Client Authentication Problem

H

Henry

I recently provisioned a 2k AD domain controller and
installed it in our only remote site. The site is
connected to our HQ by a T1. At our primary site we have
two other 2k AD domain controllers.

The problem is that we have clients at our primary site
choosing our remote domain controller to log into and if
it becomes disconnected (WAN down) the clients cant
authenticate. Shouldnt the clients be choosing the local
controllers.

Any help would be appreciated.
 
S

Shawn Rabourn \(MS\)

You need to create Sites in AD Sites and Services and Associate Subnets with
those sites in AD Sites and Services. This is a classic symptom of these
not being configured.

--Shawn
This posting is provided "AS IS" with no warranties and confers no rights.
 
C

Cary Shultz [A.D. MVP]

Henry,

Shawn is absolutely correct. However, here are a few details that might
help you along. AD Replication can be a bit tricky.

First, as Shawn suggested, you should set up Sites using the adss mmc. You
will find that you have a Default-First-Site-Name already. If you so
choose, you can rename it to whatever makes sense. I would then create the
appropriate Subnet objects and associate them with this Site. This is very
important.

I would then create the second Site. Give it whatever name makes sense.
Create the appropriate Subnet objects and associate them with this Site.
Make sure that you move the DC object that is actually located at this Site
to this Site.

If you have not already done so, create the Site Link. You need to do this
so that the KCC will know about the two Sites and how to handle everything.

Here are several links:

How to create and configure a WIN2000 Site
http://support.microsoft.com/default.aspx?scid=kb;en-us;318480

How to create and configure a Site Link
http://support.microsoft.com/default.aspx?scid=kb;en-us;316812

How to Optimize the location of DCs and GCs **** This is what you are
currently experiencing ****
http://support.microsoft.com/default.aspx?scid=kb;en-us;306602

The Role of Bridgehead Servers **** I would let the KCC handle this ****
http://support.microsoft.com/default.aspx?scid=kb;en-us;271997&Product=win2000

The Role of the ISTG
http://support.microsoft.com/default.aspx?scid=kb;en-us;224815&Product=win2000

How to T/S Intra-Site Replication Issues
http://support.microsoft.com/default.aspx?scid=kb;en-us;249256

How WIN2000 Clients locate a DC
http://support.microsoft.com/default.aspx?scid=KB;en-us;247811

How WINXP Clients locate a DC
http://support.microsoft.com/default.aspx?scid=kb;[LN];314861


Just a few things to know:

1) in WIN2000 Active Directory, there are two kinds of Replication:
intra-site and inter-site.
1a) intra-site replication is the AD replication that happens between
all DCs in that specific site.
1b) inter-site replication is the AD replication that happens between
AD Sites.
2) in WIN2000 Active Directory, the KCC ( Knowledge Consistency Checker )
dynamically takes care of creating and managing all incoming replication
objects.
2a) for intra-site replication, you - the Admin - really do not
*need* to do anything. The KCC uses the
intra-site topology generator to do all of this.
2b) for inter-site replication, you - the Admin - really only *need*
to create the Site Link ( and possibly
Site Link Bridges ). The KCC does the rest with help from the
inter-site topology generator.
3) in WIN2000 Active Directory, all replication is based on one-way incoming
replication objects. This means that if you have two DCs in Site1 the
following will happen:
- on DC01 there will be an incoming replication object representing
DC02 for each NC
- on DC02 there will be an incoming replication object representing
DC01 for each NC
4) in WIN2000 Active Directory, there are three AD Partitions, or Naming
Contexts, that are replicated;
- Schema Naming Context
- Configuration Naming Context
- Domain Naming Context
5) in WIN2000 Active Directory, the Schema NC and Configuration NC are
replicated to each and every DC in the entire Forest while the Domain NC is
replicated to each and every DC in that specific domain.
6) in WIN2000 Active Directory, replication between Sites takes place
between the Bridgehead Server in each Site. So, if you have Site1 with
three DCs and Site2 with one DC the following will happen:
- the KCC selects one of the three DCs in Site1 to act as the
Bridgehead Server for inter-site replication
and the KCC selects one of the one DC ( sounds funny, huh? ) in Site2
to act as the Bridgehead Server.
The inter-site replication for that round happens between the two
Bridgehead Servers.

HTH,

Cary
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top