pantscat Posted June 2, 2015 Posted June 2, 2015 That's good - replication seems happy. Have you tried creating something on DC01\netlogon and making sure it replicates to the other DCs? Is there any thing flagged up in dcdiag?
theeggmaster Posted June 2, 2015 Author Posted June 2, 2015 Run DCDIAG from a command prompt on all your DCs - this should highlight any issues. I've ran it on all four DC's. The two new ones report no errors. The two older ones report errors on systemlog.
pantscat Posted June 2, 2015 Posted June 2, 2015 Ok - those servers will have some errors in the System log in Event Viewer - could be worth checking what they are.
DMcCoy Posted June 2, 2015 Posted June 2, 2015 (edited) Did you make one of the new ones a global catalogue? Edit: Ah, ok, the instructions linked get you to do it. Do check the existing GPOs to make sure they aren't setting a DNS server, you can with GP, but it's a bad idea. Edited June 2, 2015 by DMcCoy 1
mikkydoos Posted June 2, 2015 Posted June 2, 2015 (edited) Just incidentally, have you got your new DC's pointing at each other for their own DNS or are they still pointing to the 2003 box ? And you never said if you de-promoted or removed the master schema etc the 2003's. And have you tried re-joining one of the problematic clients to the domain ? Edited June 2, 2015 by mikkydoos
theeggmaster Posted June 3, 2015 Author Posted June 3, 2015 Ok - those servers will have some errors in the System log in Event Viewer - could be worth checking what they are. Yes, I'll trawl through the Event Viewer logs. A quick glance shows printer errors so far, but I'm sure there's more interesting stuff in there.
theeggmaster Posted June 3, 2015 Author Posted June 3, 2015 Just incidentally, have you got your new DC's pointing at each other for their own DNS or are they still pointing to the 2003 box ? And you never said if you de-promoted or removed the master schema etc the 2003's. And have you tried re-joining one of the problematic clients to the domain ? The new DC's are pointing at each other for DNS, not the old servers. By de-promote or remove the master schema, I'm assuming you mean moving all of the FSMO roles? I've transferred them onto the new DC's, but when I run Dsquery * cn=infrastructure,dc=forestdnszones,dc=MY_domain,dc=com –attr fsmoroleowner it shows the old DC as the fsmoroleowner I haven't tried re-joining one of the clients, as some of them are intermittently working and not working.
mikkydoos Posted June 3, 2015 Posted June 3, 2015 By de-promote or remove the master schema, I'm assuming you mean moving all of the FSMO roles? I've transferred them onto the new DC's, but when I run Dsquery * cn=infrastructure,dc=forestdnszones,dc=MY_domain,dc=com –attr fsmoroleowner it shows the old DC as the fsmoroleowner That'll be it I think. That's probably the cause. It must be that one of them is still broadcasting as a PDC. Run 'netdom query fmso' on the 2003's and see what state they're still in. I think you'll need to run dcpromo on the 2003's and un-DC them or remove the AD roles on those servers. This is the guide I followed a year ago - Very good and takes you through all the steps you need. Might be an idea to go through it carefully and perform each step to verify what you've already done already is and functioning. Worked a charm for me with the same setup. 1
theeggmaster Posted June 4, 2015 Author Posted June 4, 2015 @pantscat I've checked through the error logs, and they're either printer driver errors or KDC etype errors because Server 2003 doesn't support the same Kerberos types as Server 2008/2012 (The message is While processing a TGS request for the target server krbtgt/...) Other than those errors, dcdiag is clean on all servers.
pantscat Posted June 4, 2015 Posted June 4, 2015 Well, in that case then only thing you've really got left to do is demote the old DCs.
mikkydoos Posted June 4, 2015 Posted June 4, 2015 (edited) Well, in that case then only thing you've really got left to do is demote the old DCs. DCDiag only tells you what is or isnt functioning on your DC. Netdom query will tell you what is authoritive and not. and test your DNS..... verify whether DNS is working correctly ? After you have setup your DNS Server, it's very important to check that the entries which are populated to the Internet are correct. You can use the following checklist using nslookup. Start nslookup for the desired DNS Server nslookup > server 193.247.121.196 Default Server: rabbit.akadia.ch Address: 193.247.121.196 Check Start of Authority (SOA) > set q=SOA > akadia.com Server: rabbit.akadia.ch Address: 193.247.121.196 akadia.com origin = rabbit.akadia.com mail addr = postmaster.akadia.com serial = 2000061501 refresh = 10800 (3H) retry = 3600 (1H) expire = 604800 (1W) minimum ttl = 86400 (1D) akadia.com nameserver = rabbit.akadia.com akadia.com nameserver = lila.thenet.ch rabbit.akadia.com internet address = 193.247.121.196 lila.thenet.ch internet address = 193.135.252.2 Check the Nameservers (NS) > set q=NS > akadia.com Server: rabbit.akadia.ch Address: 193.247.121.196 akadia.com nameserver = lila.thenet.ch akadia.com nameserver = rabbit.akadia.com lila.thenet.ch internet address = 193.135.252.2 rabbit.akadia.com internet address = 193.247.121.196 Check E-Mail MX-Records (MX) > set q=MX > akadia.com Server: rabbit.akadia.ch Address: 193.247.121.196 akadia.com preference = 20, mail exchanger = opal.akadia.com akadia.com preference = 10, mail exchanger = rabbit.akadia.com akadia.com nameserver = rabbit.akadia.com akadia.com nameserver = lila.thenet.ch opal.akadia.com internet address = 193.247.121.197 rabbit.akadia.com internet address = 193.247.121.196 lila.thenet.ch internet address = 193.135.252.2 Check everything (ANY) > set q=any > akadia.com Server: rabbit.akadia.ch Address: 193.247.121.196 akadia.com preference = 10, mail exchanger = rabbit.akadia.com akadia.com preference = 20, mail exchanger = opal.akadia.com akadia.com nameserver = rabbit.akadia.com akadia.com nameserver = lila.thenet.ch akadia.com origin = rabbit.akadia.com mail addr = postmaster.akadia.com serial = 2000061501 refresh = 10800 (3H) retry = 3600 (1H) expire = 604800 (1W) minimum ttl = 86400 (1D) akadia.com nameserver = rabbit.akadia.com akadia.com nameserver = lila.thenet.ch rabbit.akadia.com internet address = 193.247.121.196 opal.akadia.com internet address = 193.247.121.197 lila.thenet.ch internet address = 193.135.252.2 Lookup all hosts within a domain > ls -d akadia.com Edited June 4, 2015 by mikkydoos 1
pantscat Posted June 4, 2015 Posted June 4, 2015 Yes, that's good advice. Make sure DNS is absolutely working.
theeggmaster Posted June 4, 2015 Author Posted June 4, 2015 (edited) Everything seems fine apart from: Lookup all hosts within a domain > ls -d akadia.com Where I get: The DNS server refused to transfer the zone to your computer. If this is incorrect, check the zone transfer security settings for on the DNS server at IP address . Allow zone transfers is not ticked on DNS Edited June 4, 2015 by theeggmaster
sted Posted June 4, 2015 Posted June 4, 2015 (edited) with 2003 are your dns zones set to be saved in active directory as iirc on 2003 default was save on that pc rather than directly in ad maybe the 2003 boxes each have their own dns which as far as they can see is working right but is different to the active directory integrated dns on the newer servers Edited June 4, 2015 by sted
theeggmaster Posted June 4, 2015 Author Posted June 4, 2015 with 2003 are your dns zones set to be saved in active directory as iirc on 2003 default was save on that pc rather than directly in ad maybe the 2003 boxes each have their own dns which as far as they can see is working right but is different to the active directory integrated dns on the newer servers They are set to be AD integrated and to replicate to all DNS servers in our AD domain on the 2003 servers.
pantscat Posted June 4, 2015 Posted June 4, 2015 Everything seems fine apart from: Where I get: The DNS server refused to transfer the zone to your computer. If this is incorrect, check the zone transfer security settings for on the DNS server at IP address . Allow zone transfers is not ticked on DNS Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS? If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain.
mikkydoos Posted June 4, 2015 Posted June 4, 2015 (edited) Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS? If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain. Check these settings on your primary 2012 DC m8.....properties of your Forward Lookup Zone.... Edited June 4, 2015 by mikkydoos 1
theeggmaster Posted June 4, 2015 Author Posted June 4, 2015 Is that the whole error message? are you definitely typing the domain name as it's displayed in DNS? If you look under "Forward lookup zones" in DNS, the first folder will be the full name of the domain. Here's a screenshot of the cmd window [ATTACH=CONFIG]30794[/ATTACH]
mikkydoos Posted June 4, 2015 Posted June 4, 2015 (edited) OK. Take the old ones out and they shouldnt be looked for anymore. DHCP will issue any valid DNS server. Not necessarily your DC-02. You can test this by doing an IPconfig /all on your PC, after you ipconfig /release and ipconfig /renew your DHCP lease. If you an IPconfig before you remove them it should list them. They should be gone when you've removed them. That'll probably do it. Then you can fully demote the 2003's and remove the roles. Then switch them off. - - - Updated - - - Here's a screenshot of the cmd window [ATTACH=CONFIG]30794[/ATTACH] That attachment doesnt work Edited June 4, 2015 by mikkydoos
pantscat Posted June 4, 2015 Posted June 4, 2015 I'm not sure that's the right thing to do - you should configure what nameservers clients use by configuring those options in DHCP. I'd let dcpromo remove the servers from DNS when you demote them. 1
mikkydoos Posted June 4, 2015 Posted June 4, 2015 I'm not sure that's the right thing to do - you should configure what nameservers clients use by configuring those options in DHCP. I'd let dcpromo remove the servers from DNS when you demote them. @pantscat thats probably sage advice. Good call. I think the fact that he hasn't demoted them though is a point!
pantscat Posted June 4, 2015 Posted June 4, 2015 No worries, @mikkydoos. I do think demotion is the problem - if a DC is turned off, then some clients might still try to contact it thus causing GPO processing issues. It's just by-design - DCs aren't meant to be switched off.
mikkydoos Posted June 4, 2015 Posted June 4, 2015 @pantscat Totally m8. Bang on. Check this too @theeggmaster, like @pantscat says.... 1
tmcd35 Posted June 4, 2015 Posted June 4, 2015 I think I know what is going on. Just quickly read through the thread and not 100% sure if this as been checked yet, doesn't look like it. Did you say you haven't demoted the old servers, just switched them off? In DNS take a look under -> \Forward Lookup Zones\_msdcs.\dc\_sites\_tcp and tell me what you see. I suspect your old servers are still listed here, and under other subtrees in _msdcs. Mainly because the old servers are not demoted to DNS/AD still thinks they are valid domain controllers. The clients are asking to communicate with a DC, they don't care which. DNS is responding randomly with what it thinks is still a valid DC, but the DC it chooses is switched off - thus the problem. I'd demote the old DC's and make sure the _msdcs subtrees are properly cleaned up, then see if your problems still persist after that. 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now