Please help: Building Additional domain

[trannghia]

Dear All,

http://s20.postimg.org/7ifb59ppp/Dia.jpg

Currently, we are using windows server 2008 std x64 to build a Domain Controller. To prevent failure of the primary domain I have build an addition domain (using the Windows Server 2008 Std) During the build process does not encounter errors (when I'm creating users, DNS, OU. 2 DC can synchronize). But but after setting up completed about 1 week. I try unplugging the network cable on Primary Domain and try to open the additional domain. I saw an errors the additional domain cannot open the active directory .

 

http://s20.postimg.org/vjhlszf59/Loi.jpghttp://s20.postimg.org/4aats83fx/loi2.jpg

But when i pug the cable to Primary domain then additional domain is back to work normally .

I do not know why? Please help me to fix it.

Thanks for your advice.

[Davit2005]

Can you run DCDIAG on both DC's.

 

I've seen issues with sysvol sharing with 2012 R2.

 

To norrow tests down you can run following command (i think the syntax is correct)

 

dcdiag /s:[servername] /test:sysvolcheck.

 

Another test would be to log on to the additional DC, unplug the cable and then do a \\[domain name]\sysvol or \\[domain name]\netlogon.

Edited November 18, 2015 by Davit2005

[HPlum78]

Are both servers GC's?

[HPlum78]

Port 389

[Oaktech]

It sounds like the OP is trying to have 1 server be a DC for 2 domains? I might be struggling with language here.

[HPlum78]

These are just quick checks/ guesses by the way.

[HPlum78]

I thought it looked that way but then looks like in the diagram its a second DC, but it would be good to get it right else I am barking up the wrong tree (in every sense!)

[trannghia]

Can you run DCDIAG on both DC's.

 

I've seen issues with sysvol sharing with 2012 R2.

 

To norrow tests down you can run following command (i think the syntax is correct)

 

dcdiag /s:[servername] /test:sysvolcheck.

 

Another test would be to log on to the additional DC, unplug the cable and then do a \\[domain name]\sysvol or \\[domain name]\netlogon.

I just run the command and below is the results.

- Pri DC:

Directory Server Diagnosis
Performing initial setup:
   * Identified AD Forest. 
  Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\SFDCSVR
     Starting test: Connectivity
        ......................... SFDCSVR passed test Connectivity
Doing primary tests
  Testing server: Default-First-Site-Name\SFDCSVR
     Starting test: SysVolCheck
        ......................... SFDCSVR passed test SysVolCheck
  Running partition tests on : ForestDnsZones
  Running partition tests on : DomainDnsZones
  Running partition tests on : Schema
  Running partition tests on : Configuration
  Running partition tests on : abc
  Running enterprise tests on : abc.com

- Add DC

Directory Server Diagnosis
Performing initial setup:
  * Identified AD Forest. 
  Done gathering initial info.
Doing initial required tests  
  Testing server: Default-First-Site-Name\SFDCSVR2
     Starting test: Connectivity
        ......................... SFDCSVR2 passed test Connectivity
Doing primary tests   
  Testing server: Default-First-Site-Name\SFDCSVR2
     Starting test: SysVolCheck
        ......................... SFDCSVR2 passed test SysVolCheck 
  Running partition tests on : ForestDnsZones  
  Running partition tests on : DomainDnsZones  
  Running partition tests on : Schema  
  Running partition tests on : Configuration  
  Running partition tests on : abc  
  Running enterprise tests on : abc.com

Another test would be to log on to the additional DC, unplug the cable and then do a \\[domain name]\sysvol or \\[domain name]\netlogon.

Directory Server Diagnosis
Performing initial setup:
  * Identified AD Forest. 
  Done gathering initial info.
Doing initial required tests   
  Testing server: Default-First-Site-Name\SFDCSVR2
     Starting test: Connectivity
        The host ade287e1-78eb-429d-b101-57896e663f24._msdcs.abc.com could
        not be resolved to an IP address. Check the DNS server, DHCP, server
        name, etc.
        ......................... SFDCSVR2 failed test Connectivity
Doing primary tests
  Testing server: Default-First-Site-Name\SFDCSVR2
  Running partition tests on : ForestDnsZones
  Running partition tests on : DomainDnsZones
  Running partition tests on : Schema
  Running partition tests on : Configuration 
  Running partition tests on : abc
  Running enterprise tests on : abc.com

and i'm going to add domain (SFDCSVR2) i not found the sysvol shared folder

http://s20.postimg.org/5y9z6vhbh/image.jpg

Pls advice.

Thanks

Edited November 18, 2015 by trannghia

[Firefox]

Looks like something has gone a bit screwy with the promotion, you might have to demote and try again.

 

On DC 2 I would also set the primary DNS to be DC 1 (at least initially, but ideally the DC won't point at itself for primary.)

[trannghia]

Hi All,

Sorry, I was on-leave last week,

I found the sysvol and Netlogon folders does not shared, After read and do following this article https://support.microsoft.com/en-us/kb/316790 the sysvol folder is sharing. But, Unfortunately that the sysvol folder is empty and Group policy's not yet replication.

I check windows Events and found an error below:

- NTFRS - 13508

- Group Policy - 1058

 

Thanks.

Edited November 24, 2015 by trannghia

[trannghia]

Hi All,

I have just fixed the problems:).

1/ Please user the following steps.

https://jorgequestforknowledge.wordpress.com/2010/08/12/restoring-the-sysvol-non-authoritatively-when-either-using-ntfrs-or-dfs-r-part-2/

1.1 (Primary DC)

 

• Start the Registry Editor
  
  
• Navigate to "HKLM\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup"
  
  
• Double-click on "BurFlags"
  
  
• Assign it a value of D4 (hex) or 212 (dec)
  
  
• Stop the NTFRS Service
  
  
• Start the NTFRS Service
  

1.2 (Additional DC)

 

• Start the Registry Editor
  
  
• Navigate to "HKLM\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup"
  
  
• Double-click on "BurFlags"
  
  
• Assign it a value of D2 (hex) or 210 (dec)
  
  
• Stop the NTFRS Service
  
  
• Start the NTFRS Service
  

2/ To share SYSVOL Folder Change the regedit.

https://support.microsoft.com/en-us/kb/947022

Start the Registry Editor

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogo n\Parameters

change the sysvolready to 1.

 

Thanks.

Edited November 27, 2015 by trannghia

[Davit2005]

Hi All,

I have just fixed the problems:).

 

 

Thanks.

 

Good news, glad you got it sorted

 

I actually done the last step 'sysvolready' at home which seemed to fix my problem, but I think I will be testing over the weekend i.e. disconnecting DC's, browsing for SYSVOL and trying to join domain etc. with either DC offline.