Problem with Domain Controller and Additional Domain Controller in Win SRV 2008 R2

TashiDuks · August 8, 2013

Hi Everyone,

I have Two server installed with Windows 2008 server R2. I have configured those two server in following manner:

Server Name : BHT-DC

IP Address : 192.168.1.252

Subnet Mask : 255.255.255.0

Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.252

Alternate DNS Server : 192.168.1.253

Server Name : BHT-ADC

IP Address : 192.168.1.253

Subnet Mask : 255.255.255.0

Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.252

Alternate DNS Server : 192.168.1.253

Steps followed to configure the Domain Controller Server :

I configured using the procedures from this link Setting Up Your First Domain Controller With Windows Server 2008

Steps followed for congifure the Additional Domain Controller server :

I configured using the procedures from this link Setting Up an Additional Domain Controller With Windows Server 2008

I tested with creation of domain users in Active Directory to see whether the changes are been affected on ADC server, and i have found that its getting updated.

Problem :

When i turn off the Domain Controller server and keeping Additional Domain Controller running to see whether the Additional Domain Controller server is giving the backup service in the network, but this seems to be not working, our client PC are not able to login in their respective PC using domain users.

I also tried in the reverse way by shutting down the Additional Domain Controller and keeping Domain Controller ON but still its giving similar problems.

I think the roles for the servers has got split among those two servers, as what i have found out is that TO HAVE SUCCESSFULL RUNNING OF NETWORK BOTH THE SERVER SHOULD BE RUNNING AND IF ONE OF THE SERVER IS TURNED OFF THEN PROBLEM STARTS.

Is there any ways to find out where it went wrong, as configuration of ADC is first time for me. Is it possible to merge the roles of domain server into single server so that i can reconfigure my ADC once again? I am worried that if i demote my ADC server then i would face problem.

HELP IS HIGHLY APPRECIATE TO FIX MY ABOVE SAID PROBLEMS FORM THE EXPERTS OUT HERE.

Thanks,

TashiDuks

FN-GM · August 8, 2013

Have you moved any roles yourself? The network should run fine with the DC that holds all roles if offline.

Are your clients pointing to both DC's for DNS?

Are both DC's Global Catalogue servers?

Davit2005 · August 8, 2013

2008 R2 should by default create a DC as a Global server, as FN-GM states that should be enough. I've recovered a Domain before with from just GC and DNS on a second domain controller.

Both servers should have DNS installed, possibly Active Directory Integrated, set up the DC's so the preferred DNS is the local servers IP and the other DNS server is a secondary.

You may also look at create a split DHCP onto the 2nd DC which is much easier in Server 2008 R2 and would give you further resilience.

run a dcdiag on both servers.

TashiDuks · August 8, 2013

@FN-GM,

Thanks for the prompt response. Well to answer your question. The first thing is i didnt moved any role myself, all the roles are configured to those servers after i run the above mentioned procedures where i mentioned the link. As per the manual which i have followed to configure DC and ADC, it should be working fine like, if DC server is down ADC should get active and give the service but it is not happening.

Both ther servers are DC Global catalogue servers and all the clients are pointing to DC's for DNS (all the client are having 192.168.1.252 as prefered DNS and 192.168.1.253 as alternate DNS).

Edited August 8, 2013 by TashiDuks

TashiDuks · August 8, 2013

@Davit2005,

yes both the server have DNS installed and Active Directory Integrated in both the servers. Can you give me more information about recovering the domain from GC and DNS on the second domain controller. By looking at the current scenerio and the problem which i am facing, will it be possible to merge TWO DC's role into single server?

Davit2005 · August 8, 2013

Seems a bit strange TBH

One DC generally holds the Most FSMO roles, i.e. PDC Emulator, Operations Master, Schema master etc. the other DC just needs to be a Global Catalog there are some best practices for Role placements from Microsoft so may well be worth looking at that. As long as you have more than one Global catalog you should be able to rescue the other roles if the worse happens and you loose the server that holds the major FSMO roles.

glennda · August 8, 2013

For a start you want the second DC to look at itself for DNS then the other server.

I.e

Server Name : BHT-DC

IP Address : 192.168.1.252

Subnet Mask : 255.255.255.0

Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.252

Alternate DNS Server : 192.168.1.253

Server Name : BHT-ADC

IP Address : 192.168.1.253

Subnet Mask : 255.255.255.0

Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.253

Alternate DNS Server : 192.168.1.252

bart21 · August 8, 2013

@TashiDuks

I don't think you understand. The domain controllers as you have said are both global catalogue servers which means that they are active active when it comes to servicing login requests etc. the users should still be able to log on if the dc that holds the famo roles is down. As people have said the primary Dns address on each server should be set to 127.0.0.1 which is its self and the secondary Dns address should be the ip of the other server. Please set like this and test. If still not working post back and I will help further.

Nick

FN-GM · August 9, 2013

What are the DNS settings on your clients?

apeman · August 9, 2013

For a start you want the second DC to look at itself for DNS then the other server.

I.e
Server Name : BHT-DC
IP Address : 192.168.1.252
Subnet Mask : 255.255.255.0
Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.252
Alternate DNS Server : 192.168.1.253

Server Name : BHT-ADC
IP Address : 192.168.1.253
Subnet Mask : 255.255.255.0
Gateway : 192.168.1.10

Preferred DNS Server : 192.168.1.253
Alternate DNS Server : 192.168.1.252

Sorry but i don't agree with this, your DC's primary DNS server should be the other/another DNS server not its local DNS server, its local DNS server should be the secondary.

If you run Active Directory best practices wizard on windows 2008 R2 and above it tells you this.

kevin_lane · August 11, 2013

if it was me I would check my dcdiag and would see what errors are popping up. I would also check that the srv records are correct and also that in the dhcp settings of the clients that you have specified both servers. I assume you have dns running on both of them I would also make sure that the server / zone updates (name servers )on the dns servers are correct it might also be worth checking your sites and services to make sure that you have 2 servers listed

it might be worth also checking the event logs of the clients to see what error messages they are coming up with

if you are not sure of the fmso roles then run this command

netdom query /domain:

hope this helps

TashiDuks · August 13, 2013

@ Everyone

I have run one query to check the FSMO:

C:\>netdom query fsmo

Schema master RDB-DC.rdb.bt

Domain naming master RDB-DC.rdb.bt

PDC RDB-DC.rdb.bt

RID pool manager RDB-DC.rdb.bt

Infrastructure master RDB-DC.rdb.bt

The command completed successfully.

I get same query result in both the server (DC and ADC). As per the query above it clearly says that the primary domain holds the primary roles. Still i have a problem.

The problem is :

When i turn OFF the DC Server and keeping ADC Server ON, all the clients face probolem with network.

When i turn OFF the ADC Server and keeping DC SERVER ON, all the clients face probolem with network.

When i turn ON the DC SERVER and TURN ON ADC SERVER then the network works smoothly.

As per the scenerio which i have configured, when DC SERVER gets down with some reason then ADC should have a capability to give the service to the client machine with making network down.

Please help me.

Thanks,

TashiDuks

kevin_lane · August 13, 2013

What service is ur dhcp on

kevin_lane · August 13, 2013

Also what does the event logs say for the application and same goes for clients

kevin_lane · August 13, 2013

in ur server dns what intergated mode is it

kevin_lane · August 13, 2013

Also are your dns in sync and is the servers getting the correct time from an authoritative sources e.g time.windows.com

kevin_lane · August 13, 2013

Have you installed any firewall software or made changes to the srv records or ldap records and you when you setup the zone for the dns did you get any errors

kevin_lane · August 13, 2013

also on your client do a nslookup then set the querytype=soa then type in the name of your dcs enter your first one then enter the 2nd one and tell us what the output is also we need the output for the dcdiag maybe a problem with the sysvol / netlogon service make sure they are in a published state you can run the command net view then the name of your dcs and you should have somthing like this

Share name Type Used as Comment

-------------------------------------------------------------------------------

CertEnroll Disk Active Directory Certificate Services share

NETLOGON Disk Logon server share

SYSVOL Disk Logon server share

The command completed successfully.

kevin_lane · August 13, 2013

when you do your dcdiag you should have somthing like this but run them against both dcs just to be on the safe side

Directory Server Diagnosis

Performing initial setup:

* Identified AD Forest.

Done gathering initial info.

Doing initial required tests

Testing server: Westpark\WPDC02

Starting test: Connectivity

......................... WPDC02 passed test Connectivity

Doing primary tests

Testing server: Westpark\WPDC02

Starting test: Advertising......................... WPDC02 passed test Advertising

Starting test: FrsEvent..............................WPDC02 passed test FrsEvent

Starting test: DFSREvent......................... .WPDC02 passed test DFSREvent

Starting test: SysVolCheck....................... WPDC02 passed test SysVolCheck

Starting test: KccEvent.............................WPDC02 passed test KccEvent

Starting test: KnowsOfRoleHolders.............WPDC02 passed test KnowsOfRoleHolders

Starting test: MachineAccount...................WPDC02 passed test MachineAccount

Starting test: NetLogons...........................WPDC02 passed test NetLogons

Starting test: ObjectsReplicated ................WPDC02 passed test ObjectsReplicated

Starting test: Replications.........................WPDC02 passed test Replications

Starting test: RidManager.........................WPDC02 passed test RidManager

Starting test: Services..............................WPDC02 passed test Services

Starting test: SystemLog......................... WPDC02 passed test SystemLog

Starting test: VerifyReferences.................. WPDC02 passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom......................... ForestDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation.......................ForestDnsZones passed test

CrossRefValidation

Running partition tests on : DomainDnsZones

Starting test: CheckSDRefDom......................... DomainDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation......................... DomainDnsZones passed test

CrossRefValidation

Running partition tests on : Schema

Starting test: CheckSDRefDom......................... Schema passed test CheckSDRefDom

Starting test: CrossRefValidation......................... Schema passed test CrossRefValidation

Running partition tests on : Configuration

Starting test: CheckSDRefDom......................... Configuration passed test CheckSDRefDom

Starting test: CrossRefValidation......................... Configuration passed test CrossRefValidation

Running partition tests on : westpark

Starting test: CheckSDRefDom......................... westpark passed test CheckSDRefDom

Starting test: CrossRefValidation......................... westpark passed test CrossRefValidation

Running enterprise tests on : westpark.local

Starting test: LocatorCheck......................... westpark.local passed test LocatorCheck

Starting test: Intersite......................... westpark.local passed test Intersite

N:\>dcdiag /s:westpark.local

TashiDuks · August 13, 2013

its static..

kevin_lane · August 13, 2013

?? sorry what do you mean

TashiDuks · August 13, 2013

I mean to say server and client use static ip address. I have run dcdiag /s:rdb.bt and has following result:

Result from DC server:

Directory Server Diagnosis

Performing initial setup:

* Identified AD Forest.

Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\RDB-ADC

Starting test: Connectivity

......................... RDB-ADC passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\RDB-ADC

Starting test: Advertising

......................... RDB-ADC passed test Advertising

Starting test: FrsEvent

......................... RDB-ADC passed test FrsEvent

Starting test: DFSREvent

The event log DFS Replication on server RDB-ADC.RDB.bt could not be

queried, error 0x6ba "The RPC server is unavailable."

......................... RDB-ADC failed test DFSREvent

Starting test: SysVolCheck

......................... RDB-ADC passed test SysVolCheck

Starting test: KccEvent

The event log Directory Service on server RDB-ADC.RDB.bt could not

be queried, error 0x6ba "The RPC server is unavailable."

......................... RDB-ADC failed test KccEvent

Starting test: KnowsOfRoleHolders

......................... RDB-ADC passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... RDB-ADC passed test MachineAccount

Starting test: NCSecDesc

......................... RDB-ADC passed test NCSecDesc

Starting test: NetLogons

......................... RDB-ADC passed test NetLogons

Starting test: ObjectsReplicated

......................... RDB-ADC passed test ObjectsReplicated

Starting test: Replications

......................... RDB-ADC passed test Replications

Starting test: RidManager

......................... RDB-ADC passed test RidManager

Starting test: Services

......................... RDB-ADC passed test Services

Starting test: SystemLog

The event log System on server RDB-ADC.RDB.bt could not be queried,

error 0x6ba "The RPC server is unavailable."

......................... RDB-ADC failed test SystemLog

Starting test: VerifyReferences

......................... RDB-ADC passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom