Upgraded Domain now can't logon

[karldenton]

Hi all

 

Bit of urgent help please.

 

Just added a 2012r2 domain controller to the domain.

 

Moved all 5 fsmo roles across to it.

 

However when people try to logon now it says "there are no logon servers to process your request".

 

I can't browse to \\xxxx\netlogon either -- but it was there before i ran dcpromo on old 2003server.

 

Any ideas?

 

Thanks

[3s-gtech]

Do you have any other DCs still in place?

[Firefox]

I assume this "However when people try to logon now it says "there are no logon servers to process your request"." is when users are trying to authenticate from their devices? Can you log directly onto the new 2012 DC?

[X-13]

Try pulling the ethernet out and using the cached profile.

 

You may be able to get in to look at whether it's trying to connect to the old server...

[jamesreedersmith]

are the new servers global catalog servers?

[tmcd35]

I take it you can log in to the new server? I assume from transferring your FSMO roles and running dcpromo on the old server it's the only DC on the network?

 

That being the case, first thing to check is that DC replication completed before you removed the old DC. I take it all user and computer accounts appear correctly in the new DC?

 

Next check would be DNS. You don't have anything in DNS that points to the old DC do you? If so, remove it. You need to go through DNS with a fine tooth comb, some of the entries can be pretty deep.

 

Also, check you DHCP settings. Are they giving out your old servers IP for DNS? If so your clients are looking in the wrong place thus the error.

 

If that doesn't fix it, have you tried logging into a computer as local admin and then re-adding to the domain. Just in case the trust relationship has gone belly up?

 

I'd be 99.999% certain on a DNS issue, either rogue entry in DNS or DHCP giving out incorrect IP for DNS.

Edited August 6, 2014 by tmcd35

[karldenton]

Thanks everyone.

 

Correct there is currently only 1 dc (the new 2012 one). Everything replicated fine and all accounts are in AD on new machine. The new dc is a global catalog. Will double check fns and dhcp tomorrow as i can log onto the dc directly no problem

 

Thanks

[3s-gtech]

Possible there are just some old entries in DNS and ADSI Edit (worth a check to see if your old DC persists in there) and clients are still pointing to them as a result.

[SHimmer45]

DCDIAG would be worth running as any references to old DC's would show up in there.

[karldenton]

OK found the cause of the problem. We also have an admin domain which about 5 staff used. I've joined there pc's to the school domain but the admin server still is running until next week. However when I've done ipconfig on a client on the school domain the admin domain has given there IP address out -- there is a 1 way trust rom admin to school.

 

Any help on how to solve would be appreciated -- can i just remove DHCP from the admin server?

[karldenton]

The DNS Server setting in DHCP was also set to old server -- gee I must have been tired yesterday when I did this

[3s-gtech]

Not a good plan to have two independent DHCP servers running that can dish out IPs without some rules in place about specific ranges and DNS integration. You should be able to switch the other DHCP server off, so long as your main DHCP server will cover the full range of addresses that the other served.