Create a VMware snapshot before promoting domain controller

    Dear expert,
    I have created a new guest OS in VMware ESXi 4.1 according to the following procedures:-
    1. Install windows 2008 R2 standard
    2. Configure network information
    3. Join the server to the domain
    4. Run windows update
    As I will promote the member server to domain controller.  Therefore, I have taken the snapshot for the member server before running dcpromo.  The aim of the snapshot is to make it easier to fall back if the promotion screws up.
    When the promotion screws up, I will perform the following steps to re-promote the member server to domain controller.
    1. Restore snapshot for the member server
    2. May need to execute metadata clean up for the member server on existing domain controllers
    3. Re-run dcpromo to re-promote the member server to domain controller.
    I would like to know if the above procedures are correct when the promotion screws up.
    Thank you for your kind assistance.

    Dear expert,
    I would like to know if the above procedures are correct when the promotion screws up.
    Thank you for your kind assistance.
    I can not represent a positive response to this procedure. When you join a computer to the domain, the computer establish a live connection with the domain controller which is called Secure Channel. Imaging and cloning is one of the things which break the
    secure channel. Since you are using 2008 R2, the imaging/cloning procedure will be problematic for you now or near future. So I do not recommend it.
    If you have 10 computers or so in your whole domain it may be possible to do so because troubleshooting 10 computers in a domain is not a difficult task.
    One thing to keep in mind is that promoting a domain controller is enough important which you should not do things like that about it. If everything goes bad during the promotion you may just need a metadata cleanup (rarely), so what is the point of cloning?
    At worst you do a re-install of Windows. I prefer it this way.
    Mahdi Tehrani   |  
      |  
    www.mahditehrani.ir
    Please click on Propose As Answer or to mark this post as
    and helpful for other people.
    This posting is provided AS-IS with no warranties, and confers no rights.
    How to query members of 'Local Administrators' group in all computers?

  • ISSUE: "This domain controller must register a DNS SRV resource record, which is required for replication to function correctly"

    so we currently have three domain controllers set up, two of them on 2012r2 and one of them on 2008r2. prior to any of these domain controllers being added to the domain there was only one, running on 2003r2. the 2003r2 server was up and running when the
    first 2012r2 was added and that's when running 'dcdiag /e /c /v' would yield an issue with "_ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local" in the DNS portion of the diagnostics, specifically:
    TEST: Records registration (RReg)
    Network Adapter [00000010] Microsoft Hyper-V Network Adapter:
    Error:
    Missing SRV record at DNS server 192.168.22.4:
    _ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local
    after adding the second 2012r2 to the domain, this issue is still there... adding the 2008r2 server to the domain and running BPA it gives the following:
    Title:
    This domain controller must register a DNS SRV resource record, which is required for replication to function correctly
    Severity:
    Error
    Date:
    7/3/2014 11:24:48 AM
    Category:
    Configuration
    Issue:
    The "DcByGuid" DNS service (SRV) resource record that advertises this server as an available domain controller in the domain and ensures correct replication is not registered. All domain controllers (but not RODCs) in the domain must register this record.
    Impact:
    Other member computers and domain controllers in the domain or forest will not be able to locate this domain controller. This domain controller will not be able to provide a full suite of services.
    Resolution:
    Ensure that "DcByGuid" is not configured in the "DnsAvoidRegisteredRecords" list, either through Group Policy or through the registry. Restart the Netlogon service. Verify that the DNS service (SRV) resource record "_ldap._tcp.9a5f3c17-e7ac-48f7-ab42-bf1ea621a6f5.domains._msdcs.cmedia.local", pointing to the local domain controller "CM-DC4-NY01.cmedia.local", is registered in DNS.
    More information about this best practice and detailed resolution procedures: http://go.microsoft.com/fwlink/?LinkId=126968
    I've tried scanning and then re-scanning every single entry in DNS Manager and do not see any reference to this specific GUID mentioned, nor do I see any other domain controllers referenced that should not be in there. The two 2012r2 and the 2008r2 domain
    controllers are the only ones listed in DNS Manager... the 2003r2 mentioned earlier failed and was removed.

    Just to chime in, I noticed that you said you have one 2008 R2 DC, and two 2012 DCs.
    I also noticed in the ipconfig /all that all DCs are pointint to themselves for DNS. We usually like to see them point to a partner, then itslelf as the second entry, w hether loopback or by its own IP.
    Based on that, what I suggest to level the playing field by choosing the WIndows 2008 R2 DC as the first DNS on all DCs and only administer DNS using that DC. The reason I chose that is because of the least common denominator is what we rather use so we
    don't invoke any new features in the newer 2012 DNS console that 2008 R2 may not understand.  After that's done, on each DC run (and you can use a PowerShell window to run this):
    Rename the system32\config\netlogon.dns and netlogon.dnb files by suffixing ".old" to the file.
    ipconfig /registerdns
    net stop netlogon
    net start netlogon
    Then re-run the dcdiag /e /c /v.
    Post your results, please.
    Ace Fekay
    MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
    This posting is provided AS-IS with no warranties or guarantees and confers no rights.
    I thought the DNS entries were supposed to be the other way around? point to themselves first and a partner as secondary? regardless, as requested, I've changed it to what you've prescribed where they point to the 2008r2 server as the primary with themselves
    as the secondary. I've also followed the steps to what seems like refreshing the DNS? on each of the DCs. Here's the output from dcdiag /e /c /v
    Directory Server Diagnosis
    Performing initial setup:
    Trying to find home server...
    * Verifying that the local machine CM-DC1-NY01, is a Directory Server.
    Home Server = CM-DC1-NY01
    * Connecting to directory service on server CM-DC1-NY01.
    * Identified AD Forest.
    Collecting AD specific global data
    * Collecting site info.
    Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=cmedia,DC=local,LDAP_SCOPE_SUBTREE,(objectCategory
    =ntDSSiteSettings),.......
    The previous call succeeded
    Iterating through the sites
    Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia
    ,DC=local
    Getting ISTG and options for the site
    * Identifying all servers.
    Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=cmedia,DC=local,LDAP_SCOPE_SUBTREE,(objectClass=nt
    DSDsa),.......
    The previous call succeeded....
    The previous call succeeded
    Iterating through the list of servers
    Getting information for the server CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    Getting information for the server CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    Getting information for the server CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites
    ,CN=Configuration,DC=cmedia,DC=local
    objectGuid obtained
    InvocationID obtained
    dnsHostname obtained
    site info obtained
    All the info for the server collected
    * Identifying all NC cross-refs.
    * Found 3 DC(s). Testing 3 of them.
    Done gathering initial info.
    Doing initial required tests
    Testing server: Default-First-Site-Name\CM-DC1-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC1-NY01 passed test Connectivity
    Testing server: Default-First-Site-Name\CM-DC3-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC3-NY01 passed test Connectivity
    Testing server: Default-First-Site-Name\CM-DC4-NY01
    Starting test: Connectivity
    * Active Directory LDAP Services Check
    Determining IP4 connectivity
    * Active Directory RPC Services Check
    ......................... CM-DC4-NY01 passed test Connectivity
    Doing primary tests
    Testing server: Default-First-Site-Name\CM-DC1-NY01
    Starting test: Advertising
    The DC CM-DC1-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC1-NY01 is advertising as an LDAP server
    The DC CM-DC1-NY01 is advertising as having a writeable directory
    The DC CM-DC1-NY01 is advertising as a Key Distribution Center
    The DC CM-DC1-NY01 is advertising as a time server
    The DS CM-DC1-NY01 is advertising as a GC.
    ......................... CM-DC1-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC1-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local
    * SPN found :LDAP/CM-DC1-NY01
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :LDAP/a29d12f1-2869-44bf-8e43-adf7ddf33865._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/a29d12f1-2869-44bf-8e43-adf7ddf33865/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local
    * SPN found :HOST/CM-DC1-NY01
    * SPN found :GC/CM-DC1-NY01.cmedia.local/cmedia.local
    [CM-DC1-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC1-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC1-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC1-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC1-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC1-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC1-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC1-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC1-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC1-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local
    * SPN found :LDAP/CM-DC1-NY01
    * SPN found :LDAP/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :LDAP/a29d12f1-2869-44bf-8e43-adf7ddf33865._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/a29d12f1-2869-44bf-8e43-adf7ddf33865/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC1-NY01.cmedia.local
    * SPN found :HOST/CM-DC1-NY01
    * SPN found :HOST/CM-DC1-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC1-NY01.cmedia.local/cmedia.local
    ......................... CM-DC1-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC1-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC1-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC1-NY01\netlogon
    Verified share \\CM-DC1-NY01\sysvol
    ......................... CM-DC1-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC1-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC1-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC1-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC1-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 4609 to 5108
    * rIDPreviousAllocationPool is 4609 to 5108
    * rIDNextRID: 4629
    ......................... CM-DC1-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC1-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    A warning event occurred. EventID: 0x0000002F
    Time Generated: 07/08/2014 13:19:14
    Event String:
    Time Provider NtpClient: No valid response has been received from manually configured peer 0.ca.pool.ntp.org
    after 8 attempts to contact it. This peer will be discarded as a time source and NtpClient will attempt to discover a n
    ew peer with this DNS name. The error was: The peer is unreachable.
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC1-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC1-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC1-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC1-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC1-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC1-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC1-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC1-NY01 passed test VerifyReplicas
    Testing server: Default-First-Site-Name\CM-DC3-NY01
    Starting test: Advertising
    The DC CM-DC3-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC3-NY01 is advertising as an LDAP server
    The DC CM-DC3-NY01 is advertising as having a writeable directory
    The DC CM-DC3-NY01 is advertising as a Key Distribution Center
    The DC CM-DC3-NY01 is advertising as a time server
    The DS CM-DC3-NY01 is advertising as a GC.
    ......................... CM-DC3-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC3-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local
    * SPN found :LDAP/CM-DC3-NY01
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :LDAP/5e9d1971-39ca-484c-922d-411c2364c96e._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e9d1971-39ca-484c-922d-411c2364c96e/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local
    * SPN found :HOST/CM-DC3-NY01
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC3-NY01.cmedia.local/cmedia.local
    Checking for CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 2 servers
    Object is up-to-date on all servers.
    [CM-DC3-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC3-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC3-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC3-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC3-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC3-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC3-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC3-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC3-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC3-NY01 on DC CM-DC3-NY01.
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local
    * SPN found :LDAP/CM-DC3-NY01
    * SPN found :LDAP/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :LDAP/5e9d1971-39ca-484c-922d-411c2364c96e._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e9d1971-39ca-484c-922d-411c2364c96e/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC3-NY01.cmedia.local
    * SPN found :HOST/CM-DC3-NY01
    * SPN found :HOST/CM-DC3-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC3-NY01.cmedia.local/cmedia.local
    ......................... CM-DC3-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC3-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC3-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC3-NY01\netlogon
    Verified share \\CM-DC3-NY01\sysvol
    ......................... CM-DC3-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC3-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC3-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC3-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC3-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 15109 to 15608
    * rIDPreviousAllocationPool is 15109 to 15608
    * rIDNextRID: 15110
    ......................... CM-DC3-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC3-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC3-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC3-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC3-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC3-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC3-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC3-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC3-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC3-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC3-NY01 passed test VerifyReplicas
    Testing server: Default-First-Site-Name\CM-DC4-NY01
    Starting test: Advertising
    The DC CM-DC4-NY01 is advertising itself as a DC and having a DS.
    The DC CM-DC4-NY01 is advertising as an LDAP server
    The DC CM-DC4-NY01 is advertising as having a writeable directory
    The DC CM-DC4-NY01 is advertising as a Key Distribution Center
    The DC CM-DC4-NY01 is advertising as a time server
    The DS CM-DC4-NY01 is advertising as a GC.
    ......................... CM-DC4-NY01 passed test Advertising
    Starting test: CheckSecurityError
    * Dr Auth: Beginning security errors check!
    Found KDC CM-DC1-NY01 for domain cmedia.local in site Default-First-Site-Name
    Checking machine account for DC CM-DC4-NY01 on DC CM-DC1-NY01.
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local
    * SPN found :LDAP/CM-DC4-NY01
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :LDAP/37830012-1f10-43c9-a0ff-2a0e8a912187._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/37830012-1f10-43c9-a0ff-2a0e8a912187/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local
    * SPN found :HOST/CM-DC4-NY01
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC4-NY01.cmedia.local/cmedia.local
    Checking for CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 2 servers
    Object is up-to-date on all servers.
    [CM-DC4-NY01] No security related replication errors were found on this DC! To target the connection to a
    specific source DC use /ReplSource:<DC>.
    ......................... CM-DC4-NY01 passed test CheckSecurityError
    Starting test: CutoffServers
    * Configuration Topology Aliveness Check
    * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the alive system replication topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC4-NY01 passed test CutoffServers
    Starting test: FrsEvent
    * The File Replication Service Event log test
    ......................... CM-DC4-NY01 passed test FrsEvent
    Starting test: DFSREvent
    The DFS Replication Event Log.
    Skip the test because the server is running FRS.
    ......................... CM-DC4-NY01 passed test DFSREvent
    Starting test: SysVolCheck
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC4-NY01 passed test SysVolCheck
    Starting test: FrsSysVol
    * The File Replication Service SYSVOL ready test
    File Replication Service's SYSVOL is ready
    ......................... CM-DC4-NY01 passed test FrsSysVol
    Starting test: KccEvent
    * The KCC Event log test
    Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
    ......................... CM-DC4-NY01 passed test KccEvent
    Starting test: KnowsOfRoleHolders
    Role Schema Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role Domain Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
    guration,DC=cmedia,DC=local
    Role PDC Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Rid Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configur
    ation,DC=cmedia,DC=local
    Role Infrastructure Update Owner = CN=NTDS Settings,CN=CM-DC1-NY01,CN=Servers,CN=Default-First-Site-Name,CN
    =Sites,CN=Configuration,DC=cmedia,DC=local
    ......................... CM-DC4-NY01 passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    Checking machine account for DC CM-DC4-NY01 on DC CM-DC4-NY01.
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local
    * SPN found :LDAP/CM-DC4-NY01
    * SPN found :LDAP/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :LDAP/37830012-1f10-43c9-a0ff-2a0e8a912187._msdcs.cmedia.local
    * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/37830012-1f10-43c9-a0ff-2a0e8a912187/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia.local
    * SPN found :HOST/CM-DC4-NY01.cmedia.local
    * SPN found :HOST/CM-DC4-NY01
    * SPN found :HOST/CM-DC4-NY01.cmedia.local/cmedia
    * SPN found :GC/CM-DC4-NY01.cmedia.local/cmedia.local
    ......................... CM-DC4-NY01 passed test MachineAccount
    Starting test: NCSecDesc
    * Security Permissions check for all NC's on DC CM-DC4-NY01.
    The forest is not ready for RODC. Will skip checking ERODC ACEs.
    * Security Permissions Check for
    DC=ForestDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    DC=DomainDnsZones,DC=cmedia,DC=local
    (NDNC,Version 3)
    * Security Permissions Check for
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    (Schema,Version 3)
    * Security Permissions Check for
    CN=Configuration,DC=cmedia,DC=local
    (Configuration,Version 3)
    * Security Permissions Check for
    DC=cmedia,DC=local
    (Domain,Version 3)
    ......................... CM-DC4-NY01 passed test NCSecDesc
    Starting test: NetLogons
    * Network Logons Privileges Check
    Verified share \\CM-DC4-NY01\netlogon
    Verified share \\CM-DC4-NY01\sysvol
    ......................... CM-DC4-NY01 passed test NetLogons
    Starting test: ObjectsReplicated
    CM-DC4-NY01 is in domain DC=cmedia,DC=local
    Checking for CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local in domain DC=cmedia,DC=local o
    n 3 servers
    Object is up-to-date on all servers.
    Checking for CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuratio
    n,DC=cmedia,DC=local in domain CN=Configuration,DC=cmedia,DC=local on 3 servers
    Object is up-to-date on all servers.
    ......................... CM-DC4-NY01 passed test ObjectsReplicated
    Starting test: OutboundSecureChannels
    * The Outbound Secure Channels test
    ** Did not run Outbound Secure Channels test because /testdomain: was not entered
    ......................... CM-DC4-NY01 passed test OutboundSecureChannels
    Starting test: Replications
    * Replications Check
    * Replication Latency Check
    DC=ForestDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=DomainDnsZones,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Schema,CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    CN=Configuration,DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    DC=cmedia,DC=local
    Latency information for 4 entries in the vector were ignored.
    4 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's
    no longer replicating this nc. 0 had no latency information (Win2K DC).
    ......................... CM-DC4-NY01 passed test Replications
    Starting test: RidManager
    * Available RID Pool for the Domain is 16109 to 1073741823
    * CM-DC1-NY01.cmedia.local is the RID Master
    * DsBind with RID Master was successful
    * rIDAllocationPool is 15609 to 16108
    * rIDPreviousAllocationPool is 15609 to 16108
    * rIDNextRID: 15609
    ......................... CM-DC4-NY01 passed test RidManager
    Starting test: Services
    * Checking Service: EventSystem
    * Checking Service: RpcSs
    * Checking Service: NTDS
    * Checking Service: DnsCache
    * Checking Service: NtFrs
    * Checking Service: IsmServ
    * Checking Service: kdc
    * Checking Service: SamSs
    * Checking Service: LanmanServer
    * Checking Service: LanmanWorkstation
    * Checking Service: w32time
    * Checking Service: NETLOGON
    ......................... CM-DC4-NY01 passed test Services
    Starting test: SystemLog
    * The System Event log test
    Found no errors in "System" Event log in the last 60 minutes.
    ......................... CM-DC4-NY01 passed test SystemLog
    Starting test: Topology
    * Configuration Topology Integrity Check
    * Analyzing the connection topology for DC=ForestDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=DomainDnsZones,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Schema,CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for CN=Configuration,DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    * Analyzing the connection topology for DC=cmedia,DC=local.
    * Performing upstream (of target) analysis.
    * Performing downstream (of target) analysis.
    ......................... CM-DC4-NY01 passed test Topology
    Starting test: VerifyEnterpriseReferences
    ......................... CM-DC4-NY01 passed test VerifyEnterpriseReferences
    Starting test: VerifyReferences
    The system object reference (serverReference) CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local
    and backlink on
    CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cmedia,DC=local are
    correct.
    The system object reference (serverReferenceBL)
    CN=CM-DC4-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on
    CN=NTDS Settings,CN=CM-DC4-NY01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=chiefmed
    ia,DC=local
    are correct.
    The system object reference (frsComputerReferenceBL)
    CN=CM-DC4-NY01,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=cmedia,D
    C=local
    and backlink on CN=CM-DC4-NY01,OU=Domain Controllers,DC=cmedia,DC=local are correct.
    ......................... CM-DC4-NY01 passed test VerifyReferences
    Starting test: VerifyReplicas
    ......................... CM-DC4-NY01 passed test VerifyReplicas

  • Required FSMO Roles to Bring up Domain Controller

    I have an unusual situation.  Our network team is moving to a new vendor for our WAN circuits and this change which has left our network split. I have 10 domain controllers which can't talk to the other seven domain controllers. This situation
    will last about another 2 months.
    I have been asked to bring up an RODC domain controller in a location which can't connect to the DC which hosts the FSMO roles, but has communication with seven domain controllers.
    Is this possible?  What FSMO roles are required to bring up a DC?
    Thanks
    LRL

    In a worse case scenario, replication may fail between domain controllers when a WAN link is re-established:
    http://pmeijden.wordpress.com/2011/01/12/domain-replication-has-exceeded-the-tombstone-lifetime/
    "This can also happen when your network isn’t working properly or when replication error’s have occurred for to long without anyone noticing them. In large environments it’s possible that a complete site has been disconnected due to unavailable WAN
    connections. [...]
    The reason why the domain controllers will not continue the replication is because they are protected for so called Lingering Objects. For example, one or more objects that are deleted from Active Directory on all other domain controllers might remain on
    the disconnected domain controller. Such objects are called Lingering Objects. Because the domain controller is offline during the entire time that the tombstone is alive, the domain controller never receives replication of the tombstone and therefor doesn’t
    know that the object has been deleted."
    If your tombstone lifetime is still 60 days (the original default), that is about 2 months.
    You can check like this:
    http://technet.microsoft.com/en-us/library/cc784932(v=ws.10).aspx
    If it is 180 days (new default - I won't go into the details of how and when this changed), you may avoid the worse case scenario. But you still might have problems.
    Two months... how much time has already passed?
    Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

  • Domain controller environment do we required CAL's license ?

    Domain controller environment do we required CAL's license?
    Do I need any licensing to connect workstations to a domain?
     Where we have License for the AD Server (2008 /2012 )  and there License of  client os (windows 7/ windows 8 ) still we required the CAL's license DC ?
    I have a server running Windows Server 2012. I want to turn this into a domain controller. In order to connect my workstations to my server

    Hi,
    on this link:
    http://www.microsoft.com/licensing/about-licensing/windowsserver2012-r2.aspx#tab=4 we have the following:
    Client Access Licenses (CALs) are required for each user or device accessed. The Windows Server 2012 related CALs provide entitlement to access and use Windows 2012 R2 functionality.
    on th emultiplexing link:
    http://www.microsoft.com/licensing/about-licensing/briefs/multiplexing.aspx you can download th ePDF data who is mentioned that:
    "Multiplexing does not reduce the number of Microsoft licenses required. Users are required to have the appropriate licenses, regardless of their
    direct or indirect connection to the product. Any user or device that accesses the server, files, or data or content provided by the server that is made available through an automated process requires a CAL."
    thanks
    diramoh

  • Lack of Connectivty to Domain Controller - Domain Controller Access Issues Requires Repeated Reauthentication

    Sorry if my attempt to be thorough in my description may result in excessive and unnecessary information. 
    I'm running into some problems with a single server running WS 2012 R2 as a domain controller (AD and DNS) and I’m trying to figure out what the cause is. 
    The network has ~10 computers on it connected through a cable business gateway (running DHCP) which feeds 2 switches and a wireless router acting as a switch. (I also turned on remote services, but the end users aren’t using that until I get certificates
    setup.)
    For 6+ months everyone had access to the shared files and databases on each workstation without issue. 
    In the last month users would occasionally have to re-enter their credentials to get access to shared server folders despite being on a domain account already. 
    Last week one of the computers intermittently cannot gain access to the shared folders– entering the correct credentials just results in the credentials being requested again and again: There’s an error icon at the bottom saying that “there are currently
    no logon servers available to service the logon request”.  While access is rejected I’m still able to ping the DC both via its name and IPV4 address. 
    (Pinging via its name results in an IPv6 address in the response.) 
    Other network connectivity appears intact (able to browse the web, perform network discovery.)
    Things that ‘seem’ to allow access on this computer until the next failure:
    Entering a different domain username and password into the windows credentials request has allowed access a couple of times.
    Disconnecting and reconnecting the network cable allowed the original username to be used to log on (at least once.)
    After removing it from and then rejoining it to the domain (a few hours ago) it experienced the problem once more. Also, logging on with domain credentials created a TEMP user folder instead of the folder with the domain username. 
    Looking at the event logs, I notice there are quite a few warnings and errors reported regarding DC access on many of the computers; maybe this is normal?
    Most Problematic Computer:
    Event ID 8016:  System failed to register host A or AAAA resource records. (With an unknown Ipv6 and the server’s ipv4 address in the DNS server list.) 
    Event ID 131:  NtpClient unable to set a domain peer to use as a time source because of DNS resolution error on ‘Server.domain.local’ 
    ‘No such host is known.”
    Event ID 5719:  NETLOGON. This computer was not able to setup a secure session with a domain controller in the domain due …..: there are currently no logon servers available to service the logon request.
    And then pairs of: Event 1500: The Group Policy settings for the computer were processed successfully. There were no changes detected since the last successful processing of Group Policy. & Event 1054:
     The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.
    Event 1030:  The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation
    at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.
    On the server I’ve run DCDIAG and DCDIAG /test:DNS and those all appeared to pass.
    Ipconfig/all from the server:
       Connection-specific DNS Suffix 
       Description . . . . . . . . . . . : Intel(R) Ethernet Connection I217-LM
       Physical Address. . . . . . . . . : FC-4D-D4-F2-A1-83
       DHCP Enabled. . . . . . . . . . . : No
       Autoconfiguration Enabled . . . . : Yes
       IPv6 Address. . . . . . . . . . . : 2601:8:a182:1100:b155:a0b0:892d:9ed5(Pref
    erred)
       Link-local IPv6 Address . . . . . : fe80::b155:a0b0:892d:9ed5%13(Preferred)
       IPv4 Address. . . . . . . . . . . : 10.1.10.42(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : fe80::abd:43ff:fe9a:ab47%13
     10.1.10.1
       DHCPv6 IAID . . . . . . . . . . . : 234638804
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-3F-7D-B9-68-05-CA-24-31-C4
       DNS Servers . . . . . . . . . . . : ::1
    127.0.0.1
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Ipconfig/all from the problematic computer:
    Wireless LAN adapter Wi-Fi:
       Connection-specific DNS Suffix 
    . : wp.comcast.net
       Description . . . . . . . . . . . : Intel(R) Centrino(R) Wireless-N 6150
       Physical Address. . . . . . . . . : 40-25-C2-63-C2-B8
       DHCP Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       IPv6 Address. . . . . . . . . . . : 2601:8:a182:1100:8f5:1606:d0a8:6b25(Prefe
    rred)
       Temporary IPv6 Address. . . . . . : 2601:8:a182:1100:283e:f9e8:4841:6c50(Pref
    erred)
       Link-local IPv6 Address . . . . . : fe80::8f5:1606:d0a8:6b25%3(Preferred)
       IPv4 Address. . . . . . . . . . . : 10.1.10.31(Preferred)
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Lease Obtained. . . . . . . . . . : Tuesday, March 10, 2015 9:19:02 AM
       Lease Expires . . . . . . . . . . : Tuesday, March 17, 2015 1:23:15 PM
       Default Gateway . . . . . . . . . : fe80::abd:43ff:fe9a:ab47%3
    10.1.10.1
       DHCP Server . . . . . . . . . . . : 10.1.10.1
       DHCPv6 IAID . . . . . . . . . . . : 54535618
       DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1B-15-6B-AA-F0-DE-F1-9C-07-D4
       DNS Servers . . . . . . . . . . . : 2001:558:feed::1
    2001:558:feed::2
                    10.1.10.42
       NetBIOS over Tcpip. . . . . . . . : Enabled
    Any thoughts? I was assuming it was a Domain Controller/DNS error, but I don't know where to check next.  Could a failing piece of hardware be the culprit? 
    Thanks,
     -JT

    Hi,
    According to the error you have posted.
    A Netlogon 5719 event indicates that the client component of Netlogon was unable to locate a DC for the domain it was trying to perform an operation against.
    Most of the time this is caused by network issues or name resolution (DNS/WINS) issues, you could refer to:
    Netlogon 5719 and the Disappearing Domain [Controller]
    http://blogs.technet.com/b/instan/archive/2008/09/18/netlogon-5719-and-the-disappearing-domain.aspx
    Did you refer to this KB article?
    Event ID 5719 is logged when you start a Domain Member
    http://support.microsoft.com/kb/938449
    Regards.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Maybe you are looking for

  • How can I create own side menu in DW

    I have created a sample below of what I am trying to achieve... Problems I have: 1) H2 text in menu wraps around when there is no need. 2) need to have blue menus change on hover. 3) need to have content in document area load on clicking the menu sec

  • Safari 7.0.4 will not allow Acrobat to open PDF files, Works ok with Chrome?

    I cannot open PDF files with Acrobat using Safari 7.0.4 No problem if I use Chrome Help

  • USB 3.0 driver not working

    Laptop HP Pavilion dv6-6140us OS Widnows 7 64-bit I wipe my hard disk and loaded stock windows 7, downloaded all the drivers from HP and my USB 3.0 ports still wont work. In the device manager I can see them under other devices listed as Universal Se

  • FTP won't connect Get multiple daemons

    I had the problem where no one could connect with any password in FTP. I replaced the /Library/FTPServer/Configuration/ftpaccess file and fixed the bad password problem. For a few minutes I could connect. Now I cannot. When I try to connect I get: ++

  • Function parameter

    Hi I write a function who accept a record as parameter. a nested table is defined in the record. I initialize this record under forms 6. when a call a function in a package with the record as parameter it doesn't work. I can't find why. Could someone