Help! Our PDC cannot see our domain, complete network failure.

[reggiep]

Right, following on from my post yesterday, this is our current situation.

 

Our domain is completely non-operational.

 

DC1 - Primary Domain Controller

Our primary domain controller cannot see our domain, any attempt to access server MMCs informs us that our domain is not available or the PDC cannot be reached.

 

dcpromo tells us that it IS a domain controller and the only option it gives us is to delete the domain, which we obviously don't want to do!

 

I've attached the dcdiag output from DC1 - dcdiag-1.txt.

 

DC2 - Secondary Domain Controller

Our secondary domain controller cannot see the domain either. It has been recently demoted and promoted using dcpromo to solve a GPO issue. The problems with DC1 started shortly after that. We believe that was due to replication. The netlogon and sysvol folders we not replicating between the two DCs so, using a Microsoft suggestion, we forced that to happen using a registry edit. The "burflags" key was changed to D4 on the PDC, DC1 and D2 on the secondary DC, DC2.

 

We did a system state restore yesterday and completely restored the PDC C: drive from a week old backup this morning, but the Domain is still unavailable.

 

Anyone got any ideas? Let us know if you need any more information from us.

 

Thanks!

dcdaig-1.txt

[Willott]

Have you checked DNS settings on the NICs and that you have correct _SRV records in DNS? Is DNS Server running? Are you able to ping your domain from a workstation (ie ping prentonhigh.local)?

 

Cheers

 

Will

[ben604]

we can ping prentonhigh.local, yes. It resolves to Prenton1, our PDC.

 

It looks like the problem is the Sysvol folder is not shared. This is tied into file replication, which is where the problem started.

 

Is there a way to stop replication between DC1 and DC2 so we can get the sysvol folder shared from just DC1?

[Willott]

Do you have any Windows Event logs relating to FRS and NETLOGON? If so, what do they contain?

 

Also, can you do a "netdom query FSMO", this should show all the FSMO role holders that it sees - I wonder if some of the roles got transferred to the second DC, and then as that was failing, it's caused a knock on effect.

 

Cheers

 

Will

[Willott]

Also, can you do a netdiag /v and post?

[bossman]

@reggieip:

 

Have you seen this: How to rebuild the SYSVOL tree and its content in a domain

 

I fear that you may have overdone it with the authorative restore in that the other DCs didn't need to have the burflags set to D4 as collisions will occur and confusion set in.

 

Also check this out: http://support.microsoft.com/kb/321045

 

You may have tried these so forget it if you have.

 

will post more as I come across them.

 

Also make sure the servers clocks are all the same (reminder thats all)

Edited January 11, 2011 by bossman

[Willott]

@bossman, that's the link I passed to them on the other thread - from what I understand they've only set D4 on PDC and D2 on the other DCs (however the other DC seemed to have been the one causing issues). I wonder (from the dcdiag) whether one or more of the FSMO roles have gone from the PDC and this is then causing issues with that starting (and sorting its FRS/NETLOGON), as the other DC is not working correctly, so not providing the FSMO roles.

 

The advertising bit of the DCDIAG is interesting - could you do a dcdiag /v to see if we can get more info on the advertising bit as that may give some clues.

 

Cheers

 

Will

[bossman]

@Willott:

 

Apologies old age (Have'nt got me reading glasses on) hehe!

 

I think your right in that the FSMO roles have not been transfered to the PDC and therefore the DNS is not functioning correctly, so the advertising of the PDC is as uknown? as the text states.

Edited January 11, 2011 by bossman

[Willott]

@bossman - don't worry... even at a "young" age I struggle sometimes!

[m25man]

Demotion and Promotion without proper replication is always a recipe for AD issues.

 

95% of AD failures all trace back to DNS issues and which DC's are holding what FSMO roles?

 

If you can get the good DC to take over everything through seizure of roles and tidy up DNS and AD through NTDSUTIL and get things talking properly again replication and journal_wrap errors should be simple enough to sort out after.

[Firefox]

Sorry if I overlooked this but was just scanning, I'm assuming the netlogon share on the failed PDC is currently running? and without error?

 

Does it let you stop and restart this service? Do you have this running as local service?

 

Most of the errors you see are just a by product of the Failed Advertising, and that is normally directly related to netlogon

[ben604]

Hello! I work alongside Reg here, sorry for the late reply, some gents from a school down the road came to take a look in the flesh.

 

I've tried "netdom query FSMO" and it reports that the domain is not available.

netdiag /v - windows doesn't recognise the command.

 

I've attached dcdiag /v

 

@ Firefox - Netlogon and sysvol are both not shared or available.

dcdiag.txt

[Willott]

"The host fa635c02-25bf-48ee-bf3a-c6fd6b848613._msdcs.PRENTONHIGH.local could not be resolved to an IP address"

 

Looks like there are some DNS records out of whack - if the above record doesn't exist I would think you need to create it, I would think it needs to be a CNAME to either your PDC or secondary DC, suggest you look at what DNS records you currently have. Fixing Replication DNS Lookup Problems (Event IDs 1925, 2087, 2088): Active Directory has some details of what should exist

 

Have you had chance to do ipconfig /all and check which DNS server you're pointing to?

Edited January 11, 2011 by Willott
dns

[Firefox]

Hello! I work alongside Reg here, sorry for the late reply, some gents from a school down the road came to take a look in the flesh.

 

I've tried "netdom query FSMO" and it reports that the domain is not available.

netdiag /v - windows doesn't recognise the command.

 

I've attached dcdiag /v

 

@ Firefox - Netlogon and sysvol are both not shared or available.

 

Sorry I meant the actual Netlogon service not the share. Is the service running? can you stop and restart it? and what account is it running with?

[ben604]

Right, we've had our local authority in to lend a hand and they've done some good work so far, we think... We can now authenticate against the Domain, which is a start. We're still having trouble with replication though. I've attached the dcdiag info for both DCs. If any of you kind gentlemen could take a look, we'd be eternally grateful!

dcdiagDC1.txt

dcdiagDC2.txt

[Firefox]

DC 1 is now looking totally fine...I would expect those syslog errors will possibly clear in the next 24 hours.....and you can always backup the eventlog and clear those down to clear the other messages.

 

DC 2 does look in a bit worse condition, does this server hold any of the fsmo roles? If not, I would actually suggest a demotion, a metadata cleanup followed by a re-promotion might be the quickest fix to resync everything

[reggiep]

Can I just thank everybody who has contributed to this thread over the last few days.

We now have a working domain thanks to our local authority support who worked long hours yesterday up until 10.

Our PDC Prenton 1 is now running as it should and everybody can indeed log in and all seems well. Our second domaina controlled does still have replication issues and the support team are going to investigate this further.

It's just nice that our staff and students can get back to what they need to do.

 

Reg

[ben604]

Can I echo the above also!