Replacing old DC problems.

[forde52]

Hi guys,

 

I'm having a very odd problem trying to replace a Old DC with a new one.

 

On the old server, when entering the new server name at the Change Directory Server screen in ADUC (when trying to transfer the FSMO roles from the old server to the new one), I get the following error:

But if you attempt it from the other way round, ADUC on the new server can change to the old server and back with no problems.

 

If I then transfer the roles on the new server, the old server reports ERROR for the operation master for all the roles transferred.

 

Is there something major I've missed out?

 

Both servers are running 2008R2 Datacenter if this helps?

 

Thanks in advance!

[pantscat]

First step - try DCDIAG from a command prompt and see if there are any issues?

[forde52]

Thanks for your reply!

 

I've ran DCDIAG on both servers and attached the results to this post. They're both showing errors, but the errors appear to be caused by the old server more than the new one.

I wouldn't know where to start with most of these errors, so any help is much appreciated!

 

DCDiag_NewDC.txt

DCDiag_OldDC.txt

[Michael]

My immediate thoughts are a DNS issue, as Windows Server will no doubt try resolve the FQDN of the new DC. Is DNS able to replicate across both servers? I'd check each Forward and Reverse Lookup Zones on both servers.

[forde52]

I know at one point the DNS wasn't replicating, but since then I have removed the new server and added it again. I'll take a look now and see if they're both the same!

[forde52]

Just had a look at both servers dns records, and they're not showing the same entries. The new server has a computer listed that the old one doesn't. So i'm guessing that's problem number 1?

[Michael]

To speed things up (on the new server), if you type ipconfig /registerdns it'll register within 15 minutes (or something like that).

 

I'd also make sure the old DC and new DC IP config is correct i.e.

 

Old DC: 192.168.1.1 (first)

New DC: 192.168.1.2 (second)

 

New DC: 192.168.1.2 (first)

Old DC: 192.168.1.1 (second)

 

DNS will be the root of this problem. Once DNS is fixed, you'll be able to transfer roles. It is vital this is working, otherwise your end users will complain about logging on speeds etc... worse case scenario.

[forde52]

I'll go check them now, I've got the feeling they might be the other way round so i'll sort them.

One other thing to add is the old server is running unresponsively slow, so I'm having to do most stuff through CMD as the GUI is crashing out all the time. Could this be DNS related as well?

[Michael]

I'll go check them now, I've got the feeling they might be the other way round so i'll sort them.

One other thing to add is the old server is running unresponsively slow, so I'm having to do most stuff through CMD as the GUI is crashing out all the time. Could this be DNS related as well?

 

A slowness of a server should simply mean it'd take longer to process requests, such as transferring roles. The immediate solution is to give the server a reboot (if it's been a while), or alternatively stop some unrequired services to free up resources.

[forde52]

Oh right ok, It's had plenty of restarts the past few days so not sure what's going on there.

I've just changed the DNS settings on the old server through CMD, and i've just been met with the following error

Should this worry me or should I just ignore it?

(.14 is the old server and .16 is the new server)

Edited November 14, 2013 by forde52

[Michael]

Have you disabled the built in Windows Firewall on both servers? This could be creating your DNS issue, as servers are unable to replicate.

[forde52]

I have yes, I thought that might have been an issue but it appears it hasn't made a difference.

[sted]

just a thought is dns set to be stored in active directory I occasionally wonder why it wont replicate only to find its set to be stored locally not in ad?

 

I presume they each have themselves and the other server listed as dns server in their nics properties and can ping each other by name and ip?

[Michael]

The other possibility is a switch issue - if you have VLANs setup or just a fault with your switch in general?

 

I agree with the above - DNS should be integrated with AD these days. There are few reasons not to.

[forde52]

DNS on both servers is saying it is Active Directory-Integrated. Both servers have themselves and the other server in the Nic's DNS settings. They can both ping each other by name and ip as well. So it's looking like it's not a network connectivity issue?

[Michael]

DNS on both servers is saying it is Active Directory-Integrated. Both servers have themselves and the other server in the Nic's DNS settings. They can both ping each other by name and ip as well. So it's looking like it's not a network connectivity issue?

 

Yep I'd agree, but can you ping by servername? curricsvr1.schoolname.pri etc...

[forde52]

I can yes, FQDN and computer name both work fine. So the server's can "see" each other to some extent.

[sted]

what about ad sites and services anything there that shouldn't be isn't there that should as there may be a link to some long gone server in there (as iirc demoting a server dosent remove it from here) or possibly some long gone server has 1 or more fismo roles

[Michael]

Hmm, OK so I see no reason why you can't transfer FSMO roles! That's really got me stumped, I must admit.

 

Do the event logs show any errors which are of particular interest?

[forde52]

what about ad sites and services anything there that shouldn't be isn't there that should as there may be a link to some long gone server in there (as iirc demoting a server dosent remove it from here) or possibly some long gone server has 1 or more fismo roles

 

Nothing looks out of place in Sites and Services, it's showing the two servers and their properties.

[forde52]

Hmm, OK so I see no reason why you can't transfer FSMO roles! That's really got me stumped, I must admit.

Haha, you're not the only one!

 

Do the event logs show any errors which are of particular interest?

 

The event log on both servers is showing this error:

 

"Windows® Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services® for Windows user .

 

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

 

Verify that the Windows user is in Active Directory Domain Services and has access permissions."

 

Plus another one which shows the domain admin account instead of SYSTEM. I'm guessing that's not good?

[Michael]

Sites and Services is something I've never messed with as there's no need!

 

Looking at security of a DC I'm working on, it reads:

 

Authenticated Users - Read

SYSTEM - Full

Enterprise Read-only Domain Controllers (think this is optional)

Domain Admins - Full

Enterprise Admins - Full

 

This is on NTDS Settings.

 

As for UNIX, I'm not too worried about this so you should be able to ignore it. I presume you had a NAS or a server that was running UNIX?

[forde52]

We never had a UNIX server, but we do have 2 Mac clients which connect to file shares on the network (not joined to the domain as it seemed a bit of a fuss), so that could be what it's on about? Just checked and they can still connect to the shares so I'll just ignore that error for now.

 

Had a look at the security on these two, and the settings are the same as what you've posted above.

 

If this helps I've just tried connecting to a file share on the new server from the old one and got this message:

So, this old server thinks it doesn't have permission to access the new one I'm guessing?

[Michael]

Hmm that's interesting. I wonder if there's a problem with the computer account of the new server?

 

If possible, try demoting it and re-promoting as a DC. Certainly worth a try.

[forde52]

You'd be surprised at how many time's I've tried that the past few days. Every other computer on the network can access shares on it, just not the old DC. So with that in mind I'm thinking it's something with the old DC that's not right. It's always had errors with the RPC server as well (when you've tried to do a RSOP for example).

 

It's as if the old DC just won't let go. The domain originally ran on a 2003R2 box but that got replaced nearly 2 years ago now, and everything was fine then, so it is something recent I think.