New DC, now DNS issues

[Jawloms]

A few weeks ago I demoted two server 2008 DCs I had and built a new 2016 DC. I already had an existing 2012 DC which has remained. Everything seemed to be fine. I've now tried to change a group policy and it's not having any affect. I've done some digging. When running a GP Results wizard I get;

 

Group Policy Infrastructure failed due to the error listed below.

 

The specified domain either does not exist or could not be contacted.

 

Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.

 

and on either of my DCs when I run dcdiag I get messages like;

 

A warning event occurred. EventID: 0x000003F6

Time Generated: 09/03/2018 12:31:18

Event String: Name resolution for the name _ldap._tcp.dc._msdcs.debenham-cc3.internal. timed out after none of the configured DNS servers responded.

and

A warning event occurred. EventID: 0x00000C18

Time Generated: 09/03/2018 12:31:28

Event String: The primary Domain Controller for this domain could not be located.

 

Now I'm guessing DNS issues as these things normally are, but I can't figure it out. Both DCs are DNS servers, and are my only DNS servers.

 

Any thoughts please? I'm concerned everyone is back in a couple of days.......

 

Stuart

[gshaw]

What is DNS configured to on the NIC?

[Jawloms]

dc1 = x.x.x.11

dc2 = x.x.x.12

 

DNS on dc1 is x.x.x.12 and x.x.x.11

DNS on dc2 is x.x.x.11 and x.x.x.12

[Jawloms]

I ran;

DCDIAG /TEST:DNS /v /s:dhs-dc-01

 

dhs-dc-01 is my original 2012 one.It produced this (and a lot more, this is the highlights though);

 

TEST: Basic (Basc)

The OS Microsoft Windows Server 2012 R2 Standard (Service Pack level: 0.0) is supported.

NETLOGON service is running

kdc service is running

DNSCACHE service is running

DNS service is running

DC is a DNS server

Network adapters information:

Adapter [00000015] Microsoft Network Adapter Multiplexor Driver:

MAC address is 00:26:2D:AB:CD:EF

IP Address is static

IP address: x.x.x.11, fe80::1234:5678:9abc:def0

DNS servers:

x.x.x.12 (DHS-DC-02) [Valid]

Warning:

x.x.x.11 () [invalid (unreachable)]

Warning: adapter [00000015] Microsoft Network Adapter Multiplexor Driver has invalid DNS server: x.x.x.11 ()

Warning:

x.x.x.18 () [invalid (unreachable)]

Warning: adapter [00000015] Microsoft Network Adapter Multiplexor Driver has invalid DNS server: x.x.x.18 ()

The A host record(s) for this DC was found

The SOA record for the Active Directory zone was found

The Active Directory zone on this DC/DNS server was found primary

Root zone on this DC/DNS server was not found

 

It says it can't contact x.x.x.11, which is my newly built 2016 DC, and it can't contact x.x.x.18 which is one of my old DCs which I un-dcpromo'd and removed DNS from.

 

 

1. Why is it remembering the old one? And how do I tell it not to?

2. Why isn't it remembering the other old one which was x.x.x.8?

 

If I run DCDIAG /TEST:DNS /v /s:dhs-dc-02 then it reports all is fine.

 

Stuart

Edited September 3, 2018 by Jawloms

[Oaktech]

Have you done an adprep?

 

"To install the first DC that runs Windows Server 2016 in an existing domain and forest, the machine where you run the installation needs connectivity to the schema master in order to run adprep /forestprep and the infrastructure master in order to run adprep /domainprep."

[HPlum78]

On the new 2016 sever run get-ADReplicationUpToDatenessVectorTable

 

Also run get-adforest and get-addomain

 

Get-ADReplicationFailure -Target -Scope Domain

 

Post/ mail me directly the results and I will take a look.

Edited September 3, 2018 by HPlum78

[HPlum78]

Oh and I have mentioned the gui tool for checking these types of issues in the past but will point you at it https://www.microsoft.com/en-gb/download/details.aspx?id=30005

[HPlum78]

I will take a punt at some left over metadata or some left over dns record in the _msdcs stub.

 

(if you have promoted/ demoted the new/ DC's correctly that is!)

Edited September 3, 2018 by HPlum78

[HPlum78]

I have also just seen on 2016 a ps module called ADDSDeployment in that module there is a Test-ADDSDomainControllerUnistallation

 

Don't know anything about it just seen that it exists....

[kidpressingbuttons]

Had similar issues with dns the other day. Decommissioned restarted then repromoted the dodgy server resolved the issued. Friend of mine had it as well both of us running 2016.

Edit- the ad replication tool is your friend here!

[HPlum78]

@kidpressingbuttons what was the root cause? Anyhow in DNS management right click on that _msdcs folder and look at the degation, is the server you demoted in the list?

[kidpressingbuttons]

no idea as of yet but time was running out and that seemed like a clean way to get things going again. Yes it is but wasn't when it was decommissioned temporarily.

 

Edit- spelling

[Jawloms]

OK so thanks all for your input and suggestions, however fresh eyes are a wonderful thing! Allow me to re-answer this;

 

What is DNS configured to on the NIC?

 

dc1 = x.161.x.11

dc2 = x.161.x.12

 

DNS on dc1 is x.161.x.12 and x.161.x.11

DNS on dc2 is x.161.x.11 and x.162.x.12

 

Bugger!

 

What is curious in my DNS though is that for both of my DCs I have two entries, one in caps and one not, but other than that identical. Anyone else got this? Any thoughts as to why I might? All have recentish timestamps.

 

As I say, much appreciated those that have spent time looking at this and coming up with suggestions, and apologies for the schoolboy error.

[HPlum78]

Yeah that will do yeah! Good work glad your sorted. As for duplicate recs have one set been added manually potentially. Don't know if it's possible to add additional name servers to a stub... Right click and try I guess!

[Jawloms]

Yeah that will do yeah! Good work glad your sorted. As for duplicate recs have one set been added manually potentially. Don't know if it's possible to add additional name servers to a stub... Right click and try I guess!

 

Certainly not added manually. There's only two of us here, I didn't do it and my techs have more sense than to fiddle without letting me know.

[gshaw]

OK so thanks all for your input and suggestions, however fresh eyes are a wonderful thing! Allow me to re-answer this;

 

 

 

dc1 = x.161.x.11

dc2 = x.161.x.12

 

DNS on dc1 is x.161.x.12 and x.161.x.11

DNS on dc2 is x.161.x.11 and x.162.x.12

 

Bugger!

 

What is curious in my DNS though is that for both of my DCs I have two entries, one in caps and one not, but other than that identical. Anyone else got this? Any thoughts as to why I might? All have recentish timestamps.

 

As I say, much appreciated those that have spent time looking at this and coming up with suggestions, and apologies for the schoolboy error.

 

The old adage still holds firm then... "it's usually DNS"