Unable Active Domain Controller
Joining window 7 PC to the domain,I have already joined some machine in the domain, but few of them just unable to join, and it displays "Active Directory Domain Controller (AD DC) for the domain "mst"
could not be contacted.
The same typed name I used in other machines and work out though system is asking me to type it correctly
Your assistance will be highly appreciated.
Thanx in advance!
Hi GK Onyango,
The log file at: %SystemRoot%\debug\netsetup.log will give the detailed error information, I suggest to post the error information for support.
Besides, to solve this, you can manually set the DNS from the client in this way:
1. Open Network and Sharing Center.
2. Click “change adapter settings” then right click the adapter settings
3. Click properties and find the IP v4 item, input the DNS as the screenshot below:
Regards
Wade Liu
TechNet Community Support
Similar Messages
-
Adding a Server 2008 R2 Domain Controller at a remote site
Hello. I have been trying to set up a hot site at a remote location. The story is long and involved but a few weeks ago it seemed to be finally working. Our setup is two mirrored 2008 R2 servers at main site, mirrored with Double Take.
The hot site is the same except that so far I only had one server working. The two sites connected via site to site VPN.
About a week later our primary server basically crashed. At first it worked but very slowly. I was on vacation at the time and so I am not sure of the sequence of events, or exactly what errors were presented, but my associate first tried rebooting.
It took over 20 minutes to boot and then it said something to the effect that no domain controllers were available (not sure about this message). He then discovered that the server at the remote site had some fsmo roles assigned to it. He transferred
the roles to the primary at the main site and then demoted the remote server to a workstation (but still a domain member).
After that, rebooting the primary was much faster and everything at the primary site is working again. Now I want to set the remote site up again, but avoid the problem. The way I originally set up the remote server was to use an IFM file, generated
from our primary. This should have made the remote server a catalog server, with DNS (which it did), but as far as I know should not have transferred any fsmo roles.
The remote server(s) are wanted to be in the same domain as the primary. They will also be mirrored from the primary (with Double Take). If we had total failure at the main site, we wish to be able to immediately begin operations at the hot site
(after a fail over). I freely admit that I am swimming out of my depth here. I am not sure that I have selected the correct architecture or used the correct options in setting up the remote servers. I am looking for information about what
went wrong, and whether some other setup is more desirable.
Thanks for any help, Russ
RussPhilippe, thank you for you answers. I do not understand everything you said but I will address each point as best I can:
1. "In the remote site do you simply do a dcpromo / add the ADDS's role to make the server a active Domain Controller ?" Yes, but I use the method described at
http://technet.microsoft.com/en-us/library/cc753720(v=ws.10).aspx, The GUI method. At step #8 I specified to use advanced mode so I could use the IFM file.
2. "In your AD' Site and Service MMC, do you configured the remote site ?" R do not know what you mean by this. How does one configure the site as 'remote'?
3. "Do you added that remote server as a Global catalogue ?". Yes, when I built the IFM file I specified to add the global catalog.
4. "Do you added the PC in site 1, the IP of those DNS server in them ? (last of course) So the computer in the main site will talk to the remote server in case of a crash." I am not sure I understand this item. After the remote server
was added, all of the members of both domain servers automatically appeared in the DNS of all servers in the domain. I do not recall if the new items were last, but I expect that they would be.
I have since reviewed the happenings with my associate and have a little more information. The order of the problems and the actions taken are:
1. Our primary (production) system was still working but extremely slow, and he observed that the slowness was caused by a lot of traffic with the remote site. Rebooting the production server took over 25 minutes and the server to came up saying
that domain information was not available. After another 30 minutes or so he discovered that the domain data was now available and the server worked, but still slow.
2. He did not check to verify that roles were held by the remote server, but he transferred all roles from the remote to the production server using ntdsutil. I would expect that if the role was not held by the remote, the transfer command would have
shown that fact.
3. He then tried to demote the remote server but had an error that it could not be demoted because "the active directory service is missing mandatory configuration information".
4. He forcefully demoted the remote server.
5. After rebooting the production server again performance was slightly better but still slow (and the rebood was still very slow).
6. After some research he removed the remote domain controller's meta data from the production server and then rebooted the production server again.
At that point reboot was fast (under 5 minutes) and the production system was working at normal speed again.
All of the above leads me to believe that somehow the FSMO roles got added to, or moved to the remote site when I used the IFM file to create the new domain controller. However nothing I have read says that this should happen. I hope someone
here can give me a better answer as to what caused the problem, as I do not wish to interrupt our production system like this again.
Thank you, Russ
PS: Sorry for the delay in getting back to this but some other priorities took me away from it for a week.
Russ -
Forest trust unable to find Active Directory Domain Controller
I have two domains with a two-way forest trust. We'll call them ForestA and ForestB. They're on seperate subnets. ForestA's DCs are in one physical location. ForestB's DCs are in two locations, one of which is shared with A.
I'm unable to route traffic directly from the remote DC in ForestB to the subnet ForestA is on, so I created a new DC in ForestA that sits on the subnet ForestB uses (basically, I can't route between subnets via the wireless bridge between locations, but
can within the same location).
I found this: http://www.neomagick.net/zen/2008/11/30/using-dns-to-force-a-domain-trust-through-a-specific-domain-controller-dc/
I followed the instructions to set the new DC in forest A to be the only one the remote DC in forest B was aware of.
Nslookup ForestA.com resolves correctly to this DC, but I'm unable to validate the trust relationship, getting the error:
"Windows cannot find an Active Directory Domain Controller for the ForestA.com domain. Verify that an AD DC is available and then try again."
I'd appreciate any help.In the event viewer, have you found any event id's that corrospond with this error? Have you ensured all ports required are open? Windows firewall is correctly setup? NIC is properly configured?
Statement below taken from: http://technet.microsoft.com/en-us/library/cc961803.aspx
If you receive the following error, ERROR_NO_LOGON_SERVERS while using the Nltest tool to query the secure channel, this is usually indicative of the inability to find a domain controller for that domain. Run nltest /dsgetdc: < DomainName > : to verify
whether you can locate a domain controller. If you are unable to find a domain controller examine DNS registrations and network connectivity.
ADDS Ports:
http://msdn.microsoft.com/en-us/library/dd772723(v=ws.10).aspx -
Help with setting up active directory domain controller/DNS - need this for Clustering
Disclaimer: I am new to Active Directory, so please dont rule out the obvious things I may have overlooked.
I need to set up Active Directory Domain controller on at least one server so I can run clustering. I set up the domain controller and ran Cluster validation and that failed - unable to reach writable domain controller.
When I look at my server manager AD DS complain about DNS:
NASE-2012-234 4015 Error Microsoft-Windows-DNS-Server-Service DNS Server 1/14/2014 12:54:06 AM
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
When I click on DNS this is the error:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.
Output of DCDiag -v is below.
PS C:\Users\Administrator> dcdiag -v
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
* Verifying that the local machine NASE-2012-234, is a Directory Server.
Home Server = NASE-2012-234
* Connecting to directory service on server NASE-2012-234.
* Identified AD Forest.
Collecting AD specific global data
* Collecting site info.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=
ntDSSiteSettings),.......
The previous call succeeded
Iterating through the sites
Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lab,DC=nas
e,DC=com
Getting ISTG and options for the site
* Identifying all servers.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=lab,DC=nase,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntD
SDsa),.......
The previous call succeeded....
The previous call succeeded
Iterating through the list of servers
Getting information for the server CN=NTDS Settings,CN=NASE-2012-234,CN=Servers,CN=Default-First-Site-Name,CN=Sites,C
N=Configuration,DC=lab,DC=nase,DC=com
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\NASE-2012-234
Starting test: Connectivity
* Active Directory LDAP Services Check
The host c0c507c4-fb9b-49a6-9a01-ef79d7960c94._msdcs.lab.nasecom could not be resolved to an IP address.
Check the DNS server, DHCP, server name, etc.
Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
......................... NASE-2012-234 failed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\NASE-2012-234
Skipping all tests, because server NASE-2012-234 is not responding to directory service requests.
Test omitted by user request: Advertising
Test omitted by user request: CheckSecurityError
Test omitted by user request: CutoffServers
Test omitted by user request: FrsEvent
Test omitted by user request: DFSREvent
Test omitted by user request: SysVolCheck
Test omitted by user request: KccEvent
Test omitted by user request: KnowsOfRoleHolders
Test omitted by user request: MachineAccount
Test omitted by user request: NCSecDesc
Test omitted by user request: NetLogons
Test omitted by user request: ObjectsReplicated
Test omitted by user request: OutboundSecureChannels
Test omitted by user request: Replications
Test omitted by user request: RidManager
Test omitted by user request: Services
Test omitted by user request: SystemLog
Test omitted by user request: Topology
Test omitted by user request: VerifyEnterpriseReferences
Test omitted by user request: VerifyReferences
Test omitted by user request: VerifyReplicas
Test omitted by user request: DNS
Test omitted by user request: DNS
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : lab
Starting test: CheckSDRefDom
......................... lab passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... lab passed test CrossRefValidation
Running enterprise tests on : lab.nasecom
Test omitted by user request: DNS
Test omitted by user request: DNS
Starting test: LocatorCheck
GC Name: \\NASE-2012-234.lab.nasecom
Locator Flags: 0xe000f3fd
PDC Name: \\NASE-2012-234.lab.nasecom
Locator Flags: 0xe000f3fd
Time Server Name: \\NASE-2012-234.lab.nasecom
Locator Flags: 0xe000f3fd
Preferred Time Server Name: \\NASE-2012-234.lab.nasecom
Locator Flags: 0xe000f3fd
KDC Name: \\NASE-2012-234.lab.nasecom
Locator Flags: 0xe000f3fd
......................... lab.nase.com passed test LocatorCheck
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments
provided.
......................... lab.nasecom passed test Intersite
PS C:\Users\Administrator>http://social.technet.microsoft.com/Forums/en-US/home?forum=winserverDS is the forum for Directory Services questions. You might want to post your question there.
.:|:.:|:. tim -
Hi,
I have successfully setup SharePoint Foundation 2013 as single server farm with SQL Server Standard database in a DMZ environment using local accounts since DMZ doesn't have an Active Directory and hence Domain accounts using powershell as described
in https://theblobfarm.wordpress.com/2012/12/03/installing-sharepoint-2013-without-a-domain-controller
When I run Farm configuration wizard to provision search service application, I get an error:
ERROR: "The service application(s) for the service "Search Service Application" could not be provisioned because of the following error: I/O error occurred."
The log file logged the details of this error as:
ERROR: "Failed to create file share Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 at D:\SharePoint Search\Office Server\Analytics_e441aa1c-1a8d-4f0a-a079-58b499eb4c50 (System.ArgumentException: The SDDL string contains an invalid sid or a sid
that cannot be translated."
After investigation, I found that potentially the error could be because the timer service is trying to setup a network share for analytics component (as part of provisioning search). It is trying to setup that share with a domain account that happens to
be a local user instead in this case and fails with error “System.ArgumentException: The SDDL string contains an invalid sid or a sid that cannot be translated”.
I got some pointer from the below thread
https://social.technet.microsoft.com/Forums/en-US/c8e93984-f4e5-46da-8e8a-c5c79ea1ff62/error-creating-search-service-application-on-sharepoint-foundation-with-local-account?forum=sharepointadmin
However, the above thread doesn't state that the solution worked.
I have tried creating share manually for Analytics_<Guid> folder but it doesn't work since every time farm configuration wizards is run it creates a new Analytics_<Guid> folder.
Since, I have setup SharePoint Foundation 2013 on a production environment I cannot test and trial various solutions.
Can some please guide me on how to successfully provision search for SharePoint Foundation 2013 setup as a single server farm with SQL Server Standard database in a DMZ environment using local accounts (without Active Directory - domain accounts).
Thanks in advance.
HimanshuMicrosoft documentation doesn't always specifically call out all products (Project Server isn't there, either). But it does apply. You'll need to stand up at least one Domain Controller, or allow port access back to a DC.
Preferably, set up SharePoint on the internal network and use a reverse proxy (which will terminate client connections at the reverse proxy) present in the DMZ.
Trevor Seward
Follow or contact me at...
  
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs. -
Windows Server 2008 R2: Server unable to authenticate with Domain Controller
Hello, I was wondering what could be the reason for this error if it is certain that there was no other computer on the network using the same name:
This computer could not authenticate with<Domain-controller>, a Windows domain controller for domain <Domain-name>, and therefore this computer might deny logon requests. This
inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized.
What would cause the machine account pw to be 'not recognized'?You can track changes in AD by enabling AD Auditing: https://technet.microsoft.com/en-us/library/cc731764%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
As reading the logs is usually a complicated and time consuming task, it is recommended to use a third party tool for auditing. The one I usually recommend is Lepide Auditor - Active Directory: http://www.lepide.com/lepideauditor/active-directory.html
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile -
I install Active Directory Domain Controller on Windows server 2008 enterprise and dont login on Sql Server 2008 R2. Before install ADDC, I have logon SQL Server 2008r2 Success, After when i install ADDC is don't logon on SQL Server 2008r2 -->not success.
I have uninstalled ADDC but i still can't login on SQL server 2008r2.
please help me. it is very very disaster!
I think is loss account SQL server 2008r2!Hello,
I stronly recommend you post the detail error message to us while you try to connect to SQL Server instance, it's useful for us to do further investigation.
Microsoft recommends that you do not install SQL Server 2008 R2 on a domain controller, there are some limitations:
You cannot run SQL Server services on a domain controller under a local service account or a network service account.
After SQL Server is installed on a computer, you cannot change the computer from a domain member to a domain controller. You must uninstall SQL Server before you change the host computer to a domain controller.
After SQL Server is installed on a computer, you cannot change the computer from a domain controller to a domain member. You must uninstall SQL Server before you change the host computer to a domain member.
SQL Server failover cluster instances are not supported where cluster nodes are domain controllers.
SQL Server Setup cannot create security groups or provision SQL Server service accounts on a read-only domain controller. In this scenario, Setup will fail.
On Windows Server 2003, SQL Server services can run under a domain account or a local system account.
So, I would suggest you try to open up Windows Services list and changed the account for SQL Server service.
Regards,
Elvis Long
TechNet Community Support -
Active Directory domain controller could not be contacted
Hello
Help please.
I am trying to add a new server (2008) to domain 'bridgelimited.local' - only one DC (2003) doing everything at the moment. The plan is to add the new server, then move everything over from the old machine, then retire/upgrade the old machine and use as a backup.
I am currently trying to dcpromo on the new machine but I get the following error:
The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller for domain bridgelimited.local:
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.bridgelimited.local
Common causes of this error include the following:
- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals. This computer is configured to use DNS servers with the following IP addresses:
212.50.160.100
196.168.16.2
- One or more of the following zones do not include delegation to its child zone:
bridgelimited.local
local
. (the root zone)
For information about correcting this problem, click Help.
192.168.16.2 is IP address for the DC.
Any help would be grately appreciated.
Kind Regards
RichardManaged to get the DCDIAG
Here goes (I know my harddisk is failing - that's why I am desperate to get everything shifted to the new server).
Domain Controller Diagnosis
Performing initial setup:
* Verifying that the local machine bridgeserver, is a DC.
* Connecting to directory service on server bridgeserver.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\BRIDGESERVER
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... BRIDGESERVER passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\BRIDGESERVER
Starting test: Replications
* Replications Check
* Replication Latency Check
DC=ForestDnsZones,DC=BridgeLimited,DC=local
Latency information for 2 entries in the vector were ignored.
2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
DC=DomainDnsZones,DC=BridgeLimited,DC=local
Latency information for 2 entries in the vector were ignored.
2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
CN=Schema,CN=Configuration,DC=BridgeLimited,DC=local
Latency information for 2 entries in the vector were ignored.
2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
CN=Configuration,DC=BridgeLimited,DC=local
Latency information for 2 entries in the vector were ignored.
2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
DC=BridgeLimited,DC=local
Latency information for 2 entries in the vector were ignored.
2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
* Replication Site Latency Check
......................... BRIDGESERVER passed test Replications
Starting test: Topology
* Configuration Topology Integrity Check
* Analyzing the connection topology for DC=ForestDnsZones,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for DC=DomainDnsZones,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for CN=Schema,CN=Configuration,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for CN=Configuration,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
......................... BRIDGESERVER passed test Topology
Starting test: CutoffServers
* Configuration Topology Aliveness Check
* Analyzing the alive system replication topology for DC=ForestDnsZones,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for DC=DomainDnsZones,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for CN=Configuration,DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for DC=BridgeLimited,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
......................... BRIDGESERVER passed test CutoffServers
Starting test: NCSecDesc
* Security Permissions Check for
DC=ForestDnsZones,DC=BridgeLimited,DC=local
(NDNC,Version 2)
* Security Permissions Check for
DC=DomainDnsZones,DC=BridgeLimited,DC=local
(NDNC,Version 2)
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=BridgeLimited,DC=local
(Schema,Version 2)
* Security Permissions Check for
CN=Configuration,DC=BridgeLimited,DC=local
(Configuration,Version 2)
* Security Permissions Check for
DC=BridgeLimited,DC=local
(Domain,Version 2)
......................... BRIDGESERVER passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
......................... BRIDGESERVER passed test NetLogons
Starting test: Advertising
The DC BRIDGESERVER is advertising itself as a DC and having a DS.
The DC BRIDGESERVER is advertising as an LDAP server
The DC BRIDGESERVER is advertising as having a writeable directory
The DC BRIDGESERVER is advertising as a Key Distribution Center
The DC BRIDGESERVER is advertising as a time server
The DS BRIDGESERVER is advertising as a GC.
......................... BRIDGESERVER passed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
Role Domain Owner = CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
Role PDC Owner = CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
Role Rid Owner = CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
Role Infrastructure Update Owner = CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
......................... BRIDGESERVER passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 2609 to 1073741823
* bridgeserver.BridgeLimited.local is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 2109 to 2608
* rIDPreviousAllocationPool is 2109 to 2608
* rIDNextRID: 2121
......................... BRIDGESERVER passed test RidManager
Starting test: MachineAccount
* SPN found :LDAP/bridgeserver.BridgeLimited.local/BridgeLimited.local
* SPN found :LDAP/bridgeserver.BridgeLimited.local
* SPN found :LDAP/BRIDGESERVER
* SPN found :LDAP/bridgeserver.BridgeLimited.local/BRIDGELIMITED
* SPN found :LDAP/96d36b0b-a148-4c2f-b3d3-8c2ac83fcaf9._msdcs.BridgeLimited.local
* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/96d36b0b-a148-4c2f-b3d3-8c2ac83fcaf9/BridgeLimited.local
* SPN found :HOST/bridgeserver.BridgeLimited.local/BridgeLimited.local
* SPN found :HOST/bridgeserver.BridgeLimited.local
* SPN found :HOST/BRIDGESERVER
* SPN found :HOST/bridgeserver.BridgeLimited.local/BRIDGELIMITED
* SPN found :GC/bridgeserver.BridgeLimited.local/BridgeLimited.local
......................... BRIDGESERVER passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: IsmServ
IsmServ Service is stopped on [BRIDGESERVER]
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: w32time
* Checking Service: NETLOGON
......................... BRIDGESERVER failed test Services
Starting test: OutboundSecureChannels
* The Outbound Secure Channels test
** Did not run Outbound Secure Channels test
because /testdomain: was not entered
......................... BRIDGESERVER passed test OutboundSecureChannels
Starting test: ObjectsReplicated
BRIDGESERVER is in domain DC=BridgeLimited,DC=local
Checking for CN=BRIDGESERVER,OU=Domain Controllers,DC=BridgeLimited,DC=local in domain DC=BridgeLimited,DC=local on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local in domain CN=Configuration,DC=BridgeLimited,DC=local on 1 servers
Object is up-to-date on all servers.
......................... BRIDGESERVER passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... BRIDGESERVER passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
......................... BRIDGESERVER passed test frsevent
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the last 15 minutes.
......................... BRIDGESERVER passed test kccevent
Starting test: systemlog
* The System Event log test
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:47:27
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:47:41
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:47:55
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:48:09
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:48:23
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:48:38
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:48:52
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:49:06
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:49:20
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:49:54
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:50:08
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:50:22
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:51:33
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:51:53
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:52:07
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:52:21
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:52:35
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:52:49
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:53:03
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:53:17
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:53:31
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 16:53:45
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:12:23
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:12:37
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:12:51
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:13:05
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:13:19
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:13:33
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:13:47
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:14:01
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:14:15
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:15:24
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:15:38
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:15:53
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:16:07
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:16:21
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:16:35
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:16:49
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:17:03
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
An Error Event occured. EventID: 0xC0040075
Time Generated: 09/10/2009 17:17:17
Event String: The driver for device \Device\Scsi\hpt3xx1
detected a port timeout due to prolonged
inactivity. All associated busses were reset in
an effort to clear the condition.
......................... BRIDGESERVER failed test systemlog
Starting test: VerifyReplicas
......................... BRIDGESERVER passed test VerifyReplicas
Starting test: VerifyReferences
The system object reference (serverReference)
CN=BRIDGESERVER,OU=Domain Controllers,DC=BridgeLimited,DC=local and
backlink on
CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
are correct.
The system object reference (frsComputerReferenceBL)
CN=BRIDGESERVER,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=BridgeLimited,DC=local
and backlink on
CN=BRIDGESERVER,OU=Domain Controllers,DC=BridgeLimited,DC=local are
correct.
The system object reference (serverReferenceBL)
CN=BRIDGESERVER,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=BridgeLimited,DC=local
and backlink on
CN=NTDS Settings,CN=BRIDGESERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BridgeLimited,DC=local
are correct.
......................... BRIDGESERVER passed test VerifyReferences
Starting test: VerifyEnterpriseReferences
......................... BRIDGESERVER passed test VerifyEnterpriseReferences
Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Running partition tests on : BridgeLimited
Starting test: CrossRefValidation
......................... BridgeLimited passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... BridgeLimited passed test CheckSDRefDom
Running enterprise tests on : BridgeLimited.local
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the scope
provided by the command line arguments provided.
......................... BridgeLimited.local passed test Intersite
Starting test: FsmoCheck
GC Name: \\bridgeserver.BridgeLimited.local
Locator Flags: 0xe00003fd
PDC Name: \\bridgeserver.BridgeLimited.local
Locator Flags: 0xe00003fd
Time Server Name: \\bridgeserver.BridgeLimited.local
Locator Flags: 0xe00003fd
Preferred Time Server Name: \\bridgeserver.BridgeLimited.local
Locator Flags: 0xe00003fd
KDC Name: \\bridgeserver.BridgeLimited.local
Locator Flags: 0xe00003fd
......................... BridgeLimited.local passed test FsmoCheck
The only thing I can see (other then the HDD) is the
IsmServ Service is stopped on [BRIDGESERVER]
Hope you can help. Pretty please.
Kind Regards
Richard -
I have 2 domain controllers running 2003 server, server1 and server2. I ran dcpromo on server1 and removed AD and removed him from the domain and disconnected from network. I then added a 2012 server
with the same name and IP address server1 with no problem. Replication from sites and services work fine on both controllers.
The new 2012 server1 is GC. I transferred all FSMO roles to server1. Again no problem and replicating using sites and services. AD on server1 is populated correctly.
Now what I had intended on doing was a dcpromo to remove server2 from the domain so I can then add another 2012 server. That is when I get the: "The box indicating that this domain controller is the last controller for the domain
is unchecked. However, no other Active Directory domain controllers for that domain can be contacted.
I have DNS installed on both servers and both look good with replicating there. Strange thing is when on the 2012 server within DNS if I right click and connect to another DNS server I can add server2 just fine but from server2 adding server1 it tells me it
is not available.
Help please!Hi,
As there is server 2012 DC (SERVER1) DC is operational in a domain then "This domain controller is the last controller for the domain" should be remain unchecked when you demote SERVER2 DC.
If you are getting error "Active Directory domain controllers for that domain can be contacted" while demoting SERVER2 DC then check the DNS pointing on both as per below article, disable windows firewall on all DC, less possiblities but worth to check if both
are different site then check the ports are open on firewall.
http://abhijitw.wordpress.com/2012/03/03/best-practices-for-dns-client-settings-on-domain-controller/
http://technet.microsoft.com/en-us/library/cc766337(v=ws.10).aspx
http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx
run “ipconfig /flushdns & ipconfig /registerdns“, restart DNS server and NETLOGON service on each DC and try to demote server2 DC.
If issue reoccurs, post dcdiag /q result.
NOTE: If initial replication was completed between both DC (new 2012 and old DC) then you may remove the server2 DC from Active Directory forcefully (DCPROMO /FORCEREMOVAL) and perform metadata cleanup.
Active Directory Metadata Cleanup
http://abhijitw.wordpress.com/2012/03/03/active-directory-metadata-cleanup/
Best regards,
Abhijit Waikar.
MCSA | MCSA:Messaging | MCITP:SA | MCC:2012
Blog: http://abhijitw.wordpress.com
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees and confers no rights. -
Install Domain Controller, Active Directory, RemoteApps on Single Server?
Have a server that I want to experiment with RemoteApps. Documentation I have read state you need to have a Domain Controller setup with AD on one server, and have a second server to install all the RemoteApps requirements. Is this true or can
this all be done on one server.
If I need a separate server for the Domain Controller and Active Directory, can I assume that a low end server would be sufficient? Or would using Hyper-V with a single hardware server and create two virtual machines: one as the DC/AD, and the other
to run Remote Apps be a possible solution. Any advice?it really depends to be honest. I'd probably go something like this though:
One Small physical server to act as a domain controller - you could put DHCP on this too
One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined.
Then for your VM's create the following:
1 x additional domain controller
For remote desktop services:
1 x Remote Desktop Session Host
1 x Connection Broker
1 x Gateway and web server
For additional services
1 or 2 x Exchange
1 x sharepoint
1 x IIS
but it really depends what you want to achieve.
The benefit from Virtual machines is that you can keep separate virtual servers for separate applications.
If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance.
Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn: -
Unable to demote a domain controller
Hi Everone,
My primary DC is windows Server 2012 R2 and ADC is windows Server 2008 x64
I am trying to demote Windows Server 2008 x64 and i am facing issues.
when i demote2008 I am getting Error : A Domain Controller could not be contacted for the domain(mydomain.com) that contains
an account for this computers.Make the computer a member of a workgroup then rejoin the domain before retrying the prmotion.
The specified domain either doesnot exist or could not be contacted
When i browse my \\windows2012dc i cannot see sysvol and netlogon shared folders.
on window2012dc C:\windows\sysvol\mydomain and mydomain folder is empty.(no issues with replication in sites and services and no issues with connectivity or gateway )
please guide me because i dont want forceful demote.I would first recommend taking backups of both DCs before proceeding with any changes.
Before trying a forced demotion, you can try the following:
Make sure that both DCs have a single NIC card enabled and only one IP address in use
Make both DCs point to the other as primary DNS server, their private IP addresses as secondary DNS server and 127.0.0.1 as third one. Once done, run
ipconfig /registerdns and restart netlogon service
Disable any security filtering between both DCs and temporary disable security software you use
If this does not help then you need to proceed with a forced demotion.
You can then proceed like the following (First, Use dcdiag to check that the Windows Server 2012 R2 DC has no problems apart of the SYSVOL folder and the replication with the other DC):
Shutdown the DC running Windows Server 2008 (Do not bring it online again without re-installing it later)
Seize all FSMO roles to your Windows Server 2012 R2 DC if it is not already the current FSMO holder: http://support.microsoft.com/KB/255504
Do a metadata cleanup to remove the data of the old Windows Server 2008 DC: Use
dssite.msc to remove its NTDS settings and object over there then use
dsa.msc to remove its AD account
Rebuild your SYSVOL tree: http://support.microsoft.com/kb/315457
This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Get Active Directory User Last Logon
Create an Active Directory test domain similar to the production one
Management of test accounts in an Active Directory production domain - Part I
Management of test accounts in an Active Directory production domain - Part II
Management of test accounts in an Active Directory production domain - Part III
Reset Active Directory user password -
NTLM Authentication with a domain controller/active directory
Hi,
I have a requirement to do an NTLM authentication with the MS active directory.
I am aware that JNDI doesn't support this protocol to communicate with the AD.
I have looked into couple of online solutions available but that doesn't seem to meet my requirement. Most of the solutions like (Apache commons NTLMScheme/NTCredentials and java.net.Authenticator etc...) are used for only NTLM proxy authentication (where both username, password is sent to the proxy server which does the actual NTLM authentication with the Active Directory.)
What I need is a solution in Java where I can directly contact Active directory for negotiation of challenge/response mechanism.
Can any of you guys suggest any alternative to achieve this ?it really depends to be honest. I'd probably go something like this though:
One Small physical server to act as a domain controller - you could put DHCP on this too
One or Two physical, quite powerful servers to act as Hyper-V hosts - these can be domain joined.
Then for your VM's create the following:
1 x additional domain controller
For remote desktop services:
1 x Remote Desktop Session Host
1 x Connection Broker
1 x Gateway and web server
For additional services
1 or 2 x Exchange
1 x sharepoint
1 x IIS
but it really depends what you want to achieve.
The benefit from Virtual machines is that you can keep separate virtual servers for separate applications.
If you have two hosts you could then replicate the virtual machines between them if you wanted some layer of fault tolerance.
Hope this helps you a bit more. And thanks for positive blog feedback - its appreciated.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn: -
OD Master/PDC, 10.4.11, why xp clients unable to locate domain controller?
After a migration/upgrade from 10.3.9 to 10.4.11 Server, windows XP clients are intermittently unable to log in to or even bind to the PDC running on that server.
I did a clean format and install from the 10.4 media, choosing the standalone server type, and applied all the Software Updates, I got forward and reverse DNS working for my zone, then I followed the instructions at http://www.afp548.com/article.php?story=20050615173039158 to move my OD from a working 10.3.9 server to 10.4.
This server goes against the usual recommendations, as it provides DNS, OD master, PDC and file services to 32 clients all in the same subnet, 20 running Windows XP SP2 and 12 running OS X Client 10.4.x or 10.5.x.
File services and various other users of the OD/LDAP, for example Wildfire Jabber/XMPP server and Apache2/LDAP running on a separate Linux server, are able to authenticate against the new 10.4.11 OD.
However, at this point the symptoms become intermittent approx. 40% of the Windows XP clients were unable to log in with various domain accounts, yielding errors of the form "Unable to find domain FOO". If I remove a client from the domain by joining it to WORKGROUP and rebooting, then try to join FOO again, I'll get an error, "Unable to locate Domain Controller for FOO..."
The set-up:
My server's FQDN is myserver.foo.example.com
The server's DNS is authoritative for the 10.10.10.0/24, foo.example.com zone and I have the trailing dot's in the right places, so ping myserver.foo.example.com, ping myserver, and ping 10.10.10.10 (server's example IP from the foo.example.com zone) all work correctly.
The DHCP server for this vlan is providing my DNS server to the clients, but is providing no netbios server. The XP clients are all set to use the DHCP server setting, which, according to the TCP/IP Advanced Settings panel, means that they'll revert to netbios over tcp/ip since no wins server is specified.
In Server Admin->Windows->General:
Role: Primary Domain Controller (PDC)
Description: FOO Domain at example.com
Computer Name: myserver
Domain: FOO
Server Admin->Windows->Access:
Allow Guest Access: Check
Client Connections: Unlimited
Authentication: NTLMv2 & Kerberos, NTLM, and LAN Manager: All check
Logging->Log Detail: High
Advanced->Code Page: Latin US
Services: Workgroup Master browser and Domain master browser: check
WINS Registration: Off
Homes: Enable virtual share points: check
Should my Windows service on 10.4.11 be providing WINS or not? If so, should the DHCP server be set to point the clients to it? If not, how do the XP clients reliably resolve the FOO domain?
Why did all these XP clients work fine with a 10.3.9 Windows PDC but don't work with 10.4.11?
Another strange point - I can use the XP-side 'net view' command to poke around and things look reasonable. I.E. even the clients that aren't joined to the domain and can't locate the domain controller will return sane results for 'net view /domain:FOO'.The new PDC does use the same domain name as the old PDC, and the SID mismatch is at least partially to blame. After I'd performed the upgrade and confused the windows clients, I saw the advice on using samba's net command to duplicate the old PDC's SID to the new PDC. Maybe someday I'll have the opportunity to try that.
I resorted to removing all the XP clients from the domain and re-joining them. The XP clients were still able to contact the domain intermittently. I used various command-line tools on the XP side, including the built-in net command as well as some others I downloaded such as the quite useful http://www.joeware.net/freetools/tools/findpdc/index.htm, as well as the client-side error messages during the domain join attempts and the messages in the Event log, to determine that the clients couldn't find the domain.
The XP client TCP/IP settings state that the clients will revert to using netbios if no WINS server is specified, but that clearly wasn't working reliably, so I just enabled the WINS server on the PDC, told the DHCP server to hand out its address for the netbios-related options for that subnet, rebooted the PDC, waited a while for things to settle out, and now all the clients can reliably find the PDC.
I still have no idea why the WINS-less set-up worked in 10.3 server but didn't work in 10.4 server, but believe me, I'll remember it now! -
Im getting error "Unable to find domain controller for the specified domain. Please explicitly specify the domain controller." when I try to create an AD connection for my User Profile Service. The entire sharepoint environment is installed
on one server. That server has everyting on it, AD, SQL, Sharepoint, and its the domain controller. I cant figure out why this will not identify?Trevor FielderHi,
Did you get this error when clicking on the Populate Containers button?
If yes, please make sure that you have provide the domain credentials in the account name and password
boxes below when entering the domain information. The account must be granted the replicating directory changes permission on the domain.
You can refer to this blog:
http://www.harbar.net/articles/sp2010ups.aspx
Xue-Mei Chang -
Unable to join virtual machines to domain controller
Hello all
I am studying for MCSE 2012 R2 and have decided to move from VMware Esxi 5.5 to Hyper-V in Server 2012R2.
I built the host (Server 2012r2) and so far 3 VMs (all are Server 2012R2 VMs) . I promoted one of the VMs to a Domain controller and things appear to have installed with no issue. This is what I have done so far:
Added Static IP addresses for all VMs
Configured each VM's DNS setting to use the DC
When I try to join one of the virtual servers to the domain controller this is what I get.
Note: This information is intended for a network administrator. If you are not your network's administrator, notify the administrator that you received this information, which has been recorded in the file C:\Windows\debug\dcdiag.txt.
The following error occurred when DNS was queried for the service location (SRV) resource record used to locate an Active Directory Domain Controller (AD DC) for domain "wolfpack.local":
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.wolfpack.local
Common causes of this error include the following:
- The DNS SRV records required to locate a AD DC for the domain are not registered in DNS. These records are registered with a DNS server automatically when a AD DC is added to a domain. They are updated by the AD DC at set intervals.
This computer is configured to use DNS servers with the following IP addresses:
10.0.0.14
- One or more of the following zones do not include delegation to its child zone:
wolfpack.local
local
. (the root zone)
Phil BalderosHi Phil,
I have noticed that the domain is wolfpack.local but two VMs has another DNS suffix "home.network" .
Please remove it and join it to domain again .
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.
Hello Elton and thank you for the response.
I was looking at that same setting on my VM and its empty.
Phil Balderos
Maybe you are looking for
-
An unknown error has occurred when trying to sign in , and I know I putting in the correct info, this stinks can anyone help? Because apple isn't...
-
Error message severity not translated correct when locale is changed
We have a shell page displaying different task flows within a dynamic region. The shell page f:view tag has locale="#{LocaleManager.currentLocale}" to allow programmatic change of locale. Most of the flows uses the locale from the browser request (e.
-
How to change background color in preview mode?
After entering by chance presentation mode and had to quit indesign for exit (esc key doesn't work on my iMac), I found that the background color in preview mode is now black instead of grey. There is any way to change it?
-
Help with InDesign spread previews in Bridge CS6
Our company is updating to CS6 and needs to be able to view InDesign files as spreads as we did in CS3. We produce many catalogs a year and each spread is a separate file. We use Bridge (CS3) to view the entire catalog at once. Now, with CS6, we can
-
SOAP Adapter - Error because of special character (u00FC - Umlaut) in payload
Hello, We have a SOAP sync scenario. SAP -> PI 7.0 -> 3rd Party system We have a special character (ü - Umlaut) as part of the payload. When the message enters message pipeline in PI, I can see the payload XML till message branching step. From Messag