tazz Posted December 5, 2007 Posted December 5, 2007 Hi, I just thought I'd tidy up the AD and deleted some objects that I thought no longer existed - I inherited this network two years ago. 2 of these things were NTSRV1 and NTSERVER - we don't have any servers of that name so I deleted them. I was given a choice of demoting them as they were apparently DCs (but my 2 existing DCs still remain) but I chose an option along the lines of "this DC no longers exists and will never be used" or something. Since then it is taking eons for users to log on to workstations. It takes ages to get past "loading your personal settings...." Logging off is still dead quick though. Any tips will be most welcome!
Dos_Box Posted December 5, 2007 Posted December 5, 2007 Oh. Dear. Right what you need to do first is to ensure that none of the FSMO roles were assigned to the old servers and that AD is pointing to the current role holders. http://support.microsoft.com/kb/324801 Clear DNS of any referances of them if you can and ensure that they are not still listed as forwarders etc. Then check that their computer accounts are removed. I have to be honest here, I've had AD die before and nothing ever brings it back. Even schema restores are never sucessful. Unfortuneately AD is not perfect and does break easily.
tazz Posted December 5, 2007 Author Posted December 5, 2007 I love you Dos_Box! That worked - boy do I need to go on a course!!
djm968 Posted December 5, 2007 Posted December 5, 2007 Lucky Guy! I had to rebuild two DC's from a Syatem State Backup becuase someone did exactly what you did 3 days work! May I suggest that in future you consult edugoogle before you click OK in future. That click could have cost you your Job and the School money to fix it.
djm968 Posted December 5, 2007 Posted December 5, 2007 Thanks djm, 'nuff said. Sorry just read that back and it sounded very condescending… :oops:
Heebeejeebee Posted December 5, 2007 Posted December 5, 2007 AD borked on us a few months ago and it took us 3 days to fix the servers and to go round all the machines and take them off the domain and put them back on again. (?) This was the only way we could get the machines to connect again after a System State restore. Still not found the reason why it dropped a server out of AD but apparently it does happen. HBJB
Dos_Box Posted December 6, 2007 Posted December 6, 2007 I love you Dos_Box! That worked - boy do I need to go on a course!! I am glad, a borked AD is a heart stuttering affair at the best of times. Which bit fixed it BTW?
zag Posted December 6, 2007 Posted December 6, 2007 I've had an "Active directory is re-indexing" >> "re-indexing failed please reboot your server" on our main DC a while back. That was fun repairing Luckily you should always have 2 DC's in the school and I have learned to have them on simple workstations that can be easily fixed. There are lots of knowledge based articles on removing a DC from the schema and DNS, its not really a complicated process but can solve alot of problems.
Heebeejeebee Posted December 6, 2007 Posted December 6, 2007 Hmmm, here's something that I can't find by Googling: If one of your DCs has an issue with AD does that problem replicate to the others or do any others somehow know that it's borked and put a good copy back? HBJB
zag Posted December 6, 2007 Posted December 6, 2007 When mine went tits up the other DC was absolutely fine.
tazz Posted December 6, 2007 Author Posted December 6, 2007 Changing the schema master role fixed it Dos_Box - thanks again. I'm a lucky gal BTW djm968!
djm968 Posted December 6, 2007 Posted December 6, 2007 Changing the schema master role fixed it Dos_Box - thanks again. I'm a lucky gal BTW djm968! Sorry tazz........ I always put my foot in it! :oops:
Grommit Posted December 6, 2007 Posted December 6, 2007 One question...... If the DC with the FMSO roles on crashes can the users still log on ?
djm968 Posted December 6, 2007 Posted December 6, 2007 If the the DC is also the Global Catalog then not normally no. However you should not have all your eggs in one basket so to speak ie. split the rolls accross other DC's
zag Posted December 10, 2007 Posted December 10, 2007 One question...... If the DC with the FMSO roles on crashes can the users still log on ? Actually, yes they can, but I needed to sort out the DNS on the clients first(as our primary dns was also on the server that failed).
maniac Posted December 10, 2007 Posted December 10, 2007 I've never suceeded in getting users to log onto the network when the main DC fails no matter what I do the roles. The second DC is functioning fine, just seems reluctant to take on any of the roles when the otherone's not available. I see our second DC as more of a 'live backup' of our main one, that will need a bit of tweeking to bring it online in an emergency. Our network manages fine with 1 DC doing all the work. Mike.
projector1 Posted December 10, 2007 Posted December 10, 2007 I've never suceeded in getting users to log onto the network when the main DC fails no matter what I do the roles. The second DC is functioning fine, just seems reluctant to take on any of the roles when the otherone's not available. I see our second DC as more of a 'live backup' of our main one, that will need a bit of tweeking to bring it online in an emergency. Our network manages fine with 1 DC doing all the work. Mike. i have this issue too however our other dc is a different domian (ADMIN DOMIAN) the circ domian has only on DC and is the dhcp server for the two domians. The two servers have zone transfer setup but when the circ server goes down them admin users cannot login. (our circ server is now 6 years old and supporting twice the number of clients too)
Dos_Box Posted December 10, 2007 Posted December 10, 2007 Have DNS on the second DC then. It's active directory. You have DNS on ALL domain controllers. DNS is how AD replication is held together.
FN-GM Posted December 10, 2007 Posted December 10, 2007 But you have to install DNS on the second domain controller it isn't installed by default. Z
Grommit Posted December 11, 2007 Posted December 11, 2007 I've never suceeded in getting users to log onto the network when the main DC fails no matter what I do the roles. The second DC is functioning fine, just seems reluctant to take on any of the roles when the otherone's not available. I see our second DC as more of a 'live backup' of our main one, that will need a bit of tweeking to bring it online in an emergency. Our network manages fine with 1 DC doing all the work. Mike. i have this issue too however our other dc is a different domian (ADMIN DOMIAN) the circ domian has only on DC and is the dhcp server for the two domians. The two servers have zone transfer setup but when the circ server goes down them admin users cannot login. (our circ server is now 6 years old and supporting twice the number of clients too) I agree... but I hear people saying the reson for having 2 or more Domain Controllers so that if the a DC falls over the others will take it's place... Yet I have never been able to get another DC to take it's place.. How come Ranger gets installed on 2 DCs so that if one falls over the other will allow users to log on... yet it never seems to work.. My 3 DCs have AD, DNS, Printing roles installed..
eejit Posted December 11, 2007 Posted December 11, 2007 You also need a split DHCP really. We've been through this before at some stage and I remember actually testing it during the holidays. You can log on if the Global Catalogue is missing, so the most important thing (from the client point of view) is to have a DNS server and a DHCP server available.
zag Posted December 11, 2007 Posted December 11, 2007 Yep as long as you have a backup DNS and your clients point towards it you should be able to log on fine. That's why there is a secondary DNS field on the clients network configs. You also have to think about things like DHCP, Wins and in our case the global policies all couldn't be edited so we had to recreate those which took a few hours. The SYSVOL folder is supposed to be replicated so its worth checking that on your backup server as well.
Heebeejeebee Posted December 11, 2007 Posted December 11, 2007 SYSVOL, NETLOGON and AD are the main three that are replicated. Make sure any logon scripts/profiles etc that point to your main DC use the %logonserver% variable instead of a path to the main DC. EG a logon script in NETLOGON folder may be set as \\LOGON1\\NETLOGON\Script1.bat when it's best to use %logonserver%\NETLOGON\Script1.bat since it will obviously not work if LOGON1 is down. Using this variable means that it will pull it from whichever server your user is logged into at the time. Our machines seem to be spilt roughly down the middle as to which they log into. I'm not sure how it does this but it seems to spread the load quite well. We have 2 DCs and we recently tested our setup by pulling the network lead from DC1 to see if things were working OK (after school I hasten to add). All we had to do was log off then back on again to pick up all the replicated stuff (re-directed menus etc). We have DNS on both the DCs and the second part of a split DHCP scope on DC2. I also keep all of the DHCP reservations in a Netsh dump file for easy import if I need it. HBJB
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now