Windows Server 2016 - DNS/AD problem

[ramon82]

Windows Server 2016 - DNS/AD problemHi all - at one point our DC froze and we had to do a restart. It installed a lot of updates and then once it got up and running again we started experiencing problems with DNS, passwords, mapped drives etc - please refer to screenshots. Its as if the communication between the desktops and the server got out of sync somehow.Any idea what we can do please?Thank you

[Squelch]

Is it a VM? If so, have you tried restarting the host?

[ramon82]

Yes I did however problem persists

[Squelch]

DNS cache cleared? Scroll halfway down the article to clear the cache on a server.

 

https://activedirectorypro.com/clear-windows-dns-cache/#:~:text=Clear%20DNS%20Cache%20on%20Windows%20DNS%20Server&text=In%20this%20example%2C%20I'm,server%2C%20and%20select%20clear%20cache.

 

I'm no help after this I'm afraid.

[ramon82]

I am a bit lost...can you direct me to a simple step-by-step which i can follow?

[ramon82]

Hi again i discovered that this seems to be an AD issue through event viewer:The Security System has detected a downgrade attempt when contacting the 3-part SPN ldap/JUPITERDC01.jupiter.local/[email protected] with error code "The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)". Authentication was denied.​Any ideas??

[chaplic]

I think we are seeing symptoms rather than the cause

 

The DNS MMC screenshot is just empty, assuming we're on the DC it should be connecting to itself

 

Some questions

 

1) Is the netlogon service running on the DC

2) is the DNS service running on the DC

3) what's the IP Addresss of the DC and what is the DNS client settings (it should be pointing to itself). What about a PC, does it have the DC set as a DNS server

4) from the dc do net view \\dcservername - is the netlogon share shown? can you do the same from a client

[Domino]

Is the time on both the DC and the host (and it's NTP config if present) it's running on correct?

 

If it's been a long while since it's been patched you may be hitting this: https://support.microsoft.com/en-gb/topic/kb5011233-protections-in-cve-2022-21920-may-block-ntlm-authentication-if-kerberos-authentication-is-not-successful-dd415f99-a30c-4664-ba37-83d33fb071f4