ICTCity
Well-known member
Can you add an alias (cname) in DNS which redirects from big-rig2 to big-rig? Not a A record, just the alias. Then flush and try again.
New 2008R2 Server To 2003 Domain
- Thread starter SailingNut
- Start date
Can you add an alias (cname) in DNS which redirects from big-rig2 to big-rig? Not a A record, just the alias. Then flush and try again.
SailingNut
Well-known member
Tried the GUI and command line and both failed with the "refused" error.
ICTCity
Well-known member
Ok, I still have something to try...
Open: C:\Windows\System32\Drivers\etc\HOSTS
add this entry:
fd47:dced:df9d:5a5f::1 (which should be your IPv6 address) big-rig
Once you're finished, try to open DOMAIN AND TRUSTS and AD SITES AND SERVICES.
If you still have trouble, run dcdiag /fix
Let me know.
Open: C:\Windows\System32\Drivers\etc\HOSTS
add this entry:
fd47:dced:df9d:5a5f::1 (which should be your IPv6 address) big-rig
Once you're finished, try to open DOMAIN AND TRUSTS and AD SITES AND SERVICES.
If you still have trouble, run dcdiag /fix
Let me know.
SailingNut
Well-known member
I tried that and still had an error opeing the domains & trusts. I then tried to run a just plain dcdiag and it failed with an ldap error. Once I removed the entry from the hosts file I was able to run dcdiag again.
Should I try the dcdiag /fix without the IPv6 address in the hosts file? (Guessing the answer is yes on that one.)
One other bit of info is that I tried a disgnostic step to determine the health of the GC that I found on the Microsoft TechNet. I used the following command line:
Code:
nltest /dsgetdc:wtbhome /force /gcIt responded with status 1355 0x54b ERROR_NO_SUCH_DOMAIN
That seems bad to me.
ICTCity
Well-known member
Yes, dcdiag /fix.
I hope it's just a mistake in the name... try this:
nltest /dsgetdc:wtbhome.net /force /gc
I hope it's just a mistake in the name... try this:
nltest /dsgetdc:wtbhome.net /force /gc
SailingNut
Well-known member
using the .net suffix did not work. Same error from nltest
The dcdiag /fix failed because it's looking for big-rig2. Here's the output:
Code:
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = big-rig
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: wtbhome\BIG-RIG2
Starting test: Connectivity
The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could
not be resolved to an IP address. Check the DNS server, DHCP, server
name, etc.
Neither the the server name (big-rig2.wtbhome.net) nor the Guid DNS
name (63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net) could
be resolved by DNS. Check that the server is up and is registered
correctly with the DNS server.
Got error while checking LDAP and RPC connectivity. Please check your
firewall settings.
......................... BIG-RIG2 failed test Connectivity
Doing primary tests
Testing server: wtbhome\BIG-RIG2
Skipping all tests, because server BIG-RIG2 is not responding to
directory service requests.
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : wtbhome
Starting test: CheckSDRefDom
......................... wtbhome passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... wtbhome passed test CrossRefValidation
Running enterprise tests on : wtbhome.net
Starting test: LocatorCheck
Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1722
A Global Catalog Server could not be located - All GC's are down.
Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1722
A Primary Domain Controller could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(TIME_SERVER) call failed, error 1722
A Time Server could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error
1722
A Good Time Server could not be located.
Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1722
A KDC could not be located - All the KDCs are down.
......................... wtbhome.net failed test LocatorCheck
Starting test: Intersite
......................... wtbhome.net passed test IntersiteICTCity
Well-known member
It's frustrating, the last thing you can try is to use dcpromo /removal on your DNS. Once completed rename the server (as long it will be a standalone server), then retry the dcpromo to setup the domain again.
Be sure to be ready to setup a new DC in case this scenario will not work properly. I really apologize with you but this is my last idea
Be sure to be ready to setup a new DC in case this scenario will not work properly. I really apologize with you but this is my last idea
SailingNut
Well-known member
OK, I did a full search of the boot HD on the server for the string big-rig2 and here are the files where the string was found. I'm thinking of trying a "cleansing" of those references. What do you think? Sound crazy?
C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\dnsmgmt (no extension but content is XML)
C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\ServerManager (no extension but content is XML)
C:\Windows\System32\config\netlogon.dns
C:\Windows\System32\config\netlogon.dnb
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms (binary file)
I did find a ton of hits, but they were mostly log files. These were the only ones tlat looked like they might do something.
Any of these sound promising to you?
Also, I checked and the registry is "clean" of references to big-rig2 so, it's tog to be in the files above where it's "holding on to" that name.
C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\dnsmgmt (no extension but content is XML)
C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\ServerManager (no extension but content is XML)
C:\Windows\System32\config\netlogon.dns
C:\Windows\System32\config\netlogon.dnb
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms (binary file)
I did find a ton of hits, but they were mostly log files. These were the only ones tlat looked like they might do something.
Any of these sound promising to you?
Also, I checked and the registry is "clean" of references to big-rig2 so, it's tog to be in the files above where it's "holding on to" that name.
ICTCity
Well-known member
I know those files, but I actually don't know if they can edited "on the fly". My suggestion is:
Start in safe mode, modify files, restart.
Anyway, make sure you're ready to reinstall a new dc... you know, just in case.
Start in safe mode, modify files, restart.
Anyway, make sure you're ready to reinstall a new dc... you know, just in case.
SailingNut
Well-known member
Tried a bunch of things without any good luck, but think I may have some progress that we can work with.
I edited the two netlogon files and no luck. I found out that those are written out when the netlogon service starts. (Or in my case attempts to start.)
So, I went down the path of getting the AD DNS entries corrected and I tried editing the AD database with ADSIEdit. I did change one thing from big-rig2 to big-rig, but no help. I then restored to a backup I made just before doing that.
Next I put an entry in the hosts file to point big-rig2 to the same IP as big-rig. I then ran dcdiag and the output gave me some hope that we might be able to make progress from here. Here's the output:
I edited the two netlogon files and no luck. I found out that those are written out when the netlogon service starts. (Or in my case attempts to start.)
So, I went down the path of getting the AD DNS entries corrected and I tried editing the AD database with ADSIEdit. I did change one thing from big-rig2 to big-rig, but no help. I then restored to a backup I made just before doing that.
Next I put an entry in the hosts file to point big-rig2 to the same IP as big-rig. I then ran dcdiag and the output gave me some hope that we might be able to make progress from here. Here's the output:
ICTCity
Well-known member
Mhhhh almost the same problem as before... the problem is that netlogon has still the "big-rig2" in its config...
Adding the big-rig2 pointer to host file doesn't help... actually during replication and connectivity test things are made in a different way.
The point is: netlogon has a config file somewhere, and as you said, once it has been modified, the service re-write it and you still have the same problem.
I think the problem is the server's name, we have to find a way to change it...
Have you already tried this?
Let me know...
Adding the big-rig2 pointer to host file doesn't help... actually during replication and connectivity test things are made in a different way.
The point is: netlogon has a config file somewhere, and as you said, once it has been modified, the service re-write it and you still have the same problem.
I think the problem is the server's name, we have to find a way to change it...
Have you already tried this?
Code:
netdom renamecomputer %computername% /NewName: /userd: /password:*Let me know...
SailingNut
Well-known member
The part that seemed to give me hopw was the line:
The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server
I see that entry in ADSIEdit, but the problem is that the entry for the dnsRecord is an octet string and I don't know the meaning of the entire entry. I have been able to determine that the last 4 octets are the IPv4 address (at least in another record)
Thinking that if we clear this up that maybe some of the other tools might start working and we'll be able to clean things up.
Am I just clinging to false hope there?
if I try the netdom method to rename the computer, I'm assuming that I should name it back to big-rig2 correct? So the syntax wuold be:
Correct?
The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server
I see that entry in ADSIEdit, but the problem is that the entry for the dnsRecord is an octet string and I don't know the meaning of the entire entry. I have been able to determine that the last 4 octets are the IPv4 address (at least in another record)
Thinking that if we clear this up that maybe some of the other tools might start working and we'll be able to clean things up.
Am I just clinging to false hope there?
if I try the netdom method to rename the computer, I'm assuming that I should name it back to big-rig2 correct? So the syntax wuold be:
Code:
netdom renamecomputer big-rig /NewName:big-rig2 /userid:{admin account} /password:{admin password}Correct?
ICTCity
Well-known member
Let's give it a try...
Click here: http://www.translatorscafe.com/cafe/units-converter/numbers/calculator/octal-to-decimal/
You can easly convert from octal to decimal.
In this case you also add in HOST file this line:
63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net IP_big-rig or localhost... no idea... but I think it's the same...
Wait before the rename... try this first.
SailingNut
Well-known member
It's not the octal to decimal that is giving me a problem. It's the meaning of the entire octet string. There are lots of bytes in there but I've only figured out what the last 4 are in a regular DNS entry. I may need to change things other than just the IP address. (Currently it has a nonsensical IP address)
ICTCity
Well-known member
So you could just add the string in host file..
can you PM the string pls?
can you PM the string pls?
SailingNut
Well-known member
I followed the steps in http://support.microsoft.com/kb/816587/en-us and my DC is configured as it should be. All of the SRV entries listed in the KB point to big-rig.wtbhome.net
ICTCity
Well-known member
So it's time to rename... If you can't do this "normally" try in safe mode.
Good luck
Good luck
SailingNut
Well-known member
So I FINALLY had time to do the demote - rename - promote process you suggested. It appears to have worked. I recreated my domain user accounts and things look good.
I do see some errors in dcdiag still, but not sure if they may be expected given my setup.
Here's the output:
I do see some errors in dcdiag still, but not sure if they may be expected given my setup.
Here's the output:
Code:
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = big-rig
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\BIG-RIG
Starting test: Connectivity
......................... BIG-RIG passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\BIG-RIG
Starting test: Advertising
......................... BIG-RIG passed test Advertising
Starting test: FrsEvent
......................... BIG-RIG passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
......................... BIG-RIG failed test DFSREvent
Starting test: SysVolCheck
......................... BIG-RIG passed test SysVolCheck
Starting test: KccEvent
......................... BIG-RIG passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... BIG-RIG passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... BIG-RIG passed test MachineAccount
Starting test: NCSecDesc
......................... BIG-RIG passed test NCSecDesc
Starting test: NetLogons
......................... BIG-RIG passed test NetLogons
Starting test: ObjectsReplicated
......................... BIG-RIG passed test ObjectsReplicated
Starting test: Replications
......................... BIG-RIG passed test Replications
Starting test: RidManager
......................... BIG-RIG passed test RidManager
Starting test: Services
......................... BIG-RIG passed test Services
Starting test: SystemLog
An error event occurred. EventID: 0x0000040B
Time Generated: 05/15/2011 20:30:39
Event String:
The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data.
An error event occurred. EventID: 0x0000040C
Time Generated: 05/15/2011 20:30:39
Event String:
The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data.
An error event occurred. EventID: 0xC0001B61
Time Generated: 05/15/2011 20:30:43
Event String:
A timeout was reached (30000 milliseconds) while waiting for the File Replication Service service to connect.
A warning event occurred. EventID: 0x00002724
Time Generated: 05/15/2011 20:30:46
Event String:
This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.
A warning event occurred. EventID: 0x800009CA
Time Generated: 05/15/2011 20:30:47
Event String:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
A warning event occurred. EventID: 0x800009CA
Time Generated: 05/15/2011 20:30:50
Event String:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
An error event occurred. EventID: 0x0000002E
Time Generated: 05/15/2011 20:44:05
Event String:
The time service encountered an error and was forced to shut down. The error was: 0x80070700: An attempt was made to logon, but the network logon service was not started.
An error event occurred. EventID: 0xC0001B6F
Time Generated: 05/15/2011 20:44:05
Event String:
The Windows Time service terminated with the following error:
An error event occurred. EventID: 0x0000002E
Time Generated: 05/15/2011 20:44:28
Event String:
The time service encountered an error and was forced to shut down. The error was: 0x80070005: Access is denied.
An error event occurred. EventID: 0xC0001B6F
Time Generated: 05/15/2011 20:44:28
Event String:
The Windows Time service terminated with the following error:
A warning event occurred. EventID: 0x8000001D
Time Generated: 05/15/2011 20:46:52
Event String:
The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.
A warning event occurred. EventID: 0x800009CA
Time Generated: 05/15/2011 20:47:00
Event String:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
A warning event occurred. EventID: 0x800009CA
Time Generated: 05/15/2011 20:47:03
Event String:
The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.
An error event occurred. EventID: 0x0000040B
Time Generated: 05/15/2011 20:47:15
Event String:
The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data.
An error event occurred. EventID: 0x0000040C
Time Generated: 05/15/2011 20:47:15
Event String:
The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data.
A warning event occurred. EventID: 0x000003F6
Time Generated: 05/15/2011 20:47:28
Event String:
Name resolution for the name _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.WTBHOME.NET timed out after none of the configured DNS servers responded.
A warning event occurred. EventID: 0x00002724
Time Generated: 05/15/2011 20:47:34
Event String:
This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.
An error event occurred. EventID: 0xC00038D6
Time Generated: 05/15/2011 20:47:38
Event String:
The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
A warning event occurred. EventID: 0x0000000C
Time Generated: 05/15/2011 20:47:37
Event String:
Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
An error event occurred. EventID: 0x00000423
Time Generated: 05/15/2011 20:47:43
Event String:
The DHCP service failed to see a directory server for authorization.
An error event occurred. EventID: 0x00000423
Time Generated: 05/15/2011 20:47:43
Event String:
The DHCP service failed to see a directory server for authorization.
A warning event occurred. EventID: 0x0000A001
Time Generated: 05/15/2011 20:47:43
Event String:
The Security System could not establish a secured connection with the server ldap/wtbhome.net/wtbhome.net@WTBHOME.NET. No authentication protocol was available.
An error event occurred. EventID: 0xC00038D6
Time Generated: 05/15/2011 20:47:53
Event String:
The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.
A warning event occurred. EventID: 0x000727AA
Time Generated: 05/15/2011 20:50:04
Event String:
The WinRM service failed to create the following SPNs: WSMAN/big-rig.wtbhome.net; WSMAN/big-rig.
An error event occurred. EventID: 0x0000165B
Time Generated: 05/15/2011 21:13:30
Event String:
The session setup from computer 'CHGSINLATTITUDE' failed because the security database does not contain a trust account 'CHGSINLATTITUDE$' referenced by the specified computer.
An error event occurred. EventID: 0x000016AD
Time Generated: 05/15/2011 21:15:52
Event String:
The session setup from the computer CHGSINLATTITUDE failed to authenticate. The following error occurred:
An error event occurred. EventID: 0x0000165B
Time Generated: 05/15/2011 21:15:52
Event String:
The session setup from computer 'MISSMAGIC' failed because the security database does not contain a trust account 'MISSMAGIC$' referenced by the specified computer.
......................... BIG-RIG failed test SystemLog
Starting test: VerifyReferences
......................... BIG-RIG passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : wtbhome
Starting test: CheckSDRefDom
......................... wtbhome passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... wtbhome passed test CrossRefValidation
Running enterprise tests on : wtbhome.net
Starting test: LocatorCheck
......................... wtbhome.net passed test LocatorCheck
Starting test: Intersite
......................... wtbhome.net passed test IntersiteICTCity
Well-known member
WELCOME BACK!
You should check something:
1) SYSLOG share (permissions)
2) Check DHCP & TIME services for start account. You may have to change the user account (network, system) if they start with a domain account, check passwords.
The warnings you have, may all be related to time service (which is failing to start). But it seems to be a permission's problem.
let me know.
You should check something:
1) SYSLOG share (permissions)
2) Check DHCP & TIME services for start account. You may have to change the user account (network, system) if they start with a domain account, check passwords.
The warnings you have, may all be related to time service (which is failing to start). But it seems to be a permission's problem.
let me know.
SailingNut
Well-known member
OK, somehow the time service got started since I last rain dcdiag. I then configured the time service to sync to an external source.
However, dcdiag is still complaining abot the time service and being configured to use the domain hirearchy and that it can't find a time server.
This is really odd since I did reconfigure the time service using w23tm /configure and for good measure I rebooted the server and dcdiag still has that time error.
I checked the registry and I do see that the two external time servers I configured are in the registry, but it would appear that it is still configured to use the domain not the external servers I set up.
What can I do to troubleshoot why this is and discover a fix.
Thanks!
However, dcdiag is still complaining abot the time service and being configured to use the domain hirearchy and that it can't find a time server.
This is really odd since I did reconfigure the time service using w23tm /configure and for good measure I rebooted the server and dcdiag still has that time error.
I checked the registry and I do see that the two external time servers I configured are in the registry, but it would appear that it is still configured to use the domain not the external servers I set up.
What can I do to troubleshoot why this is and discover a fix.
Thanks!
Similar threads
- Todd Eichmann
- Networking / Internet / Servers
- K Santhosh
- Visual C# .NET