XP Clients unable to resolve DNS on Server 2008, but ok on Server 2003!

[mo_vigilante]

Hi guys,

Need to pick your brains on this one as as I will be going bald tearing my hair out!!

Uptil today one site are unable to resolve DNS queries on the network. All our servers apart from one run 2008 Server Standard (Both DC's, File, Mail, BB Server) - the other being 2003 (Apps Server).

Now all other sites are fine and we run on Win XP SP3 and Win 7 across various sites.

The weird thing is that on the site I'm having problems at, I am able to ping to the server by it's DNS name, but if I want to browse to a hidden share by the DNS, it comes up with a username/password box and even though you type in the right one, it keeps asking for it.

I've tried the following: -

- restarted the machine a few times
- ipconfig /release, ipconfig /renew, ipconfig /flushdns
- uninstalled the network card, and re-installed it
- even used static DNS pointing to the DC's (primary and secondary)
- restarted the servers and did ipconfig/flushdns on the servers
- take machine out domain and into workgroup, also applied NEWSid to the machine just in case faulty/corrupt files
- I can remote into the server via its DNS, but simply can't browse to hidden shares.

I've tried the above to no avail

Now that I've taken the machine out of the domain, it won't add it back it lol. Assuming it can't resolve the DNS for the domain??

Weird thing is that we have one 2003 server running our apps and I am able to ping this server by DNS, and I am able to browse the the hidden shares as well.

On this same site, there are two machines running on 7 and they are fine - no problems! Just the XP clients on this site.

I've contacted the other sites who also run Win XP and 7 and all them sites are ok. I would have thought the servers are fine from this and surely something with these particular clients on this site?

I'm beginning to tear my hair out on this. At the moment, I've mapped the users to the shares by it's IP so they can work, but anyone got any ideas on this one??

Any advice/help will be much appreciated!

Thanks.
Mo

[john]

Have a look at this - Some DNS name queries are unsuccessful after you deploy a Windows Server 2003 or Windows Server 2008 R2-based DNS server I had some issues with that on my new 2008 R2 but says it also applys to 2003 so may help?

[mo_vigilante]

Hi,

Thanks for your post. After much investigation I realised on Friday for some time probably a week now that AD is not replicating to the secondary DC, and this is causing problems like DNS issues, adding new objects/users/groups/emails and not replicating over. The site where the secondary DC lives is causing lots of DNS issues for those users (unable to resolve mapped drives because of name resolution for starters).

Anyway tried restarting both servers, checked the logs and from this on forums, suggested to manually force replicating from AD Sites & Service. When I attempt to do this, it comes up with an error ‘Access is Denied’ when I try to replicate configuration from the primary DC. It also does the same from the primary DC to replicate over to the targeted secondary DC.

I’ve stopped and started the AD service which also stops DNS, Kerberos authentication etc and restarting both DC’s to no avail and tried to replicate and same error message as above.

When I read on forums if the manual replication doesn’t work and stopping and starting the services, then I read on that to uninstall AD on the server and reinstall, some threads about demoting and promoting the server again and roles and this should replicate again?

To be honest, as I haven’t done this before I’m not sure which method to try and see?

Need some advice on what should be the course of action in getting replication back up and running from the things I’ve mentioned above??
Thanks.

[john]

The site that isn't replicating has it got any data on it that hasn't gone to the main working one? If so you got a problem it not I'd do as you have said, demote that iffy one and re-promote it, do this on the same physical site as the existing DC that is working and then you know you got it all sorted and working well and then take it back.