i have 2 DCs on my network, OCP and OCP2. i have only one domain in
my forest. i want to demote the second one (OCP2), but dcpromo is not
working. i get the following error: "The operation failed because:
The Directory Service failed to replicate off changes made locally.
’The DSA operation is unable to proceed because of a DNS lookup
failure.’" i’ve read that i could do a /forceremoval but that it is
only a last resort, so i’d like to see if i can remedy this without
forcing removal.

in http://support.microsoft.com/kb/332199 MS states "Microsoft
Windows 2000 or Microsoft Windows Server 2003 domain controllers may
not gracefully demote by using the Active Directory Installation
Wizard (Dcpromo.exe). CAUSE: This behavior may occur if a required
dependency or operation fails. These include network connectivity,
name resolution, authentication, Active Directory directory service
replication, or the location of a critical object in Active
Directory."

i know that replication is NOT working. i made policy changes a few
weeks ago, and any workstation that pulls its policies from OCP2 does
not get the most recent changes. i can also tell by comparing the
"registry.pol" files. on OCP, the file is 4,856 bytes and dated
3/4/05. on OCP2, the file is 4,216 and dated 2/17/05. however, when
i view the group policy on both machines through an MMC, they are the
same. i don’t know how to fix this.

how do i get these machines in sync with each other?

on a side note, i have verified that OCP is the global catalog server,
domain naming master, pdc emulator, rid master and infrastructure
master. i do not know how to verify if it is the schema master before
i demote OCP2.

how do i verify that the DC i am not trying to demote is not the
schema master?

thank you for any and all help. i’ve been fighting with this for
weeks now.

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Active-...ict345598.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1083753

Hello,
This seems to be a DNS issue.
Ensure all clients/servers and domain controllers within your domain has
there TCP/IP DNS Servers, set to the server hosting dns for your active
directory, it should be one of the domain controllers. Use nslookup to
troubleshooting name resolution. e.g nslookup domainname.com, ensure a DC
answers. as well try e.g ocp.domainname.com , verify you get the name
resolved successfully

The FSMO roles should transfer automatically during demote, this can
operation may fail some times, how ever it dosen't seems to be related in
your case.
--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"thecheat" <(E-Mail Removed)> skrev i meddelandet
news:(E-Mail Removed)...
>i have 2 DCs on my network, OCP and OCP2. i have only one domain in
> my forest. i want to demote the second one (OCP2), but dcpromo is not
> working. i get the following error: "The operation failed because:
> The Directory Service failed to replicate off changes made locally.
> 'The DSA operation is unable to proceed because of a DNS lookup
> failure.'" i've read that i could do a /forceremoval but that it is
> only a last resort, so i'd like to see if i can remedy this without
> forcing removal.
>
> in http://support.microsoft.com/kb/332199 MS states "Microsoft
> Windows 2000 or Microsoft Windows Server 2003 domain controllers may
> not gracefully demote by using the Active Directory Installation
> Wizard (Dcpromo.exe). CAUSE: This behavior may occur if a required
> dependency or operation fails. These include network connectivity,
> name resolution, authentication, Active Directory directory service
> replication, or the location of a critical object in Active
> Directory."
>
> i know that replication is NOT working. i made policy changes a few
> weeks ago, and any workstation that pulls its policies from OCP2 does
> not get the most recent changes. i can also tell by comparing the
> "registry.pol" files. on OCP, the file is 4,856 bytes and dated
> 3/4/05. on OCP2, the file is 4,216 and dated 2/17/05. however, when
> i view the group policy on both machines through an MMC, they are the
> same. i don't know how to fix this.
>
> how do i get these machines in sync with each other?
>
> on a side note, i have verified that OCP is the global catalog server,
> domain naming master, pdc emulator, rid master and infrastructure
> master. i do not know how to verify if it is the schema master before
> i demote OCP2.
>
> how do i verify that the DC i am not trying to demote is not the
> schema master?
>
> thank you for any and all help. i've been fighting with this for
> weeks now.
>
> --
> Posted using the http://www.windowsforumz.com interface, at author's
> request
> Articles individually checked for conformance to usenet standards
> Topic URL:
> http://www.windowsforumz.com/Active-...ict345598.html
> Visit Topic URL to contact author (reg. req'd). Report abuse:
> http://www.windowsforumz.com/eform.php?p=1083753

"Chriss3 MVP" wrote:
> Hello,
> This seems to be a DNS issue.
> Ensure all clients/servers and domain controllers within your
> domain has
> there TCP/IP DNS Servers, set to the server hosting dns for
> your active
> directory, it should be one of the domain controllers. Use
> nslookup to
> troubleshooting name resolution. e.g nslookup domainname.com,
> ensure a DC
> answers. as well try e.g ocp.domainname.com , verify you get
> the name
> resolved successfully
>
> The FSMO roles should transfer automatically during demote,
> this can
> operation may fail some times, how ever it dosen't seems to be
> related in
> your case.
> --
> Regards
> Christoffer Andersson
> Microsoft MVP - Directory Services
>
> No email replies please - reply in the newsgroup
> ------------------------------------------------
> http://www.chrisse.se - Active Directory Tips
>
> "thecheat" <(E-Mail Removed)> skrev i
> meddelandet
> news:(E-Mail Removed)...
> >i have 2 DCs on my network, OCP and OCP2. i have only one
> domain in
> > my forest. i want to demote the second one (OCP2), but
> dcpromo is not
> > working. i get the following error: "The operation failed
> because:
> > The Directory Service failed to replicate off changes made
> locally.
> > 'The DSA operation is unable to proceed because of a DNS
> lookup
> > failure.'" i've read that i could do a /forceremoval but
> that it is
> > only a last resort, so i'd like to see if i can remedy this
> without
> > forcing removal.
> >
> > in http://support.microsoft.com/kb/332199 MS states "Microsoft
> > Windows 2000 or Microsoft Windows Server 2003 domain
> controllers may
> > not gracefully demote by using the Active Directory
> Installation
> > Wizard (Dcpromo.exe). CAUSE: This behavior may occur if a
> required
> > dependency or operation fails. These include network
> connectivity,
> > name resolution, authentication, Active Directory directory
> service
> > replication, or the location of a critical object in Active
> > Directory."
> >
> > i know that replication is NOT working. i made policy
> changes a few
> > weeks ago, and any workstation that pulls its policies from
> OCP2 does
> > not get the most recent changes. i can also tell by
> comparing the
> > "registry.pol" files. on OCP, the file is 4,856 bytes and
> dated
> > 3/4/05. on OCP2, the file is 4,216 and dated 2/17/05.
> however, when
> > i view the group policy on both machines through an MMC,
> they are the
> > same. i don't know how to fix this.
> >
> > how do i get these machines in sync with each other?
> >
> > on a side note, i have verified that OCP is the global
> catalog server,
> > domain naming master, pdc emulator, rid master and
> infrastructure
> > master. i do not know how to verify if it is the schema
> master before
> > i demote OCP2.
> >
> > how do i verify that the DC i am not trying to demote is not
> the
> > schema master?
> >
> > thank you for any and all help. i've been fighting with
> this for
> > weeks now.
> >
> > --
> > Posted using the http://www.windowsforumz.com interface, at author's
> > request
> > Articles individually checked for conformance to usenet
> standards
> > Topic URL:
> > http://www.windowsforumz.com/Active-...ict345598.html
> > Visit Topic URL to contact author (reg. req'd). Report
> abuse:
> > http://www.windowsforumz.com/eform.php?p=1083753

thank you for the help.

i currently have all workstations, and OCP2 (the problem DC), pointed
to OCP for DNS (192.168.1.44).

every computer except OCP (the DNS server) is set up as follows:
preferred DNS: 192.168.1.44 (OCP)
alternate DNS: 199.2.252.10 (Sprint)

OCP (the DNS server) is set up as follows:
preferred DNS: 199.2.252.10 (Sprint)
alternate DNS: 60.something (another internet DNS address)

would you say that i have these configured correctly?

i also meant to say earlier that i am getting the following error in
the event log on OCP

Event Type: Error
Event Source: NtFrs
Event Category: None
Event ID: 13555
Date: 1/24/2005
Time: 8:08:24 AM
User: N/A
Computer: OCP
Description:
The File Replication Service is in an error state.

lastly, here is a screenshot of DNS in MMC on OCP. also, i am using
forwarders on OCP.

http://sadchild.cjb.net/dns.jpg

All DCs and workstations should point to internal DNS servers only, so
preferred set as 192.168.1.44. OCP should point to itself as well and
configured to forward requests to your ISP dns server. So when clients need
to resolve a name to an ip address internally, the dns server would handle
that resolution. Name resolution for hosts outside (Internet), the queries
would be forwarded to the ISP. It would be a good idea to have a second dns
server setup for fault tolerance purposes.

hth,
Chris

"thecheat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "Chriss3 MVP" wrote:
> > Hello,
> > This seems to be a DNS issue.
> > Ensure all clients/servers and domain controllers within your
> > domain has
> > there TCP/IP DNS Servers, set to the server hosting dns for
> > your active
> > directory, it should be one of the domain controllers. Use
> > nslookup to
> > troubleshooting name resolution. e.g nslookup domainname.com,
> > ensure a DC
> > answers. as well try e.g ocp.domainname.com , verify you get
> > the name
> > resolved successfully
> >
> > The FSMO roles should transfer automatically during demote,
> > this can
> > operation may fail some times, how ever it dosen't seems to be
> > related in
> > your case.
> > --
> > Regards
> > Christoffer Andersson
> > Microsoft MVP - Directory Services
> >
> > No email replies please - reply in the newsgroup
> > ------------------------------------------------
> > http://www.chrisse.se - Active Directory Tips
> >
> > "thecheat" <(E-Mail Removed)> skrev i
> > meddelandet
> > news:(E-Mail Removed)...
> > >i have 2 DCs on my network, OCP and OCP2. i have only one
> > domain in
> > > my forest. i want to demote the second one (OCP2), but
> > dcpromo is not
> > > working. i get the following error: "The operation failed
> > because:
> > > The Directory Service failed to replicate off changes made
> > locally.
> > > 'The DSA operation is unable to proceed because of a DNS
> > lookup
> > > failure.'" i've read that i could do a /forceremoval but
> > that it is
> > > only a last resort, so i'd like to see if i can remedy this
> > without
> > > forcing removal.
> > >
> > > in http://support.microsoft.com/kb/332199 MS states "Microsoft
> > > Windows 2000 or Microsoft Windows Server 2003 domain
> > controllers may
> > > not gracefully demote by using the Active Directory
> > Installation
> > > Wizard (Dcpromo.exe). CAUSE: This behavior may occur if a
> > required
> > > dependency or operation fails. These include network
> > connectivity,
> > > name resolution, authentication, Active Directory directory
> > service
> > > replication, or the location of a critical object in Active
> > > Directory."
> > >
> > > i know that replication is NOT working. i made policy
> > changes a few
> > > weeks ago, and any workstation that pulls its policies from
> > OCP2 does
> > > not get the most recent changes. i can also tell by
> > comparing the
> > > "registry.pol" files. on OCP, the file is 4,856 bytes and
> > dated
> > > 3/4/05. on OCP2, the file is 4,216 and dated 2/17/05.
> > however, when
> > > i view the group policy on both machines through an MMC,
> > they are the
> > > same. i don't know how to fix this.
> > >
> > > how do i get these machines in sync with each other?
> > >
> > > on a side note, i have verified that OCP is the global
> > catalog server,
> > > domain naming master, pdc emulator, rid master and
> > infrastructure
> > > master. i do not know how to verify if it is the schema
> > master before
> > > i demote OCP2.
> > >
> > > how do i verify that the DC i am not trying to demote is not
> > the
> > > schema master?
> > >
> > > thank you for any and all help. i've been fighting with
> > this for
> > > weeks now.
> > >
> > > --
> > > Posted using the http://www.windowsforumz.com interface, at author's
> > > request
> > > Articles individually checked for conformance to usenet
> > standards
> > > Topic URL:
> > >
http://www.windowsforumz.com/Active-...ict345598.html
> > > Visit Topic URL to contact author (reg. req'd). Report
> > abuse:
> > > http://www.windowsforumz.com/eform.php?p=1083753
>
> thank you for the help.
>
> i currently have all workstations, and OCP2 (the problem DC), pointed
> to OCP for DNS (192.168.1.44).
>
> every computer except OCP (the DNS server) is set up as follows:
> preferred DNS: 192.168.1.44 (OCP)
> alternate DNS: 199.2.252.10 (Sprint)
>
> OCP (the DNS server) is set up as follows:
> preferred DNS: 199.2.252.10 (Sprint)
> alternate DNS: 60.something (another internet DNS address)
>
> would you say that i have these configured correctly?
>
> i also meant to say earlier that i am getting the following error in
> the event log on OCP
>
> Event Type: Error
> Event Source: NtFrs
> Event Category: None
> Event ID: 13555
> Date: 1/24/2005
> Time: 8:08:24 AM
> User: N/A
> Computer: OCP
> Description:
> The File Replication Service is in an error state.
>
> lastly, here is a screenshot of DNS in MMC on OCP. also, i am using
> forwarders on OCP.
>
> http://sadchild.cjb.net/dns.jpg

"C Hall" wrote:
> All DCs and workstations should point to internal DNS servers
> only, so
> preferred set as 192.168.1.44. OCP should point to itself as
> well and
> configured to forward requests to your ISP dns server. So when
> clients need
> to resolve a name to an ip address internally, the dns server
> would handle
> that resolution. Name resolution for hosts outside (Internet),
> the queries
> would be forwarded to the ISP. It would be a good idea to have
> a second dns
> server setup for fault tolerance purposes.
>
> hth,
> Chris
>
> "thecheat" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > "Chriss3 MVP" wrote:
> &nbsp;> > Hello,
> &nbsp;> > This seems to be a DNS issue.
> &nbsp;> > Ensure all clients/servers and domain controllers
> within your
> &nbsp;> > domain has
> &nbsp;> > there TCP/IP DNS Servers, set to the server hosting
> dns for
> &nbsp;> > your active
> &nbsp;> > directory, it should be one of the domain
> controllers. Use
> &nbsp;> > nslookup to
> &nbsp;> > troubleshooting name resolution. e.g nslookup
> domainname.com,
> &nbsp;> > ensure a DC
> &nbsp;> > answers. as well try e.g ocp.domainname.com ,
> verify you get
> &nbsp;> > the name
> &nbsp;> > resolved successfully
> &nbsp;> >
> &nbsp;> > The FSMO roles should transfer automatically during
> demote,
> &nbsp;> > this can
> &nbsp;> > operation may fail some times, how ever it dosen't
> seems to be
> &nbsp;> > related in
> &nbsp;> > your case.
> &nbsp;> > --
> &nbsp;> > Regards
> &nbsp;> > Christoffer Andersson
> &nbsp;> > Microsoft MVP - Directory Services
> &nbsp;> >
> &nbsp;> > No email replies please - reply in the newsgroup
> &nbsp;> > ------------------------------------------------
> &nbsp;> > http://www.chrisse.se - Active Directory Tips
> &nbsp;> >
> &nbsp;> > "thecheat" &lt;(E-Mail Removed)&gt;
> skrev i
> &nbsp;> > meddelandet
> &nbsp;> >
> news:(E-Mail Removed)...
> &nbsp;&nbsp;> > >i have 2 DCs on my network, OCP and OCP2. i
> have only one
> &nbsp;> > domain in
> &nbsp;&nbsp;> > > my forest. i want to demote the second one
> (OCP2), but
> &nbsp;> > dcpromo is not
> &nbsp;&nbsp;> > > working. i get the following error: "The
> operation failed
> &nbsp;> > because:
> &nbsp;&nbsp;> > > The Directory Service failed to replicate
> off changes made
> &nbsp;> > locally.
> &nbsp;&nbsp;> > > 'The DSA operation is unable to proceed
> because of a DNS
> &nbsp;> > lookup
> &nbsp;&nbsp;> > > failure.'" i've read that i could do a
> /forceremoval but
> &nbsp;> > that it is
> &nbsp;&nbsp;> > > only a last resort, so i'd like to see if i
> can remedy this
> &nbsp;> > without
> &nbsp;&nbsp;> > > forcing removal.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > in http://support.microsoft.com/kb/332199
> MS states "Microsoft
> &nbsp;&nbsp;> > > Windows 2000 or Microsoft Windows Server
> 2003 domain
> &nbsp;> > controllers may
> &nbsp;&nbsp;> > > not gracefully demote by using the Active
> Directory
> &nbsp;> > Installation
> &nbsp;&nbsp;> > > Wizard (Dcpromo.exe). CAUSE: This behavior
> may occur if a
> &nbsp;> > required
> &nbsp;&nbsp;> > > dependency or operation fails. These
> include network
> &nbsp;> > connectivity,
> &nbsp;&nbsp;> > > name resolution, authentication, Active
> Directory directory
> &nbsp;> > service
> &nbsp;&nbsp;> > > replication, or the location of a critical
> object in Active
> &nbsp;&nbsp;> > > Directory."
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > i know that replication is NOT working. i
> made policy
> &nbsp;> > changes a few
> &nbsp;&nbsp;> > > weeks ago, and any workstation that pulls
> its policies from
> &nbsp;> > OCP2 does
> &nbsp;&nbsp;> > > not get the most recent changes. i can
> also tell by
> &nbsp;> > comparing the
> &nbsp;&nbsp;> > > "registry.pol" files. on OCP, the file is
> 4,856 bytes and
> &nbsp;> > dated
> &nbsp;&nbsp;> > > 3/4/05. on OCP2, the file is 4,216 and
> dated 2/17/05.
> &nbsp;> > however, when
> &nbsp;&nbsp;> > > i view the group policy on both machines
> through an MMC,
> &nbsp;> > they are the
> &nbsp;&nbsp;> > > same. i don't know how to fix this.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > how do i get these machines in sync with
> each other?
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > on a side note, i have verified that OCP is
> the global
> &nbsp;> > catalog server,
> &nbsp;&nbsp;> > > domain naming master, pdc emulator, rid
> master and
> &nbsp;> > infrastructure
> &nbsp;&nbsp;> > > master. i do not know how to verify if it
> is the schema
> &nbsp;> > master before
> &nbsp;&nbsp;> > > i demote OCP2.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > how do i verify that the DC i am not trying
> to demote is not
> &nbsp;> > the
> &nbsp;&nbsp;> > > schema master?
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > thank you for any and all help. i've been
> fighting with
> &nbsp;> > this for
> &nbsp;&nbsp;> > > weeks now.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > --
> &nbsp;&nbsp;> > > Posted using the
> http://www.windowsforumz.com interface, at author's
> &nbsp;&nbsp;> > > request
> &nbsp;&nbsp;> > > Articles individually checked for
> conformance to usenet
> &nbsp;> > standards
> &nbsp;&nbsp;> > > Topic URL:
> &nbsp;&nbsp;> > >
> http://www.windowsforumz.com/Active-...ict345598.html
> &nbsp;&nbsp;> > > Visit Topic URL to contact author (reg.
> req'd). Report
> &nbsp;> > abuse:
> &nbsp;&nbsp;> > >
> http://www.windowsforumz.com/eform.php?p=1083753
> >
> > thank you for the help.
> >
> > i currently have all workstations, and OCP2 (the problem
> DC), pointed
> > to OCP for DNS (192.168.1.44).
> >
> > every computer except OCP (the DNS server) is set up as
> follows:
> > preferred DNS: 192.168.1.44 (OCP)
> > alternate DNS: 199.2.252.10 (Sprint)
> >
> > OCP (the DNS server) is set up as follows:
> > preferred DNS: 199.2.252.10 (Sprint)
> > alternate DNS: 60.something (another internet DNS address)
> >
> > would you say that i have these configured correctly?
> >
> > i also meant to say earlier that i am getting the following
> error in
> > the event log on OCP
> >
> > Event Type: Error
> > Event Source: NtFrs
> > Event Category: None
> > Event ID: 13555
> > Date: 1/24/2005
> > Time: 8:08:24 AM
> > User: N/A
> > Computer: OCP
> > Description:
> > The File Replication Service is in an error state.
> >
> > lastly, here is a screenshot of DNS in MMC on OCP. also, i
> am using
> > forwarders on OCP.
> >
> > http://sadchild.cjb.net/dns.jpg

thank you very much. that seems to have been the problem. i set
OCP’s preferred DNS to itself, and then OCP2 demoted itself without
problem!

/tip CHall $10

i have another question.

you can see in the screenshot below that even though OCP2 is no longer
in the Domain Controllers OU, it is still listed as a server in ’sites
and services’. i did notice that the ’NTDS settings’
sub-......."thing" is no longer there under OCP2 anymore, just under
OCP. (sub-folder? sub-item? sub-setting?)

my question is should i manually delete this, will it go away on its
own or should i let it stay there?

http://home.comcast.net/~ingoldsby/ocp2lingers.jpg

Glad that helped.
Good luck,
Chris

"thecheat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "C Hall" wrote:
> > All DCs and workstations should point to internal DNS servers
> > only, so
> > preferred set as 192.168.1.44. OCP should point to itself as
> > well and
> > configured to forward requests to your ISP dns server. So when
> > clients need
> > to resolve a name to an ip address internally, the dns server
> > would handle
> > that resolution. Name resolution for hosts outside (Internet),
> > the queries
> > would be forwarded to the ISP. It would be a good idea to have
> > a second dns
> > server setup for fault tolerance purposes.
> >
> > hth,
> > Chris
> >
> > "thecheat" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > "Chriss3 MVP" wrote:
> > &nbsp;> > Hello,
> > &nbsp;> > This seems to be a DNS issue.
> > &nbsp;> > Ensure all clients/servers and domain controllers
> > within your
> > &nbsp;> > domain has
> > &nbsp;> > there TCP/IP DNS Servers, set to the server hosting
> > dns for
> > &nbsp;> > your active
> > &nbsp;> > directory, it should be one of the domain
> > controllers. Use
> > &nbsp;> > nslookup to
> > &nbsp;> > troubleshooting name resolution. e.g nslookup
> > domainname.com,
> > &nbsp;> > ensure a DC
> > &nbsp;> > answers. as well try e.g ocp.domainname.com ,
> > verify you get
> > &nbsp;> > the name
> > &nbsp;> > resolved successfully
> > &nbsp;> >
> > &nbsp;> > The FSMO roles should transfer automatically during
> > demote,
> > &nbsp;> > this can
> > &nbsp;> > operation may fail some times, how ever it dosen't
> > seems to be
> > &nbsp;> > related in
> > &nbsp;> > your case.
> > &nbsp;> > --
> > &nbsp;> > Regards
> > &nbsp;> > Christoffer Andersson
> > &nbsp;> > Microsoft MVP - Directory Services
> > &nbsp;> >
> > &nbsp;> > No email replies please - reply in the newsgroup
> > &nbsp;> > ------------------------------------------------
> > &nbsp;> > http://www.chrisse.se - Active Directory Tips
> > &nbsp;> >
> > &nbsp;> > "thecheat" &lt;(E-Mail Removed)&gt;
> > skrev i
> > &nbsp;> > meddelandet
> > &nbsp;> >
> > news:(E-Mail Removed)...
> > &nbsp;&nbsp;> > >i have 2 DCs on my network, OCP and OCP2. i
> > have only one
> > &nbsp;> > domain in
> > &nbsp;&nbsp;> > > my forest. i want to demote the second one
> > (OCP2), but
> > &nbsp;> > dcpromo is not
> > &nbsp;&nbsp;> > > working. i get the following error: "The
> > operation failed
> > &nbsp;> > because:
> > &nbsp;&nbsp;> > > The Directory Service failed to replicate
> > off changes made
> > &nbsp;> > locally.
> > &nbsp;&nbsp;> > > 'The DSA operation is unable to proceed
> > because of a DNS
> > &nbsp;> > lookup
> > &nbsp;&nbsp;> > > failure.'" i've read that i could do a
> > /forceremoval but
> > &nbsp;> > that it is
> > &nbsp;&nbsp;> > > only a last resort, so i'd like to see if i
> > can remedy this
> > &nbsp;> > without
> > &nbsp;&nbsp;> > > forcing removal.
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > in http://support.microsoft.com/kb/332199
> > MS states "Microsoft
> > &nbsp;&nbsp;> > > Windows 2000 or Microsoft Windows Server
> > 2003 domain
> > &nbsp;> > controllers may
> > &nbsp;&nbsp;> > > not gracefully demote by using the Active
> > Directory
> > &nbsp;> > Installation
> > &nbsp;&nbsp;> > > Wizard (Dcpromo.exe). CAUSE: This behavior
> > may occur if a
> > &nbsp;> > required
> > &nbsp;&nbsp;> > > dependency or operation fails. These
> > include network
> > &nbsp;> > connectivity,
> > &nbsp;&nbsp;> > > name resolution, authentication, Active
> > Directory directory
> > &nbsp;> > service
> > &nbsp;&nbsp;> > > replication, or the location of a critical
> > object in Active
> > &nbsp;&nbsp;> > > Directory."
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > i know that replication is NOT working. i
> > made policy
> > &nbsp;> > changes a few
> > &nbsp;&nbsp;> > > weeks ago, and any workstation that pulls
> > its policies from
> > &nbsp;> > OCP2 does
> > &nbsp;&nbsp;> > > not get the most recent changes. i can
> > also tell by
> > &nbsp;> > comparing the
> > &nbsp;&nbsp;> > > "registry.pol" files. on OCP, the file is
> > 4,856 bytes and
> > &nbsp;> > dated
> > &nbsp;&nbsp;> > > 3/4/05. on OCP2, the file is 4,216 and
> > dated 2/17/05.
> > &nbsp;> > however, when
> > &nbsp;&nbsp;> > > i view the group policy on both machines
> > through an MMC,
> > &nbsp;> > they are the
> > &nbsp;&nbsp;> > > same. i don't know how to fix this.
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > how do i get these machines in sync with
> > each other?
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > on a side note, i have verified that OCP is
> > the global
> > &nbsp;> > catalog server,
> > &nbsp;&nbsp;> > > domain naming master, pdc emulator, rid
> > master and
> > &nbsp;> > infrastructure
> > &nbsp;&nbsp;> > > master. i do not know how to verify if it
> > is the schema
> > &nbsp;> > master before
> > &nbsp;&nbsp;> > > i demote OCP2.
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > how do i verify that the DC i am not trying
> > to demote is not
> > &nbsp;> > the
> > &nbsp;&nbsp;> > > schema master?
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > thank you for any and all help. i've been
> > fighting with
> > &nbsp;> > this for
> > &nbsp;&nbsp;> > > weeks now.
> > &nbsp;&nbsp;> > >
> > &nbsp;&nbsp;> > > --
> > &nbsp;&nbsp;> > > Posted using the
> > http://www.windowsforumz.com interface, at author's
> > &nbsp;&nbsp;> > > request
> > &nbsp;&nbsp;> > > Articles individually checked for
> > conformance to usenet
> > &nbsp;> > standards
> > &nbsp;&nbsp;> > > Topic URL:
> > &nbsp;&nbsp;> > >
> >
http://www.windowsforumz.com/Active-...ict345598.html
> > &nbsp;&nbsp;> > > Visit Topic URL to contact author (reg.
> > req'd). Report
> > &nbsp;> > abuse:
> > &nbsp;&nbsp;> > >
> > http://www.windowsforumz.com/eform.php?p=1083753
> > >
> > > thank you for the help.
> > >
> > > i currently have all workstations, and OCP2 (the problem
> > DC), pointed
> > > to OCP for DNS (192.168.1.44).
> > >
> > > every computer except OCP (the DNS server) is set up as
> > follows:
> > > preferred DNS: 192.168.1.44 (OCP)
> > > alternate DNS: 199.2.252.10 (Sprint)
> > >
> > > OCP (the DNS server) is set up as follows:
> > > preferred DNS: 199.2.252.10 (Sprint)
> > > alternate DNS: 60.something (another internet DNS address)
> > >
> > > would you say that i have these configured correctly?
> > >
> > > i also meant to say earlier that i am getting the following
> > error in
> > > the event log on OCP
> > >
> > > Event Type: Error
> > > Event Source: NtFrs
> > > Event Category: None
> > > Event ID: 13555
> > > Date: 1/24/2005
> > > Time: 8:08:24 AM
> > > User: N/A
> > > Computer: OCP
> > > Description:
> > > The File Replication Service is in an error state.
> > >
> > > lastly, here is a screenshot of DNS in MMC on OCP. also, i
> > am using
> > > forwarders on OCP.
> > >
> > > http://sadchild.cjb.net/dns.jpg
>
> thank you very much. that seems to have been the problem. i set
> OCP's preferred DNS to itself, and then OCP2 demoted itself without
> problem!
>
> /tip CHall $10
>
> i have another question.
>
> you can see in the screenshot below that even though OCP2 is no longer
> in the Domain Controllers OU, it is still listed as a server in 'sites
> and services'. i did notice that the 'NTDS settings'
> sub-......."thing" is no longer there under OCP2 anymore, just under
> OCP. (sub-folder? sub-item? sub-setting?)
>
> my question is should i manually delete this, will it go away on its
> own or should i let it stay there?
>
> http://home.comcast.net/~ingoldsby/ocp2lingers.jpg

"C Hall" wrote:
> Glad that helped.
> Good luck,
> Chris
>
> "thecheat" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > "C Hall" wrote:
> &nbsp;> > All DCs and workstations should point to internal
> DNS servers
> &nbsp;> > only, so
> &nbsp;> > preferred set as 192.168.1.44. OCP should point to
> itself as
> &nbsp;> > well and
> &nbsp;> > configured to forward requests to your ISP dns
> server. So when
> &nbsp;> > clients need
> &nbsp;> > to resolve a name to an ip address internally, the
> dns server
> &nbsp;> > would handle
> &nbsp;> > that resolution. Name resolution for hosts outside
> (Internet),
> &nbsp;> > the queries
> &nbsp;> > would be forwarded to the ISP. It would be a good
> idea to have
> &nbsp;> > a second dns
> &nbsp;> > server setup for fault tolerance purposes.
> &nbsp;> >
> &nbsp;> > hth,
> &nbsp;> > Chris
> &nbsp;> >
> &nbsp;> > "thecheat" &lt;(E-Mail Removed)&gt;
> wrote in message
> &nbsp;> >
> news:(E-Mail Removed)...
> &nbsp;&nbsp;> > > "Chriss3 MVP" wrote:
> &nbsp;> > &nbsp;&gt; &gt; Hello,
> &nbsp;> > &nbsp;&gt; &gt; This seems to be a DNS issue.
> &nbsp;> > &nbsp;&gt; &gt; Ensure all clients/servers and
> domain controllers
> &nbsp;> > within your
> &nbsp;> > &nbsp;&gt; &gt; domain has
> &nbsp;> > &nbsp;&gt; &gt; there TCP/IP DNS Servers, set to
> the server hosting
> &nbsp;> > dns for
> &nbsp;> > &nbsp;&gt; &gt; your active
> &nbsp;> > &nbsp;&gt; &gt; directory, it should be one of the
> domain
> &nbsp;> > controllers. Use
> &nbsp;> > &nbsp;&gt; &gt; nslookup to
> &nbsp;> > &nbsp;&gt; &gt; troubleshooting name resolution.
> e.g nslookup
> &nbsp;> > domainname.com,
> &nbsp;> > &nbsp;&gt; &gt; ensure a DC
> &nbsp;> > &nbsp;&gt; &gt; answers. as well try e.g
> ocp.domainname.com ,
> &nbsp;> > verify you get
> &nbsp;> > &nbsp;&gt; &gt; the name
> &nbsp;> > &nbsp;&gt; &gt; resolved successfully
> &nbsp;> > &nbsp;&gt; &gt;
> &nbsp;> > &nbsp;&gt; &gt; The FSMO roles should transfer
> automatically during
> &nbsp;> > demote,
> &nbsp;> > &nbsp;&gt; &gt; this can
> &nbsp;> > &nbsp;&gt; &gt; operation may fail some times, how
> ever it dosen't
> &nbsp;> > seems to be
> &nbsp;> > &nbsp;&gt; &gt; related in
> &nbsp;> > &nbsp;&gt; &gt; your case.
> &nbsp;> > &nbsp;&gt; &gt; --
> &nbsp;> > &nbsp;&gt; &gt; Regards
> &nbsp;> > &nbsp;&gt; &gt; Christoffer Andersson
> &nbsp;> > &nbsp;&gt; &gt; Microsoft MVP - Directory Services
> &nbsp;> > &nbsp;&gt; &gt;
> &nbsp;> > &nbsp;&gt; &gt; No email replies please - reply in
> the newsgroup
> &nbsp;> > &nbsp;&gt; &gt;
> ------------------------------------------------
> &nbsp;> > &nbsp;&gt; &gt; http://www.chrisse.se - Active
> Directory Tips
> &nbsp;> > &nbsp;&gt; &gt;
> &nbsp;> > &nbsp;&gt; &gt; "thecheat"
> &lt;(E-Mail Removed)&gt;
> &nbsp;> > skrev i
> &nbsp;> > &nbsp;&gt; &gt; meddelandet
> &nbsp;> > &nbsp;&gt; &gt;
> &nbsp;> >
> news:(E-Mail Removed)...
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;i have 2 DCs on my
> network, OCP and OCP2. i
> &nbsp;> > have only one
> &nbsp;> > &nbsp;&gt; &gt; domain in
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; my forest. i want to
> demote the second one
> &nbsp;> > (OCP2), but
> &nbsp;> > &nbsp;&gt; &gt; dcpromo is not
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; working. i get the
> following error: "The
> &nbsp;> > operation failed
> &nbsp;> > &nbsp;&gt; &gt; because:
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; The Directory Service
> failed to replicate
> &nbsp;> > off changes made
> &nbsp;> > &nbsp;&gt; &gt; locally.
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; 'The DSA operation is
> unable to proceed
> &nbsp;> > because of a DNS
> &nbsp;> > &nbsp;&gt; &gt; lookup
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; failure.'" i've read
> that i could do a
> &nbsp;> > /forceremoval but
> &nbsp;> > &nbsp;&gt; &gt; that it is
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; only a last resort, so
> i'd like to see if i
> &nbsp;> > can remedy this
> &nbsp;> > &nbsp;&gt; &gt; without
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; forcing removal.
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; in
> http://support.microsoft.com/kb/332199
> &nbsp;> > MS states "Microsoft
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Windows 2000 or
> Microsoft Windows Server
> &nbsp;> > 2003 domain
> &nbsp;> > &nbsp;&gt; &gt; controllers may
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; not gracefully demote
> by using the Active
> &nbsp;> > Directory
> &nbsp;> > &nbsp;&gt; &gt; Installation
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Wizard (Dcpromo.exe).
> CAUSE: This behavior
> &nbsp;> > may occur if a
> &nbsp;> > &nbsp;&gt; &gt; required
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; dependency or operation
> fails. These
> &nbsp;> > include network
> &nbsp;> > &nbsp;&gt; &gt; connectivity,
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; name resolution,
> authentication, Active
> &nbsp;> > Directory directory
> &nbsp;> > &nbsp;&gt; &gt; service
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; replication, or the
> location of a critical
> &nbsp;> > object in Active
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Directory."
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; i know that replication
> is NOT working. i
> &nbsp;> > made policy
> &nbsp;> > &nbsp;&gt; &gt; changes a few
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; weeks ago, and any
> workstation that pulls
> &nbsp;> > its policies from
> &nbsp;> > &nbsp;&gt; &gt; OCP2 does
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; not get the most recent
> changes. i can
> &nbsp;> > also tell by
> &nbsp;> > &nbsp;&gt; &gt; comparing the
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; "registry.pol" files.
> on OCP, the file is
> &nbsp;> > 4,856 bytes and
> &nbsp;> > &nbsp;&gt; &gt; dated
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; 3/4/05. on OCP2, the
> file is 4,216 and
> &nbsp;> > dated 2/17/05.
> &nbsp;> > &nbsp;&gt; &gt; however, when
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; i view the group policy
> on both machines
> &nbsp;> > through an MMC,
> &nbsp;> > &nbsp;&gt; &gt; they are the
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; same. i don't know how
> to fix this.
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; how do i get these
> machines in sync with
> &nbsp;> > each other?
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; on a side note, i have
> verified that OCP is
> &nbsp;> > the global
> &nbsp;> > &nbsp;&gt; &gt; catalog server,
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; domain naming master,
> pdc emulator, rid
> &nbsp;> > master and
> &nbsp;> > &nbsp;&gt; &gt; infrastructure
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; master. i do not know
> how to verify if it
> &nbsp;> > is the schema
> &nbsp;> > &nbsp;&gt; &gt; master before
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; i demote OCP2.
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; how do i verify that
> the DC i am not trying
> &nbsp;> > to demote is not
> &nbsp;> > &nbsp;&gt; &gt; the
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; schema master?
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; thank you for any and
> all help. i've been
> &nbsp;> > fighting with
> &nbsp;> > &nbsp;&gt; &gt; this for
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; weeks now.
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; --
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Posted using the
> &nbsp;> > http://www.windowsforumz.com interface, at author's
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; request
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Articles individually
> checked for
> &nbsp;> > conformance to usenet
> &nbsp;> > &nbsp;&gt; &gt; standards
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Topic URL:
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> >
> http://www.windowsforumz.com/Active-...ict345598.html
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt; Visit Topic URL to
> contact author (reg.
> &nbsp;> > req'd). Report
> &nbsp;> > &nbsp;&gt; &gt; abuse:
> &nbsp;> > &nbsp;&nbsp;&gt; &gt; &gt;
> &nbsp;> > http://www.windowsforumz.com/eform.php?p=1083753
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > thank you for the help.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > i currently have all workstations, and OCP2
> (the problem
> &nbsp;> > DC), pointed
> &nbsp;&nbsp;> > > to OCP for DNS (192.168.1.44).
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > every computer except OCP (the DNS server)
> is set up as
> &nbsp;> > follows:
> &nbsp;&nbsp;> > > preferred DNS: 192.168.1.44 (OCP)
> &nbsp;&nbsp;> > > alternate DNS: 199.2.252.10 (Sprint)
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > OCP (the DNS server) is set up as follows:
> &nbsp;&nbsp;> > > preferred DNS: 199.2.252.10 (Sprint)
> &nbsp;&nbsp;> > > alternate DNS: 60.something (another
> internet DNS address)
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > would you say that i have these configured
> correctly?
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > i also meant to say earlier that i am
> getting the following
> &nbsp;> > error in
> &nbsp;&nbsp;> > > the event log on OCP
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > Event Type: Error
> &nbsp;&nbsp;> > > Event Source: NtFrs
> &nbsp;&nbsp;> > > Event Category: None
> &nbsp;&nbsp;> > > Event ID: 13555
> &nbsp;&nbsp;> > > Date: 1/24/2005
> &nbsp;&nbsp;> > > Time: 8:08:24 AM
> &nbsp;&nbsp;> > > User: N/A
> &nbsp;&nbsp;> > > Computer: OCP
> &nbsp;&nbsp;> > > Description:
> &nbsp;&nbsp;> > > The File Replication Service is in an error
> state.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > lastly, here is a screenshot of DNS in MMC
> on OCP. also, i
> &nbsp;> > am using
> &nbsp;&nbsp;> > > forwarders on OCP.
> &nbsp;&nbsp;> > >
> &nbsp;&nbsp;> > > http://sadchild.cjb.net/dns.jpg
> >
> > thank you very much. that seems to have been the problem.
> i set
> > OCP's preferred DNS to itself, and then OCP2 demoted itself
> without
> > problem!
> >
> > /tip CHall $10
> >
> > i have another question.
> >
> > you can see in the screenshot below that even though OCP2 is
> no longer
> > in the Domain Controllers OU, it is still listed as a server
> in 'sites
> > and services'. i did notice that the 'NTDS settings'
> > sub-......."thing" is no longer there under OCP2 anymore,
> just under
> > OCP. (sub-folder? sub-item? sub-setting?)
> >
> > my question is should i manually delete this, will it go
> away on its
> > own or should i let it stay there?
> >
> > http://home.comcast.net/~ingoldsby/ocp2lingers.jpg

does anybody have any insight to my question right above my screenshot
in my last post? "should i manually delete this, will it go away on
its own or should i let it stay there?"

also, someone else on a different forum asked the following question
in the same thread i posted my original question:

Is my problem the same???
Hi,
I have a windows 2000 server which is a DC. I have set up an
additional PC with Windows 2000 server. I have ran DCPROMO and made it
an additional DC. I have also made it an additional global catalog.
When I turn off the original DC server however and leave the
additional DC pc on and try to access users and computers on the PC I
get the following error message:
Naming information cannot be located because: The specified domain
either does not exist or could not be contacted.
What can I do to allow me to access AD when the original DC is
switched off
Is this the same problem? Should I point the DNS on the additional
server to point to itself?

this is where that question was posted if anybody has an answer for
this other person:
http://www.techsupportforum.com/showthread.php?t=44342

See this article:
http://support.microsoft.com/Default.aspx?kbid=216364

> > > http://home.comcast.net/~ingoldsby/ocp2lingers.jpg
>
> does anybody have any insight to my question right above my screenshot
> in my last post? "should i manually delete this, will it go away on
> its own or should i let it stay there?"
>
> also, someone else on a different forum asked the following question
> in the same thread i posted my original question:
>
> Is my problem the same???

It's a bit confusing to bring in another post....are you needing just the
question above answered or do you have other issues? If you have a seperate
issue than the one above, you would probably be best served to start a new
thread.


> Hi,
> I have a windows 2000 server which is a DC. I have set up an
> additional PC with Windows 2000 server. I have ran DCPROMO and made it
> an additional DC. I have also made it an additional global catalog.
> When I turn off the original DC server however and leave the
> additional DC pc on and try to access users and computers on the PC I
> get the following error message:
> Naming information cannot be located because: The specified domain
> either does not exist or could not be contacted.
> What can I do to allow me to access AD when the original DC is
> switched off
> Is this the same problem? Should I point the DNS on the additional
> server to point to itself?
>
> this is where that question was posted if anybody has an answer for
> this other person:
> http://www.techsupportforum.com/showthread.php?t=44342

"C Hall" wrote:
>See this article:
>http://support.microsoft.com/Default.aspx?kbid=216364
>

thank you, that cleared it all up for me.

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Active-...ict345598.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1091706

Glad that helped.
"thecheat" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "C Hall" wrote:
> >See this article:
> >http://support.microsoft.com/Default.aspx?kbid=216364
> >
>
> thank you, that cleared it all up for me.
>
> --
> Posted using the http://www.windowsforumz.com interface, at author's
request
> Articles individually checked for conformance to usenet standards
> Topic URL:
http://www.windowsforumz.com/Active-...ict345598.html
> Visit Topic URL to contact author (reg. req'd). Report abuse:
http://www.windowsforumz.com/eform.php?p=1091706