SQL MP - SPN Status monitor weird behaviour

Question

Hi all,
I have a strange behaviour with the monitor that checks SQL 2008 SPN status. More precisely I have a weird behaviour with the script used by the monitor. The script is GetSQL2008SPNState.vbs. I configured the SQL monitoring profile (which is used by the
script) with a domain account with necessary rights.
Let's say I have a SQL Server called SQL1. SQL1 is in domain AD1. I have a forest called contoso.com with two child domains AD1 and AD2.
On SQL1 I sometimes see events 4001 generated by this script that mentions a problem to connect to WMI namespace (which is healthy, I checked with wbemtest). The event says that it couldn't connect to
\\SQL1.AD1.contoso.com.AD2.contoso.com\root\blabla. I have no idea why it is using that broken FQDN.
I made some research into the script and understood the following:
The script has the SQL server FQDN as parameter (here SQL1.AD1.contoso.com)
It searches the defaultnamingcontext by doing
 Set oRootDse = GetObject("GC://RootDSE)
 sRootnamingContext = oRootDse.Get("defaultNamingContext")
It converts the defaultnamingcontext variable from "DC=a,DC=b,DC,c" to ".a.b.c"
It checks if the defaultnamingcontext is in the fqdn and if not it appends it at the end of the fqdn. Dunno if I'm clear here so here are examples of good and bad behaviours:
GOOD:
FQDN is SQL1.AD1.contoso.com, defaultnamingcontext gives AD1.contoso.com, AD1.contoso.com is in SQL1.AD1.contoso.com so the script go on using SQL1.AD1.contoso.com and it's ok...
BAD:
FQDN is SQL1.AD1.contoso.com, defaultnamingcontext gives AD2.contoso.com, AD2.contoso.com is not in SQL1.AD1.contoso.com so the script go on using SQL1.AD1.contoso.com.AD2.contoso.com and it's broken...
I didn't mention earlier but the runas account I use is from domain AD1. It's called AD1\svc_scom_mp
My question is how comes sometimes (sometimes means during 6 hours, a whole day, nothing reccurent :( ) The defaultnamingcontext gives me the fqdn of the other domain ??
I'm wondering if this can be due to the fact that I also have an account called svc_scom_mp in AD2 but I'm 100% sure it's not used here as it's not targeted nor distributed to any AD1 computers.
I guess it's more an AD problem than anything else.
Any ideas ?
<a href="http://myitforum.com/cs2/blogs/fdufour/default.aspx">Supervize Me ©</a>

Answer 1

Hi François
I tested GetSQL2008SPNState.vbs on my POC with a similar configuration (one root and two child domains) and i have got the same issue. I think the root cause is the Server less binding (GC://RootDSE) used to search defaultNamingContext.
With Server less binding, GC name relies on
DNS round robin to find a GC, if a GC from another domain is returned the defaultNamingContext will be the other domain.
You can check GC resolution with nslookup:
nslookup gc._msdcs.contoso.com  (the root domain)
repeat the command to see the round robin result.
I wrote a vbscript to test it:
This script search all GC and search defaultNamingContext with GC provider server less and server name binding. With LDAP Provider the right domain name is always returned.
=============================
ldapFilter = "(&(objectClass=nTDSDSA)(options:1.2.840.113556.1.4.803:=1))"
Set rootDSE = GetObject("LDAP://rootDSE")
configDN =   rootDSE.Get("configurationNamingContext")
Set ado = CreateObject("ADODB.Connection")
ado.Provider = "ADSDSOObject"
ado.Open "ADSearch"
Set objectList =   ado.Execute("<LDAP://" &configDN& ">;" & ldapFilter & ";distinguishedName;subtree")
' GC Server less binding LDAP
      Set oRootDse = GetObject("LDAP://RootDSE")
      If Not (oRootDse Is Nothing) Then
            sDefaultNamingContext = oRootDse.Get("defaultNamingContext")
            wscript.echo "Server less binding:
LDAP://RootDSE"
            wscript.echo "   DefaultNamingContext found: " & sDefaultNamingContext
             wscript.echo " "
      Else
            wscript.echo "   NOT found: "
      End If
' GC Server less binding  GC
      Set oRootDse = GetObject("GC://RootDSE")
      If Not (oRootDse Is Nothing) Then
            sDefaultNamingContext = oRootDse.Get("defaultNamingContext")
            wscript.echo "Server less binding: GC://RootDSE"
            wscript.echo "   DefaultNamingContext found: " & sDefaultNamingContext
             wscript.echo " "
      Else
            wscript.echo "   NOT found: "
      End If
wscript.echo "Server Name binding: GC://<ServerName>/RootDSE"
While Not objectList.EOF
    nTSDSA = objectList.Fields("distinguishedName")
    serverDN = Mid(nTSDSA, 18)                                        
    Set serverObj = GetObject("LDAP://" & serverDN )
    WScript.Echo " GC name:" & serverObj.dNSHostName
    ' GC Server Binding
    Set oRootDse = GetObject("GC://" & serverObj.dNSHostName & "/RootDSE")
      If Not (oRootDse Is Nothing) Then
            sDefaultNamingContext = oRootDse.Get("defaultNamingContext")
            wscript.echo "   DefaultNamingContext found: " & sDefaultNamingContext
      Else
            wscript.echo "   NOT found: "
      End If
    wscript.echo " "
    objectList.MoveNext
Wend
======================================================
Cordialement