DHCP DNS AD all died at the same time!

[CHR1S]

So this weekend it seems that my PDC decided it didnt like something and flaked out. (Out of interest a restart made it all better)

I have a huge amount of errors so I will pick the few that I feel are most relevent -

NTDS (504) NTDSA: A request to write to the file "C:\WINDOWS\NTDS\edb.chk" at offset 0 (0x0000000000000000) for 4096 (0x00001000) bytes succeeded, but took an abnormally long time (116 seconds) to be serviced by the OS. This problem is likely due to faulty hardware. Please contact your hardware vendor for further assistance diagnosing the problem.

NTDS (504) NTDSA: The logfile sequence in "C:\WINDOWS\NTDS\" has been halted due to a fatal error. No further updates are possible for the databases that use this logfile sequence. Please correct the problem and restart or restore from backup.

The Knowledge Consistency Checker (KCC) encountered an unexpected error while performing an Active Directory operation.

Operation type:
KccSearch
Object distinguished name:
CN=Inter-Site

Active Directory was unable to establish a connection with the global catalog.

The Security Account Manager failed a KDC request in an unexpected way.

The DHCP service failed to see a directory server for authorization.

etc etc etc etc LOL!


So, where the hell do I start to look for a cause?

[rh91uk]

You could try looking for Kerberos errors ... we had something very similar happen here........

[RabbieBurns]

isnt the first error something to do with exchange?

[CHR1S]

isnt the first error something to do with exchange?

We dont use exchange

[jamin100]

do the results from dcdiag show anything ?

[ChrisH]

It looks like it couldn't access the AD log and transaction files. Maybe a hardware error HD RAID array or it may have just been one of them things. Time to make sure you have good backups and start testing hardware.

[CHR1S]

@jamin - just checking now.

One thing I have noticed is that one of my backups over ran into another as its file size has shot up! Could that be enough to cause this?

[CHR1S]

dcdiag passed all tests but this one -

Skipping all tests, because server SERVER is
not responding to directory service requests

Ironically it did the rest of the tests even tho it said it would skip them?

Edit - I checked the servers DNS settings with nltest.exe /dsregdns reported no errors but I am getting another error now -

The host c1****3f-9379-4c70-****-94e762d04eb1._msdcs.school.BHAM.SC
d not be resolved to an
IP address. Check the DNS server, DHCP, server name, etc
Although the Guid DNS name
(c1****3f-9379-4c70-****-94e762d04eb1._msdcs.school.BHAM.SCH.UK)
couldn't be resolved, the server name (server.school.BHAM.SCH.UK)
resolved to the IP address (****) and was pingable. Check
that the IP address is registered correctly with the DNS server.
......................... SERVER failed test Connectivity

[Michael]

I would say it looks like a hard disk/RAID problem. Have you tried running Scandisk, although you'll need to reboot as this is the system drive.

[CHR1S]

I would say it looks like a hard disk/RAID problem. Have you tried running Scandisk, although you'll need to reboot as this is the system drive.

No, not tried it. Will get it to run tonight.

[CHR1S]

DCDiag /v passes with no errors

Its strange, there seems to be no problems I can see now - everything is working fine

I will get the scandisk running tonight and I have rejigged the backups so they dont over run.

Anyone else got any ideas?

[Michael]

You could run a memory test in Windows, but you should be running ECC memory anyway which should correct most errors. I suppose you could also check your UPS for unusual activity.

[CHR1S]

You could run a memory test in Windows, but you should be running ECC memory anyway which should correct most errors. I suppose you could also check your UPS for unusual activity.

Yes its EEC memory, How would the UPS affect it? You mean look for spikes?

[Michael]

You mean look for spikes?

If you're using an APC UPS with the software installed, it can provide useful data if there was a spike or any other strange activity such as overloading.

[CHR1S]

For anyone still wondering the outcome of this -

I changed the backup schedule so there were no conflicts and it seems to be all ok So thanks again to all those who helped it was heavy disk access.... time to find out if its anything underlying