forde52

So now everything is working, not sure how that made a difference but it has worked! Thank you everyone for your help/suggestions

Now here's something odd. On the old DC I changed the DNS to only the old DC, removed the GC role (and i probably did something else but i'm not sure now), and it's now accepting the new server. I'm going to try demoting the old server now to see if everything is working like it should then i'll let you know how it goes!

No worries! It's 2008R2 to 2008R2, so the same OS. The network did run on a 2003R2 DC but I upgraded it to the current 2008R2 server 2 years ago. I did raise the forest and domain function levels to 2008R2 just before I attempted to add this new server into the domain though!

I might take a look at that actually, I think it still is a GC so i'll remove that now. the DNS is pointing to both old and new, so i'll change that as well and see if anything changes!

That looks a handy guide so I'll follow that when i attempt to take it off line again. Just going through the Directory Service event log on the old server, and it is full of warnings about KCC, error 1925. I appear to be getting 3 errors at 15Minuite intervals. Looking at ways to resolve it at the moment.

Good Idea, I'll do that now! Although it doesn't make it easy when explorer crashes when you click on it anywhere (this is on the old server).

after following this artical, the netlogon share has still not been created. The netlogon service is running though!

Hmm, this one doesn't. I've just found an artical on how to get the DC to produce one, so i'll do that now and see if anything changes!

Netlogon is supposed to be a share right? If so the new server doesn't have one.

Haha don't worry you didn't! If I knew what to ask I would. It's confusing me as to why it's not working. If I try to demote the old server from DC using DCPROMO, it tells me that it could not find any other domain controllers for the domain. But if i try to demote the new server from DC I don't get that message and can successfully demote it. It is certainly something with the old server that's wrong.

Yeah I agree, It's the fixing of the problem that's proving difficult at the moment sadly .

They are yes!

I have been thinking about doing that, but the other day when I give the new server the roles and took the network cable out of the old server, everything stopped working. I suppose I didn't do that the correct way but I was interested in seeing what would stop if I were to just remove the old server.

Thanks for that, I'll take a look now and see what I can come up with! I've attached the results of the repadmin, the new server has no errors but the old one shows quite a few. OldDCReps.txt NewDCReps.txt

You'd be surprised at how many time's I've tried that the past few days. Every other computer on the network can access shares on it, just not the old DC. So with that in mind I'm thinking it's something with the old DC that's not right. It's always had errors with the RPC server as well (when you've tried to do a RSOP for example). It's as if the old DC just won't let go. The domain originally ran on a 2003R2 box but that got replaced nearly 2 years ago now, and everything was fine then, so it is something recent I think.

We never had a UNIX server, but we do have 2 Mac clients which connect to file shares on the network (not joined to the domain as it seemed a bit of a fuss), so that could be what it's on about? Just checked and they can still connect to the shares so I'll just ignore that error for now. Had a look at the security on these two, and the settings are the same as what you've posted above. If this helps I've just tried connecting to a file share on the new server from the old one and got this message: So, this old server thinks it doesn't have permission to access the new one I'm guessing?

Haha, you're not the only one! The event log on both servers is showing this error: "Windows® Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services® for Windows user . Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources. Verify that the Windows user is in Active Directory Domain Services and has access permissions." Plus another one which shows the domain admin account instead of SYSTEM. I'm guessing that's not good?

Nothing looks out of place in Sites and Services, it's showing the two servers and their properties.

I can yes, FQDN and computer name both work fine. So the server's can "see" each other to some extent.

DNS on both servers is saying it is Active Directory-Integrated. Both servers have themselves and the other server in the Nic's DNS settings. They can both ping each other by name and ip as well. So it's looking like it's not a network connectivity issue?

I have yes, I thought that might have been an issue but it appears it hasn't made a difference.

Oh right ok, It's had plenty of restarts the past few days so not sure what's going on there. I've just changed the DNS settings on the old server through CMD, and i've just been met with the following error Should this worry me or should I just ignore it? (.14 is the old server and .16 is the new server)

I'll go check them now, I've got the feeling they might be the other way round so i'll sort them. One other thing to add is the old server is running unresponsively slow, so I'm having to do most stuff through CMD as the GUI is crashing out all the time. Could this be DNS related as well?

Just had a look at both servers dns records, and they're not showing the same entries. The new server has a computer listed that the old one doesn't. So i'm guessing that's problem number 1?

I know at one point the DNS wasn't replicating, but since then I have removed the new server and added it again. I'll take a look now and see if they're both the same!