Gardinho Posted June 23, 2010 Author Posted June 23, 2010 Well, I am underway with this on-site. I want to check before I demote the old DC: So far, I have installed the OS, promoted to a DC, installed DNS & DHCP, Transferred FSMO roles. When I try to demote the old DC I get the following message: this domain controller is a global catalog server. Global catalogs are used to process user logons. You should make sure other global catalogs are accessible to users of this domain before removing active directory from this computer If I continue, I get this message: the box indicating that this domain controller is the last controller for the domain is unchecked. However, no other active directory domain controllers for that domain can be contacted There is no sysvol or netlogon share on the new DC. I'm abit cautious about demoting the old DC until I know the new server is functioning properly. Any ideas? I'm guessing it's something to do with DNS. Many thanks,
djones Posted June 23, 2010 Posted June 23, 2010 Don't run DCPROMO yet! It may be as simple as replication hasn't finished yet. From my experience, this can sometimes take a while. You could check in the event logs of both servers for replication issues?
edutech4schools Posted June 23, 2010 Posted June 23, 2010 (edited) In my test sysvol was duplicated after DNS was installed on the new server. other issue - Have you made the new server a global catalog server EDIT or are any other servers global catalog server? Edited June 23, 2010 by edutech4schools
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 The new server and the old server are both global catalog servers. They are the only servers on the domain. The event logs aren't showing any errors. For some reason, netlogon and sysvol have not been replicated. Should I try removing and re-installing DNS? Or should I wait to see if it replicates?
djones Posted June 23, 2010 Posted June 23, 2010 (edited) Edit - should learn to read who has written what! I would leave it and wait to see if replication happens on its own if there are no errors reported. Edit again - Have you checked DNS with dcdiag? Edited June 23, 2010 by djones
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 Hmmm.. I'm a little stuck then. How about removing DNS on the old DC and pointing it to the new one? It does sound like a DNS issue to me, but clearly I may be wrong!
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 (edited) Thanks for your advice. I have ran DCDIAG with some interesting results. Do you know where the dcdiag log file is afer running the /f switch? EDIT: I have it here: Doing primary tests Testing server: Default-First-Site\GATEWAY1 Starting test: Advertising Warning: DsGetDcName returned information for \\gateway.stmargaretmarys.local, when we were trying to reach GATEWAY1. SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE. ......................... GATEWAY1 failed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Starting test: NetLogons Unable to connect to the NETLOGON share! (\\GATEWAY1\netlogon) [GATEWAY1] An net use or LsaPolicy operation failed with error 67, The network name cannot be found.. ......................... GATEWAY1 failed test NetLogons Edited June 23, 2010 by Gardinho
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 Follow up information: event log The File Replication Service is having trouble enabling replication from GATEWAY1 to GATEWAY for c:\windows\sysvol\domain using the DNS name GATEWAY1.stmargaretmarys.local. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name GATEWAY1.stmargaretmarys.local from this computer. [2] FRS is not running on GATEWAY1.stmargaretmarys.local. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. It's been doing this for a couple of hours now. Can anyone help?
DMcCoy Posted June 23, 2010 Posted June 23, 2010 can you ping the hostname and fqdn from the old server? Does the old DC have DNS entries for the new DC in DNS?
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 Well, it has now hit the fan - BIG TIME! I can't logon to the old server. The system cannot log you on due to the following error: the specified domain either does not exist or could not be contacted. DCDiag now tells me there are NO GC servers. Heeeelllpppp!!!
DMcCoy Posted June 23, 2010 Posted June 23, 2010 \gateway.stmargaretmarys.local, when we were trying to reach GATEWAY1. Is the server gateway, or gateway1? or is one the old server?
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 gateway is the old server, gateway1 is the new server. Thanks for your reply. I can still access DNS on the old server, from the new server.
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 This is in the DNS event log: The DNS server encountered error 32 attempting to load zone stmargaretmarys from Active Directory. The DNS server will attempt to load this zone again on the next timeout cycle. This can be caused by high Active Directory load and may be a transient condition.
DMcCoy Posted June 23, 2010 Posted June 23, 2010 are the servers pointing to their own dns and the other servers dns? The new one needs to see the old one to find the DC to load the AD dns domain. Is the AD zone present and populated in the new server?
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 AD was present. The new server does point to the old one. I have a feeling I have made a schoolboy error and deleted a dns entry (host or other entry) from within the forward lookup zone. I'm beginning to think of cutting my losses. Thanks for your help.
DMcCoy Posted June 23, 2010 Posted June 23, 2010 ipconfig /registerdns on a DC should register all the details it needs to with the dns server.
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 I have ran that, nothing new to report. Is it safe to delete the DNS zones and reconfigure DNS?
DMcCoy Posted June 23, 2010 Posted June 23, 2010 I have ran that, nothing new to report. Is it safe to delete the DNS zones and reconfigure DNS? I really wouldn't touch the zones. If they have been populated from AD then they should be working. Troubleshooting Active Directory For 2000, but should give you some idea what entries should be in DNS
Gardinho Posted June 23, 2010 Author Posted June 23, 2010 I have taken a backup before I began the whole migration process, but now the old DC will not log on. I think this all started when I tried to get the sysvol and netlogon shares to replicate. I followed a guide to change the burflag registry key to D2(non authorise). Either that or a problem with DNS. This is a nightmare! Before I did that, I took a copy of the sysvol folder. Is there a way to restore this to the new dc?
edutech4schools Posted June 24, 2010 Posted June 24, 2010 I can't help to much as learning this as I go also but can you log on locally to the old domain server?
Gardinho Posted June 24, 2010 Author Posted June 24, 2010 Update for those who are interested, or come across this in future: I deleted the DNS entries for the new DC and demoted it using the force command. The old DC would then logon, albeit very slowly. I then used ntdsutil.exe to seize the FSMO roles back to the old server. I reconfigured DNS and things started to work again. I promoted the new DC again, moveid the FSMO roles and have left it replicating. People are telling me that everythings working fine, but I checked before and SYSVOL and NETLOGON had not yet been transferred. Fingers cross that will happen over night. I'm back in there tomorrow to move shares etc. I don't plan to demote the old server for at least a week! I'm not totally relaxed that I'm out of the woods yet.
Gardinho Posted June 24, 2010 Author Posted June 24, 2010 further update: There is a problem with DNS on my new server. nslookup works on the old server, but on the new one i get: default server : unkown address : fe80:b881:f2ca:d1ae:d6fa also, if I right click on the dns server, in the dns console, on the interfaces tab, all ip addresses is ticked but the ip addresses in the box are: fe80:b881:f2ca:d1ae:d6fa and it's own ip address. Can anyone help me configure the new domain conrollers DNS settings? Something is stopping the replication, and it;s definitily in here somewhere! Many thanks
ChrisH Posted June 24, 2010 Posted June 24, 2010 Try the microsoft tool sonar to troubleshoot replication. http://www.microsoft.com/downloads/details.aspx?FamilyID=158cb0fb-fe09-477c-8148-25ae02cf15d8&displaylang=en
Gardinho Posted June 25, 2010 Author Posted June 25, 2010 Try the microsoft tool sonar to troubleshoot replication. http://www.microsoft.com/downloads/details.aspx?FamilyID=158cb0fb-fe09-477c-8148-25ae02cf15d8&displaylang=en Do I run this on the new DC or old one?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now