Group Policy only applying if 2003 DC's are still switched on

[pantscat]

That's good - replication seems happy. Have you tried creating something on DC01\netlogon and making sure it replicates to the other DCs?

 

Is there any thing flagged up in dcdiag?

[theeggmaster]

Run DCDIAG from a command prompt on all your DCs - this should highlight any issues.

 

I've ran it on all four DC's. The two new ones report no errors. The two older ones report errors on systemlog.

[pantscat]

Ok - those servers will have some errors in the System log in Event Viewer - could be worth checking what they are.

[DMcCoy]

Did you make one of the new ones a global catalogue?

 

Edit: Ah, ok, the instructions linked get you to do it.

 

Do check the existing GPOs to make sure they aren't setting a DNS server, you can with GP, but it's a bad idea.

Edited June 2, 2015 by DMcCoy

[mikkydoos]

Just incidentally, have you got your new DC's pointing at each other for their own DNS or are they still pointing to the 2003 box ?

 

And you never said if you de-promoted or removed the master schema etc the 2003's.

 

And have you tried re-joining one of the problematic clients to the domain ?

Edited June 2, 2015 by mikkydoos

[theeggmaster]

Ok - those servers will have some errors in the System log in Event Viewer - could be worth checking what they are.

 

Yes, I'll trawl through the Event Viewer logs. A quick glance shows printer errors so far, but I'm sure there's more interesting stuff in there.

[theeggmaster]

Just incidentally, have you got your new DC's pointing at each other for their own DNS or are they still pointing to the 2003 box ?

 

And you never said if you de-promoted or removed the master schema etc the 2003's.

 

And have you tried re-joining one of the problematic clients to the domain ?

 

The new DC's are pointing at each other for DNS, not the old servers.

 

By de-promote or remove the master schema, I'm assuming you mean moving all of the FSMO roles? I've transferred them onto the new DC's, but when I run Dsquery * cn=infrastructure,dc=forestdnszones,dc=MY_domain,dc=com –attr fsmoroleowner it shows the old DC as the fsmoroleowner

 

I haven't tried re-joining one of the clients, as some of them are intermittently working and not working.

[mikkydoos]

By de-promote or remove the master schema, I'm assuming you mean moving all of the FSMO roles? I've transferred them onto the new DC's, but when I run Dsquery * cn=infrastructure,dc=forestdnszones,dc=MY_domain,dc=com –attr fsmoroleowner it shows the old DC as the fsmoroleowner

 

That'll be it I think. That's probably the cause. It must be that one of them is still broadcasting as a PDC.

 

Run 'netdom query fmso' on the 2003's and see what state they're still in.

 

I think you'll need to run dcpromo on the 2003's and un-DC them or remove the AD roles on those servers.

 

 

This is the guide I followed a year ago -

 

Very good and takes you through all the steps you need. Might be an idea to go through it carefully and perform each step to verify what you've already done already is and functioning.

 

Worked a charm for me with the same setup.

[theeggmaster]

@pantscat I've checked through the error logs, and they're either printer driver errors or KDC etype errors because Server 2003 doesn't support the same Kerberos types as Server 2008/2012 (The message is While processing a TGS request for the target server krbtgt/...)

 

Other than those errors, dcdiag is clean on all servers.

[pantscat]

Well, in that case then only thing you've really got left to do is demote the old DCs.

[mikkydoos]

Well, in that case then only thing you've really got left to do is demote the old DCs.

 

DCDiag only tells you what is or isnt functioning on your DC. Netdom query will tell you what is authoritive and not.

 

 

 

and test your DNS.....

 

 

verify whether DNS is working correctly ?

 

After you have setup your DNS Server, it's very important to check that the entries which are populated to the Internet are correct. You can use the following checklist using nslookup.

 

Start nslookup for the desired DNS Server

 

nslookup

> server 193.247.121.196

Default Server: rabbit.akadia.ch

Address: 193.247.121.196

 

Check Start of Authority (SOA)

 

> set q=SOA

> akadia.com

Server: rabbit.akadia.ch

Address: 193.247.121.196

 

akadia.com

origin = rabbit.akadia.com

mail addr = postmaster.akadia.com

serial = 2000061501

refresh = 10800 (3H)

retry = 3600 (1H)

expire = 604800 (1W)

minimum ttl = 86400 (1D)

akadia.com nameserver = rabbit.akadia.com

akadia.com nameserver = lila.thenet.ch

rabbit.akadia.com internet address = 193.247.121.196

lila.thenet.ch internet address = 193.135.252.2

 

Check the Nameservers (NS)

 

> set q=NS

> akadia.com

Server: rabbit.akadia.ch

Address: 193.247.121.196

 

akadia.com nameserver = lila.thenet.ch

akadia.com nameserver = rabbit.akadia.com

lila.thenet.ch internet address = 193.135.252.2

rabbit.akadia.com internet address = 193.247.121.196

 

Check E-Mail MX-Records (MX)

 

> set q=MX

> akadia.com

Server: rabbit.akadia.ch

Address: 193.247.121.196

 

akadia.com preference = 20, mail exchanger = opal.akadia.com

akadia.com preference = 10, mail exchanger = rabbit.akadia.com

akadia.com nameserver = rabbit.akadia.com

akadia.com nameserver = lila.thenet.ch

opal.akadia.com internet address = 193.247.121.197

rabbit.akadia.com internet address = 193.247.121.196

lila.thenet.ch internet address = 193.135.252.2

 

Check everything (ANY)

 

> set q=any

> akadia.com

Server: rabbit.akadia.ch

Address: 193.247.121.196

 

akadia.com preference = 10, mail exchanger = rabbit.akadia.com

akadia.com preference = 20, mail exchanger = opal.akadia.com

akadia.com nameserver = rabbit.akadia.com

akadia.com nameserver = lila.thenet.ch

akadia.com

origin = rabbit.akadia.com

mail addr = postmaster.akadia.com

serial = 2000061501

refresh = 10800 (3H)

retry = 3600 (1H)

expire = 604800 (1W)

minimum ttl = 86400 (1D)

akadia.com nameserver = rabbit.akadia.com

akadia.com nameserver = lila.thenet.ch

rabbit.akadia.com internet address = 193.247.121.196

opal.akadia.com internet address = 193.247.121.197

lila.thenet.ch internet address = 193.135.252.2

 

Lookup all hosts within a domain

 

> ls -d akadia.com

Edited June 4, 2015 by mikkydoos

[pantscat]

Yes, that's good advice.

Make sure DNS is absolutely working.

[theeggmaster]

Everything seems fine apart from:

 

Lookup all hosts within a domain

 

> ls -d akadia.com

 

Where I get:

The DNS server refused to transfer the zone to your computer. If this is incorrect, check the zone transfer security settings for on the DNS server at IP address .

Allow zone transfers is not ticked on DNS

Edited June 4, 2015 by theeggmaster

[sted]

with 2003 are your dns zones set to be saved in active directory as iirc on 2003 default was save on that pc rather than directly in ad maybe the 2003 boxes each have their own dns which as far as they can see is working right but is different to the active directory integrated dns on the newer servers Edited June 4, 2015 by sted

[theeggmaster]

with 2003 are your dns zones set to be saved in active directory as iirc on 2003 default was save on that pc rather than directly in ad maybe the 2003 boxes each have their own dns which as far as they can see is working right but is different to the active directory integrated dns on the newer servers

 

They are set to be AD integrated and to replicate to all DNS servers in our AD domain on the 2003 servers.

[pantscat]

Everything seems fine apart from:

 

 

 

Where I get:

The DNS server refused to transfer the zone to your computer. If this is incorrect, check the zone transfer security settings for on the DNS server at IP address .

Allow zone transfers is not ticked on DNS

 

Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS?

If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain.

[mikkydoos]

Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS?

If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain.

 

 

Check these settings on your primary 2012 DC m8.....properties of your Forward Lookup Zone....

 

 

 

Edited June 4, 2015 by mikkydoos

[theeggmaster]

 

 

[theeggmaster]

Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS?

If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain.

 

Here's a screenshot of the cmd window

 

[ATTACH=CONFIG]30794[/ATTACH]

[mikkydoos]

OK. Take the old ones out and they shouldnt be looked for anymore. DHCP will issue any valid DNS server. Not necessarily your DC-02.

 

You can test this by doing an IPconfig /all on your PC, after you ipconfig /release and ipconfig /renew your DHCP lease.

 

If you an IPconfig before you remove them it should list them. They should be gone when you've removed them.

 

That'll probably do it. Then you can fully demote the 2003's and remove the roles. Then switch them off.

 

- - - Updated - - -

 

Here's a screenshot of the cmd window

 

[ATTACH=CONFIG]30794[/ATTACH]

 

That attachment doesnt work

Edited June 4, 2015 by mikkydoos

[pantscat]

I'm not sure that's the right thing to do - you should configure what nameservers clients use by configuring those options in DHCP.

 

I'd let dcpromo remove the servers from DNS when you demote them.

[mikkydoos]

I'm not sure that's the right thing to do - you should configure what nameservers clients use by configuring those options in DHCP.

 

I'd let dcpromo remove the servers from DNS when you demote them.

@pantscat thats probably sage advice. Good call. I think the fact that he hasn't demoted them though is a point!

[pantscat]

No worries, @mikkydoos.

 

I do think demotion is the problem - if a DC is turned off, then some clients might still try to contact it thus causing GPO processing issues.

It's just by-design - DCs aren't meant to be switched off.

[mikkydoos]

@pantscat Totally m8. Bang on.

 

Check this too @theeggmaster, like @pantscat says....

 

[tmcd35]

I think I know what is going on. Just quickly read through the thread and not 100% sure if this as been checked yet, doesn't look like it. Did you say you haven't demoted the old servers, just switched them off?

 

In DNS take a look under -> \Forward Lookup Zones\_msdcs.\dc\_sites\_tcp and tell me what you see. I suspect your old servers are still listed here, and under other subtrees in _msdcs. Mainly because the old servers are not demoted to DNS/AD still thinks they are valid domain controllers.

 

The clients are asking to communicate with a DC, they don't care which. DNS is responding randomly with what it thinks is still a valid DC, but the DC it chooses is switched off - thus the problem.

 

I'd demote the old DC's and make sure the _msdcs subtrees are properly cleaned up, then see if your problems still persist after that.