IIS 7.5 Authentication issues

[beancole]

HI All,

 

odd one. I am decommissioning an old server 2003 which is a domain controller (secondary) and I have a server 2008r2 box that runs my IIS 7.5.

 

I turned off the server 2003 yesterday and then Authentication failed for IIS 7.5

 

My intranet, wiki, myphp etc. all failed to authenticate until I turned the old server back on. (401 error I think)

 

I tried rebooting the server 2008 and restarting websites etc. while the old server was off in case it was still trying to authenticate through the old one.

 

Any ideas what this is. Its likely just some cache want clearing but I can't think what. and don't know how to frame this as a question for google.

Edited June 30, 2015 by beancole

[beancole]

Anyone?

[pantscat]

Did you demote the 2003 box before turning it off?

[beancole]

not demoted yet. but it is the secondary controller.

[localzuk]

Define "secondary". There isn't a primary/secondary structure to AD, just a "we're all AD servers, but that one has XYZ role and this one has ABC role" structure.

 

So, with it being switched off, clients will still think of it as a valid server and therefore will seek to use it.

[beancole]

Secondary in that it is not a primary domain controller. Not all my servers are AD servers I don't fully understand what your asking?

 

Surely if I turn it off it then reboot the IIS Server it should seek a different source of authentication, if not how do I tell IIS/server2008r2 to authenticate from a different server.

[localzuk]

There is no such thing as a "primary" active directory server. They're all just active directory servers. Just different active directory servers may have different roles assigned to them - eg. Operations Master, PDC emulator, Infrastructure Master, Global Catalog etc...

 

Something to check:

 

In Active Directory Users and Computers, right click on your domain at the top and choose "Operations Masters". Is the server you're turning off selected in any of the roles in there. If it is, transfer the role to a different AD server.

Edited July 2, 2015 by localzuk

[pantscat]

There is no such thing as a "primary" active directory server.

@localzuk is quite right - there's not been such a thing as a PDC since NT4...

 

You can't really just turn a DC off and expect things to still work - it'll be listed in DNS as an available DC and so clients will try to contact it (and fail...)

[beancole]

There is no such thing as a "primary" active directory server. They're all just active directory servers. Just different active directory servers may have different roles assigned to them - eg. Operations Master, PDC emulator, Infrastructure Master, Global Catalog etc...

 

Something to check:

 

In Active Directory Users and Computers, right click on your domain at the top and choose "Operations Masters". Is the server you're turning off selected in any of the roles in there. If it is, transfer the role to a different AD server.

 

It is not the operations master it gives you the option underneath to change the server to operations master.

 

Essentially do I have to demote the DC?

[pantscat]

Also worth checking to see if it's a Global Catalog - "Get-ADForest MyDomain.com | FL GlobalCatalogs"

 

If you don't want the DC anymore, then yes, you'll need to demote it before turning it off.

[beancole]

AD forest isn't recognised. its a server 2003 box i'm planning to remove it that means anything.

 

Its not the Global catalogue. I don't get this I was always under the impression the reason you have multiple DC's is so when one fails. others take the slack. its not a problem for logging on etc. I've tested this as part of my disaster recovery plan. But what I never considered is IIS authenticating through it.

Edited July 2, 2015 by beancole

[pantscat]

Should have said - run it from Powershell on your 2008 R2 server.

[beancole]

It's sorted now. I have turned off the old DC and IIS is working. It appears it just took a further reboot of IIS with the old DC turned off.

[beancole]

And I'm back to having this fault. Demoted the DC and turned it off and the problem starts again on some computers but not others. Anyone any ideas?

[localzuk]

What does dcdiag report on one of your remaining DCs? It could be that the demotion hasn't completed 100% cleanly so there are still some traces of the server in the active directory. It happened here a while back, so I had to go through and manually remove any and all trace of that server.

[beancole]

It reports back its failed the syslog test. But I know this is because I have a few unresolved errors on the server in question (print server failed documents)

 

What do I need to remove manually I don't know where to start really?

[beancole]

Fixed it - DNS issue, the server with IIS 7.5 was looking for DNS on the old server as primary and another as secondary. I removed the old DNS server details completely. I changed the DNS server in the network cards IP settings for the other domain controller/DNS etc. and it worked immediately.

[3s-gtech]

Have a scour through DNS as well, and possibly ADSIEdit if you're feeling adventurous. Even fairly recently I found traces of old long-forgotten DCs hiding in there. Just double check when deleting anything!