Intermittend DNS resolution, timeserver, group policy updates errors in client logs in Win 2012 R2 single server environement

Question

We recently switched hardware and server software Win SBS 2008 to 2012R2 for a small network roughly 40 clients (Win7 Pro / Win 8.1 Pro) about 16 running concurrently at a given time and one network printer with the printer queue residing on the DC as well.
I read that a single server environment might not be ideal in particular no fail-over but that is an accepted risk in this particular network here.
Errors:
Error 1043: Timeout during name resolution request
Error 1129: Group policy updates could not be processed due to DC not available
Error 5719: Could not establish secure connection to DC, DC not available
Occasionally but disappears after a while
Error 134: As a result of a DNS resolution timeout could not reach time server
Symptoms
On Win 7 Clients
Network shares added through Group Policy will not show sometimes
Network shares disconnect (red X) and when accessed return access authorization error after one or two clicks on the share finally grant access again
When the issue with accessing network shares occurs, it usually also affects Internet access meaning a 'server not responding' error appears in the browser windows when trying to open just any web page
nslookup during the incident returns cannot resolve error
ipconfig on client shows correct default router (VDSL Router) and DHCP / DNS Domain Controller
Also, the Win system log shows the above errors during these incidents, however, the nuimber of incidents vary from 20-30
On Win 8.1 Clients
Same as above with the slight variation for network shares apparently due to Server 2012 and Win 8.1 clients managing drive shares differently. However, network share refresh does not work with this clients. In most cases only a gpupdate /force returns
drive shares but usually only for the active session. After logoff / logon the shares are gone again.
The issue does appear to be load related since it occurs even if there are only one or two workstations active.
Server Configuration
Dell R320 PowerEdge 16GB / 4TB 7200RPM RAID10 / GBitEthernet
Zyxel 1910-48 Port Switch
VDSL 50Mbps Down / 20Mbps Up
Since the DC is the only local DNS and there are no plans to add another one or move DNS to another server, the DNS server is configured with this own address as preferred DNS with three DNS forwarders 1) VDSL Router 2) ISP DNS1 3) ISP DNS2
Currently only one Network card is active for problem determination reasons.
There appears to be no consensus concerning IPV6 enabled or disabled, I tried both with no apparent effect
I have set all network cards server and client to Full Duplex and the same speed, also disabled Offload functions within the adapter settings. Some but no consistent improvements.
Best Practice Analyzer Results
DNS server scavening not enabled
Root hint server XYZ must respond to NS queries for the root zone
More than one forwarding server should be configured (although 3 are configured)
NIC1 should be configured to use both a preferred and alternate DNS (there is only one DNS in this network)
I have found some instructions to apply changes to the clients through a host file but I would rather like to understand whether this DNS response time issue can be resolved on the server for example timing setting perhaps. Currently the DNS forwarders are
set to 3 second.
Since a few people have reported issues with DNS but most are working with multi DNS, DC environment I could not really apply any suggestions made there. perhaps there is anyone like me who is running a single server who has overcome or experience the same
issues. Any help would be appreciated

Answer 1

Hello Milos thx for your reply.. my comments below
1. What does it "switched"? You may mean migration or new installation. We do not know...
>> Switched is probably the incorrect term, replaced would be the appropriate wording. Before, there was a HP Proliant Server with SBS 2008 with distinct domain and now there is a Dell Server with MS 2012 R2 with a distinct domain. Client were
removed from one (SBS) domain and added to the new Server 2012 domain. Other components did not change for example same Network Switch or VDSL Router, Workstations and Printer
2. Two DCs are better alternative. Or backup very frequently. There are two groups of administrators. Those who have lost DC and those who will experience this disaster in near future.
>> Correct, and I am aware of that
3. NIC settings in W 7 and W 8.1, namely DNS points to DC (...and NOTHING else. No public IP or that of router DNS.))
>> Correct, this is how it's currently implemented. Clients point to DC for DHCP and DNS and Default Router, no public IP or DNS. The only references to ISP DNS exist on the VDSL Router itself as provided through ISP when establishing VDSL
Link and the list of Forwarders in the DNS Server configuration. However, I have just recently added the ISPs DNS as forwarders for test purposes and will probably learn tomorrow morning whether this had any effect for better or worse.
4. Do nslookup to RR on clients. RR branch is saying client basic info on LDAP parameters of AD.
>> Will post as soon as available
5. I do not use forwarders and the system works
>> Ok, does this mean it works for you in a similar or the same infrastructure setup or are you saying it is not required at all and I can remove any forwarder in a scenario like mine? If not required can you explain a bit more why it is not
required apart from that it does work for you that way?
6. DHCP should sit on DC (DHCP on router is disabled)
>> Correct, no other device is configured to provide DHCP service other than DC and DHCP is currently running on DC
7. NIC settings in DC points to itself (loopback address 127.0.0.1)
>> Are you sure this is still correct and does apply to Server 2012? I am reading articles stating that it should be the servers own IP but local loop or should this be added as alternate DNS in addition to the servers own IP?
8. Use IPCONFIG /FLUSHDNS whenever you change DNS settings.
>> OK, that was not done every time I changed some settings but I can do that next week. Reboot alone would not suffice, correct?
9. Test your system with dcdiag.
>> See result below
10. Share your findings.
Regards
Milos
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
  Home Server = GSERVER2
   * Identified AD Forest.
   Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\GSERVER2
      Starting test: Connectivity
         ......................... GSERVER2 passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\GSERVER2
      Starting test: Advertising
         ......................... GSERVER2 passed test Advertising
      Starting test: FrsEvent
         ......................... GSERVER2 passed test FrsEvent
      Starting test: DFSREvent
         ......................... GSERVER2 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... GSERVER2 passed test SysVolCheck
      Starting test: KccEvent
         ......................... GSERVER2 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... GSERVER2 passed test
         KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... GSERVER2 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... GSERVER2 passed test NCSecDesc
      Starting test: NetLogons
         ......................... GSERVER2 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... GSERVER2 passed test
         ObjectsReplicated
      Starting test: Replications
         ......................... GSERVER2 passed test Replications
      Starting test: RidManager
         ......................... GSERVER2 passed test RidManager
      Starting test: Services
         ......................... GSERVER2 passed test Services
      Starting test: SystemLog
         ......................... GSERVER2 passed test SystemLog
      Starting test: VerifyReferences
         ......................... GSERVER2 passed test VerifyReferences  
   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation
   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation
   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
   Running partition tests on : GS2
      Starting test: CheckSDRefDom
         ......................... GS2 passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... GS2 passed test CrossRefValidation  
   Running enterprise tests on : GS2.intra
      Starting test: LocatorCheck
         ......................... GS2.intra passed test LocatorCheck
      Starting test: Intersite
         ......................... GS2.intra passed test Intersite
Server:  gserver2.g2.intra
Address:  192.168.240.6
*** gserver2.g2.intra can't find g2: Non-existent domain
> gserver2
Server:  gserver2.g2.intra
Address:  192.168.240.6
g2.intra
        primary name server = gserver2.g2.intra
        responsible mail addr = hostmaster.g2.intra
        serial  = 443
        refresh = 900 (15 mins)
        retry   = 600 (10 mins)
        expire  = 86400 (1 day)
        default TTL = 3600 (1 hour)
> wikipedia.org
Server:  gserver2.g2.intra
Address:  192.168.240.6
Non-authoritative answer:
wikipedia.org   MX preference = 10, mail exchanger = polonium.wikimedia.org
wikipedia.org   MX preference = 50, mail exchanger = lead.wikimedia.org
polonium.wikimedia.org  internet address = 208.80.154.90
polonium.wikimedia.org  AAAA IPv6 address = 2620:0:861:3:208:80:154:90
lead.wikimedia.org      internet address = 208.80.154.89
lead.wikimedia.org      AAAA IPv6 address = 2620:0:861:3:208:80:154:89
Final benchmark results, sorted by nameserver performance:
 (average cached name retrieval speed, fastest to slowest)
  192.168.240.  6 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  + Cached Name   | 0,001 | 0,002 | 0,003 | 0,001 | 100,0 |
  + Uncached Name | 0,027 | 0,076 | 0,298 | 0,069 | 100,0 |
  + DotCom Lookup | 0,041 | 0,048 | 0,079 | 0,009 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
             gserver2.g2.intra
                Local Network Nameserver
  195.186.  4.162 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,022 | 0,023 | 0,025 | 0,000 | 100,0 |
  - Uncached Name | 0,025 | 0,071 | 0,274 | 0,065 | 100,0 |
  - DotCom Lookup | 0,039 | 0,040 | 0,043 | 0,001 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
                     cns8.bluewin.ch
           BLUEWIN-AS Swisscom (Schweiz) AG,CH
  195.186.  1.162 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,022 | 0,023 | 0,026 | 0,001 | 100,0 |
  - Uncached Name | 0,025 | 0,072 | 0,299 | 0,066 | 100,0 |
  - DotCom Lookup | 0,039 | 0,042 | 0,049 | 0,003 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
                     cns7.bluewin.ch
           BLUEWIN-AS Swisscom (Schweiz) AG,CH
    8.  8.  8.  8 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,033 | 0,040 | 0,079 | 0,011 | 100,0 |
  - Uncached Name | 0,042 | 0,113 | 0,482 | 0,097 | 100,0 |
  - DotCom Lookup | 0,049 | 0,079 | 0,192 | 0,039 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
             google-public-dns-a.google.com
                 GOOGLE - Google Inc.,US
  UTC: 2014-11-03, from 14:33:12 to 14:33:29, for 00:17,648
15: 40
192.168.240.  6 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  + Cached Name   | 0,001 | 0,002 | 0,004 | 0,000 | 100,0 |
  + Uncached Name | 0,025 | 0,074 | 0,266 | 0,063 | 100,0 |
  + DotCom Lookup | 0,042 | 0,048 | 0,075 | 0,007 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
             gserver2.g2.intra
                Local Network Nameserver
  195.186.  1.162 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,022 | 0,024 | 0,029 | 0,001 | 100,0 |
  - Uncached Name | 0,024 | 0,073 | 0,289 | 0,067 | 100,0 |
  - DotCom Lookup | 0,039 | 0,041 | 0,043 | 0,001 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
                     cns7.bluewin.ch
           BLUEWIN-AS Swisscom (Schweiz) AG,CH
  195.186.  4.162 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,022 | 0,024 | 0,029 | 0,001 | 100,0 |
  - Uncached Name | 0,025 | 0,073 | 0,286 | 0,065 | 100,0 |
  - DotCom Lookup | 0,041 | 0,066 | 0,180 | 0,037 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
                     cns8.bluewin.ch
           BLUEWIN-AS Swisscom (Schweiz) AG,CH
    8.  8.  8.  8 |  Min  |  Avg  |  Max  |Std.Dev|Reliab%|
  ----------------+-------+-------+-------+-------+-------+
  - Cached Name   | 0,033 | 0,038 | 0,077 | 0,009 | 100,0 |
  - Uncached Name | 0,042 | 0,105 | 0,398 | 0,091 | 100,0 |
  - DotCom Lookup | 0,049 | 0,066 | 0,141 | 0,025 | 100,0 |
  ---<-------->---+-------+-------+-------+-------+-------+
             google-public-dns-a.google.com
                 GOOGLE - Google Inc.,US
  UTC: 2014-11-03, from 14:39:59 to 14:40:12, for 00:13,363