Point clients to one server in domain for log on?

[reggiep]

Hi All,

My local authorities support team were helping us last week with a sysvol synch issue between our two domain controllers.

One of them is still not synching but they are still working on it, thanks guys.

 

The problem I have however at the moment is that some clients are trying to authenticate against the broken server.

 

Is there a way to make sure all clients authenticate against the working server?

 

Thanks

[3s-gtech]

Bit drastic perhaps - could you demote the one that's causing issues, then promote it back when any other faults are found?

[reggiep]

Yep bit drastic that!

[3s-gtech]

What about a tweak in DNS for now, removing it from the default first name sites for the domain, so it's not seen as a DNS entry for domain.sch.uk?

[reggiep]

ooh, that sounds interesting?

[3s-gtech]

Yup - should work! Just fire up DNS, go to the domain site root under Forward Lookup Zones, and delete the Host (A) entry for the IP address of the server (same as parent folder). Make a note of the settings here so you can put it back manually if necessary. I've not tested this myself, but should work short term.

[reggiep]

In the end I disabled the netlogon service on the problematic server. Any machines with issues I just Took off the domain and rejoined.

[sukh]

Hi

 

Make sure your domain controller does not stay off for too long as this can cause server damage to your AD.

 

Check your tombstone settings.

 

Regards

Sukh

[michaelf]

Hi

 

Make sure your domain controller does not stay off for too long as this can cause server damage to your AD.

 

Check your tombstone settings.

 

Regards

Sukh

 

IIRC the default is 60 days, although I'd guess that disabling netlogon wouldn't trigger this because the server is still online just not accepting logon requests.

 

However, a broken SysVol might well cause similar issues although I've never encountered this before so could be totally wrong, might be worth asking LA support though?

[sukh]

Hi

 

Netlogon should not cause any issues (as long as you dont have any NT 4.0 DC), which I doubt. Was a scenario I remembered and typed first thing came to my mind.

 

I'm sure the LEA won't take more than 60 days, if not, then you can change the attribute yourself. Netter off deploying SP1 than changing the setting.

 

Regards

Sukh