backup login server

[DW]

I inherited a setup of two Windows 2000 servers. The first server is used
for primary authentication to the domain. The second server is the Exchange
2000 server for email. If the first server goes down, existing sessions are
fine, but anyone who attempts to log in is not able to authenticate.

Now, I was under the impression that in AD, the authentication duties were
shared between systems. Obviously, I was wrong. Is it possible (or even
advisable) to get the Exchange 2k server to service authentication requests
if the primary server is down?

I searched the internet, but I obviously missed this topic. Thanks in
advance for your help to a (AD) newbie..


--dw

 

[Herb Martin]

I inherited a setup of two Windows 2000 servers. The first server is used
for primary authentication to the domain.

Not really -- all DCs that are available are used for authentication,
although preference is given to those in the same (or nearest) site.

The second server is the Exchange
2000 server for email. If the first server goes down, existing sessions are
fine, but anyone who attempts to log in is not able to authenticate.

You have DNS misconfigured (99% of the time) -- and likely you may
need to make sure that both DCs are GCs since Exchange uses the GC
for the (older) GAL (global address list.)

Now, I was under the impression that in AD, the authentication duties were
shared between systems.
Yes.

Obviously, I was wrong. Is it possible (or even
advisable) to get the Exchange 2k server to service authentication requests
if the primary server is down?

Yes. -- after you fix DNS

I searched the internet, but I obviously missed this topic. Thanks in
advance for your help to a (AD) newbie..

It's a common error even for people who THINK they fully understand
AD and DNS:

DNS must be dynamic (yours probably is) and fully replicated (mostly
a problem for people who screw up DNS and use multiple AD-integrated
DNS servers BEFORE they straighten out the DNS and AD replication
problems that depend on the DNS.)

ALL internal clients must point to BOTH internal DNS servers so that they
will be able to resolve DNS and thus DCs from either one. (Remember that
DCs are DNS clients too.)

Make sure both DCs are properly registered with BOTH DNS servers
(DNS zone transfer or replication.) If you fix any of the above, then you
can restart NetLogon service to get that DC to re-register.

 

[DW]

DNS must be dynamic (yours probably is) and fully replicated (mostly

a problem for people who screw up DNS and use multiple AD-integrated
DNS servers BEFORE they straighten out the DNS and AD replication
problems that depend on the DNS.)

DNS is dynamic. Systems added to the domain (or via DHCP) are resolvable
immediately. The DNS records are replicated between the two systems
successfully (after about a 15 minute lag)

ALL internal clients must point to BOTH internal DNS servers so that they
will be able to resolve DNS and thus DCs from either one. (Remember that
DCs are DNS clients too.)

This one was correct except for the DC's. They didn't have each other set
as a DNS server.

Make sure both DCs are properly registered with BOTH DNS servers
(DNS zone transfer or replication.) If you fix any of the above, then you
can restart NetLogon service to get that DC to re-register.

This also appears to be correct. The only caveat is that an old server
which died and was removed had a DNS entry of "from parent container". I
removed the entry (and suspect that this was what was causing the issue)
Systems were trying to authenticate to a non-existing server...

I'm going to let the data replicate and get back to you. Thanks for your
help!

 

[DW]

It must've been that old DNS server. Works as expected now. Thanks

 

[Herb Martin]

[You other email says it's working now...]

This one was correct except for the DC's. They didn't have each other set
as a DNS server.

This part isn't as critical for DNS servers -- since if the DNS service is
down, the server itself is likely down or undergoing maintenance but it
seldom hurts and MIGHT help.

If I didn't mention it before, you might run DCDiag on each DC and
capture the output to a text file to search for FAIL, WARN, ERROR.