Server not accessible error

[bmdixon]

Having a very similar problem as reported here but thought i'd post this in the correct forum

 

We're running Server 2003 R2, xp clients.

 

Some machines are fine, can do everything as normal, others have no internet, can't remote desktop to servers, and get the message "Naming information cannot be located for the following reason; the server is not operational." when connecting to active directory.

 

They can all ping the servers and can see shares on the network but can't run ad, or access internet.

 

Does anyone know why this is happening? I have restarted servers/clients multiple times and still having problems!

 

Run dcdiag and netdiag and there are no problems there. Event logs on both clients and servers are clean (no recent errors or warnings)

 

Have removed clients from the domain, then re-added them and still not working!

 

I'm supposed to be off for the next week but figure if someone knows what causes this then i might have to pop in and see if it fixes it.

 

Any help/advice would be very very gratefully received!

[adamf]

Are the affected clients getting the correct DNS server addresses and the correct default gateway?

[bmdixon]

Yeah, getting correct dns and gateway info. Can ping the proxy server and the dns server no problems.

[Michael]

Try removing a workstation from the domain (set it to workgroup), reboot, then re-join the domain and reboot again. Does this help?

 

If it does, it would point to a possible computer object corruption within Active Directory.

[bmdixon]

Try removing a workstation from the domain (set it to workgroup), reboot, then re-join the domain and reboot again. Does this help?

 

If it does, it would point to a possible computer object corruption within Active Directory.

 

Sorry, forgot to mention i have tried this. We were renaming lots of machines today and one of the things i tried was re-syspreping it to see if that helped but no luck

[Michael]

On a problematic machine, if you open a command prompt and enter ipconfig /all are all the entries correct?

 

Especially DNS entries. Your primary DNS should be your primary domain controller, you may have a secondary DNS server and then you should have external DNS servers listed.

[bmdixon]

On a problematic machine, if you open a command prompt and enter ipconfig /all are all the entries correct?

 

Especially DNS entries. Your primary DNS should be your primary domain controller, you may have a secondary DNS server and then you should have external DNS servers listed.

 

Yup, all entries are correct....

we only have one DNS server so that is first, then we have an external dns (bgfl dns server)

 

Thanks for your help so far.

[Michael]

Ok, lets focus on more basic problems such as proxy settings. Seeing as you're a Birmingham/BGFL school, it makes sense to configure proxy settings on the Default Domain Policy.

 

Normally I wouldn't touch the Default Domain Policy, but for exceptions like this it makes sense. Once you've made this change (on the server), could you then verify where the computer objects are within your OU structure?

 

As a general recommendation, creating an OU called Curriculum and then sub OUs, such as 'Pupils', 'Classroom PCs' and 'ICT Suite' (for example). Make sure the computer objects are located under Classroom PCs or ICT Suite using my example.

 

On the workstation, from the Run menu perform: gpupdate /force then reboot (you should be prompted to).

 

One question I forgot to ask previously, is your workstations are running XP, but are they running SP2 or SP3?

[bmdixon]

They're running SP3.

The machines have been working fine in the past (been set up for a year), this has just come out of the blue.

Ran gpupdate and they do pick up the policies and reboot.

[Michael]

How do you access Active Directory on your workstations? Do you use either the MMC or the 2003 Server Administration Tools?

[bmdixon]

We use the admin tools

[Michael]

And if you try using MMC - Start > Run > MMC > File > Add/Remove Snap-in > Add > Group Policy Object Editor > Add > Browse

 

You should see all your domain GPOs listed here. Does this work OK?

[7andY]

Adding an external DNS does seem just a little strange. If your machines always pick the secondary, the external Resolver won't know anything about your internal arrangements, and the look-up will fail. Try removing the external DNS Resolver from your list, and just run with the internal one.

 

(Your internal DNS should resolve all external requesst for you - it's the only one that should reference external DNS)

 

7&Y

Edited April 9, 2009 by 7andY

[Michael]

It's perfectly normal to set an external resolver. It all depends how your network is setup, but without it, internet connectivity would fail.

 

It means workstations connect directly to the DNS servers which handle external requests (in this case web pages), which would cut down on the number of requests your local DNS server has to handle, as well as all other roles such as Active Directory, DHCP, File Server, Print Server, IIS etc etc

[Polski]

Stab in the dark...have you checked the DNS records to see if any are out of sync?

 

Had something simular a while back when DHCP had assigned a new IP address and DNS had not caught up.

[tmcd35]

If your DNS and DHCP records are getting out of sync then it's best to double check your DHCP lease time rules and, more importantly, your DNS scavaging rules. Make sure the scavaging is turned on and set to times in sync with DHCP leasing.

 

For most schools I'd recommends an 8hr DHCP lease - ie 1 school day. And have the DNS records scavanged after 8hrs. That way you can be confident that the records are fresh the next morning.

[ranj]

One thing I forgot to mention to you yest was try running commands ipconfig /flushdns

 

and then ipconfig /registerdns. I keep coming back to thinking that this must be a DNS problem.

 

Also try things on the last post about setting scavenging on DNS and DHCP records, check time to live.

[k-strider]

can i suggest you try NSlookup

 

open cmd window type nslookup

it should jump on your primary DNS server. (your internal one)

otherwise type server ip.ip.ip.ip

then just type mydomain.local

see if thats resolving ok...

 

I had a problem ages ago with a 2K3 server where i turned the firewall on and the DNS Server service was blocked D'oh. had to open the ports...

[ranj]

can i suggest you try NSlookup

 

open cmd window type nslookup

it should jump on your primary DNS server. (your internal one)

otherwise type server ip.ip.ip.ip

then just type mydomain.local

see if thats resolving ok...

 

I had a problem ages ago with a 2K3 server where i turned the firewall on and the DNS Server service was blocked D'oh. had to open the ports...

 

I noticed that on your machines you the firewall service was enabled. Try disabling it on a problem machine and also checking on both servers to ensure firewall is off and see what happens.

[bmdixon]

A quick update (i popped in very briefly today-i'm on holiday atm)

Ranj - the machine that we were looking at yesterday is now working fine.... No problems at all. It hadn't been restarted since yesterday when it wasn't working. Firewall is disabled on the lan connection, not quite sure why the service is still running but it is definitely not active on the lan. Will try stopping it but don't think it'll have any effect (worth trying though )

 

I did try flushing the dns and it had no effect (still not working)

I'll look at the scavenging on DNS and DHCP records next time i'm in, as well as trying the nslookup.

 

I won't be able to try any of this for a week or so now, but if anyone has any more ideas of things that might be causing it, or things to try that might help identify the problem then please post and i will try it next time i'm in.

[Michael]

As an option/recommendation, as well as turning the Windows Firewall off by GPO, you can also turn off or disable the service too as it's not needed.

 

Computer Config > Admin Templates > Network > Network Connections > Windows Firewall > Domain Profile

 

Windows Firewall - Protect all network connections - Disabled

 

Computer Config > Windows Settings > Security Settings > System Services

 

Windows Firewall/Internet Connection Sharing (ICS) - Disabled

 

------------------------------

 

Have you checked the event logs both server and workstation for any errors, especially errors related to DNS? Again you can do this remotely using MMC, allowing you to view several event logs from several machines at once. This is useful especially if sods law the PC is at the other end of the building!

[sjl]

7 and Y wrote: -

 

Adding an external DNS does seem just a little strange. If your machines always pick the secondary, the external Resolver won't know anything about your internal arrangements, and the look-up will fail. Try removing the external DNS Resolver from your list, and just run with the internal one.

 

(Your internal DNS should resolve all external requesst for you - it's the only one that should reference external DNS)

 

7&Y

 

I would agree with this - a more standard approach is to have all internal clients point to your internal DNS server then have that server set up with a forwarder to your external DNS - that way internet DNS requests are sent to your DNS server which then performs the query on your client’s behalf.

 

This scenario has many advantages a big one is your internal DNS server will cache the queries for internet sites – speeding up name resolution and meaning you clients don’t have to leave the building for name resolution

 

Cheers,

 

Steve