Netdiag: help needed in interpreting results and fixing problem

[Andie]

I have a problem with two older machines on our network that aren't picking up group policies when logged in as pupil users; these machines are also very slow logging on. The problem was posted here:

http://www.edugeek.net/frms/showthread.php?t=16379

But I am starting a new thread to get more specific help.

The machines are Win2000 Prof. I have now downloaded and installed netdiag and have run it on two machines, one that is faulty and one that is OK. The faulty one has passed the DNS test, but has a warning as follows:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for the name
'computername.asjs.internal.'. [ERROR_TIMEOUT]
The name 'computername.asjs.internal.' may not be registered in DN

This warning doesn't appear on the netdiag for the computer that is fine.

There is also a failure for the DC list test and an error on the Trust relationship as follows:

DC list test . . . . . . . . . . . : Failed
'ASJS': No DCs are up.


Trust relationship test. . . . . . : Passed
'ASJS': No DCs are up (Cannot run test).
Secure channel for domain 'ASJS' is to '\\SERVERNAME'.

Whereas the computer that works has the following results:

DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Passed
Secure channel for domain 'ASJS' is to '\\servername.asjs.internal'.


Note: I have edited the actual computer name and server name out.

Can anyone tell me if I can do something to fix this. I found a post on a similar theme, suggesting doing something about reverse DNS lookup, but I don't know how to go about checking this and fixing it.

[Ric_]

First thing you need to check is your DNS settings - all these errors are complaining about not being able to find things in DNS.

If the DNS settings are correct, try re-joining to the domain... the computer accounts may have got disturbed somehow.

[Andie]

First thing you need to check is your DNS settings - all these errors are complaining about not being able to find things in DNS.

If the DNS settings are correct, try re-joining to the domain... the computer accounts may have got disturbed somehow.

I already tried rejoining the domain way back when I first discovered the problem with group policies, with no resolution.

I have now found the DNS console (sorry, but these things were all set up by our IT provider, and this is uncharted territory for me!). In the Forward and Reverse lookup folders, I can't find either of the faulty computers listed (others on our network are there, but not these two). How do I go about fixing this myself, and is there any poss I can make things worse (ie. what are the risks involved??)??

Server is Windows 2003, and I am using the DNS console part of MMC.

[Geoff]

Clients will only register themselves in DNS if they are using DHCP. Do you use a DHCP server? Are the effected clients set to use DHCP?

[Andie]

Clients will only register themselves in DNS if they are using DHCP. Do you use a DHCP server? Are the effected clients set to use DHCP?

Um?? How do I tell, please?

[Andie]

OK, I found the DHCP console. We have a scope setup and there are current machines listed as having leases assigned. The faulty two machines are not on the list.

How do I tell if a client is configured to use DHCP?? (As far as I know, all of these machines - we have about 14 other identical ones - were set up the same when the new network was installed about 18 months ago).

[Ric_]

You need to edit the network settings on the machine. Setting everything to automatic should do the trick.

Once you have done this, make sure that you can ping your DCs and can resolve DNS names using nslookup.

Once all this is working, it is time to rejoin the domain in the usual way.

[Andie]

Clients will only register themselves in DNS if they are using DHCP. Do you use a DHCP server? Are the effected clients set to use DHCP?

OK, I have done some more digging using ipconfig /all and looking at the Properties and Configure parts of the Network Settings of the faulty machines.

Turns out that they are not DHCP enabled. They have been given a fixed IP address. The network adapter is Intel PRO/100 VE. The addresses are not registered in DNS. Should I do this myself and if so how???

Thinking back to when the new network was set up, we did have problems with these two machines straight away. I seem to remember the IT provider actually physically moving one of the machines out of this classroom and down to the IT Suite, where it booted and logged on fine. I think that was intended to check the integrity of the network cabling (not done by the IT provider).

Possibly these machines were given fixed IP addresses as a sort of fix by the IT provider.

However, one setting does puzzle me. These machines have also been set to use a preferred DNS server (rather than obtain the DNS server address automatically). We are a small junior school, and we only have the one server which does everything. The DNS server address on one of the faulty machines is different to the DNS server address coming up on working machines and the other faulty machine. Should I change the odd DNS server address to match the others??

These machines are taking well over five minutes to boot up and then the same to log on. I can't believe that no one has reported this to me and I only found out because another fault developed with one of them!! I must either have very tolerant users or they have no faith in my ability to fix things at all!!

[Geoff]

1) If the machines are set to use a static IP, you must manually create A and PTR DNS records for them. Or switch them back to DHCP.

2) If the machines are set manually to use a DNS server, they must be set to use the Windows DNS server serving the Active Directory Domain. If you don't do this, they will not work correctly. Alternatively, you can set them to use DHCP which will will use the AD DNS server automatically.

[Andie]

1) If the machines are set to use a static IP, you must manually create A and PTR DNS records for them. Or switch them back to DHCP.

I think I may need to keep the static IP addresses. How do I manually create A and PTR DNS records for them (I can open the DNS console on Win Server 2003). I need very basic instructions, please!!

[CHR1S]

Wouldnt it be easier to set it to DHCP and assign it a reservation?

[Andie]

Wouldnt it be easier to set it to DHCP and assign it a reservation?

Quite possibly, but I think the IT provider set these clients to have fixed IP addresses for a reason. Possibly a dodgy bit of network cabling. But the addresses aren't registered in DNS and the login is slow and the clients aren't picking up GP when logged in as lowest level users. Yeah, it's a long story!!

I really need basic instructions for creating the records in DNS, please.

[Michael]

You haven't specified why these machines need static IP addresses. If they don't, specify DHCP and reboot.

If you wish to keep the static entries, you shouldn't have to do anything in DNS. Within DHCP, create a reservation. Enter all information required including the MAC address. All this information can be found typing:

ipconfig /all

from a command prompt at the two workstations.

This tells DHCP not to use these IPs for any other machines (which would create a conflict).

Hope this helps

[CHR1S]

http://support.microsoft.com/kb/168322

That should explain it.

[Andie]

http://support.microsoft.com/kb/168322

That should explain it.

This explains how to create alias records, but Geoff said that I need to create A and PTR records.