when old 2kDC turned off - new 03dc cant verify users ?

[scott]

Hi

Does anyone know what else do i need to do to my 2000 dc and 2003 dc so that
when i switch it off my 2000 dc everything in my domain works as normal ?

So far i have:
- run forestprep domainprep from 2003 cd run on 2000 AD
- added 2003 member server then ran dcpromo to make it additional dc
- transferred schema, naming, RID, PDC, infrastructure roles to new 2003 dc
- deselected global catalog on old 2kdc and selected it on 2003 dc
- all LAN clients now use 2003 dc for WINS, DNS, DHCP

yet when i switch off my 2K DC:
- my clients have net access so DNS and DHCP must be ok
- clients can browse network neighbourhood so WINS must be ok
- but i cant access any member server drives

Its seems the user names cannot be authenticated unless 2kDC still on.

(ie i cant browse to a shared on a machine via nw neighbourhood because as
soon as i select a machine im prompted for user + pass).

Does anyone know why ?

Thanks for your time
Scott

 

[Robert L [MS-MVP]]

We have seen many cases like this recently. Assuming you have transferred all roles to the 2003 DC, it could be the FRS issue. Any errors in event Viewer? or use dcdiag to check any errors. this case study may help,

We follow these articles to transfer all DC role, DNS, WINS and DHCP from Windows 2000 DC to the 2003 DC, but 2003 server doesn't function like DC. We experience the following issues...
Upgrade 2000 DC to 2003 DC


Bob Lin, MS-MVP, MCSE & CNE
Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net
How to Setup Windows, Network, VPN & Remote Access on http://www.HowToNetworking.com
Hi

Does anyone know what else do i need to do to my 2000 dc and 2003 dc so that
when i switch it off my 2000 dc everything in my domain works as normal ?

So far i have:
- run forestprep domainprep from 2003 cd run on 2000 AD
- added 2003 member server then ran dcpromo to make it additional dc
- transferred schema, naming, RID, PDC, infrastructure roles to new 2003 dc
- deselected global catalog on old 2kdc and selected it on 2003 dc
- all LAN clients now use 2003 dc for WINS, DNS, DHCP

yet when i switch off my 2K DC:
- my clients have net access so DNS and DHCP must be ok
- clients can browse network neighbourhood so WINS must be ok
- but i cant access any member server drives

Its seems the user names cannot be authenticated unless 2kDC still on.

(ie i cant browse to a shared on a machine via nw neighbourhood because as
soon as i select a machine im prompted for user + pass).

Does anyone know why ?

Thanks for your time
Scott

 

[scott]

thanks for reply. when examining the event log for "File replication service" i see Event ID 13508

-----------------------------------------------------------------------------------------------------------------
The File Replication Service is having trouble enabling replication from \\dserver.domain.COM to BSERVER for c:\windows\sysvol\domain using the DNS name \\dserver.domain.COM. FRS will keep retrying.

Following are some of the reasons you would see this warning.


[1] FRS can not correctly resolve the DNS name \\dserver.domain.COM from this computer.

[2] FRS is not running on \\dserver.domain.COM.

[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.


This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

-----------------------------------------------------------------------------------------------------------------

dserver is old 2000 DC, bserver is new 03 DC and is set to look at its self for DNS resolution.

could this be somthing to do with it ?

thanks

scott

 

[scott]

also got this is applicaiton log

ID 1006

Windows cannot bind to domain.COM domain. (Local Error). Group Policy processing aborted.



ID 1030

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

 

[Richard G. Harper]

Try rebooting one client PC with the Win2K server down - can that PC browse
the network afterwards? If so you may just need to let the other computers
'settle down' to see the new DC.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

 

[Robert L [MS-MVP]]

as mentioned, it is FRS issue. read the case carefully.

--
For more and other information, go to http://howtonetworking.com.

Don't send e-mail or reply to me except you need consulting services.
Posting on MS newsgroup will benefit all readers and you may get more help.

Bob Lin, MS-MVP, MCSE & CNE
How to Setup Windows, Network, Remote Access on
http://www.HowToNetworking.com
Networking, Internet, Routing, VPN Troubleshooting on
http://www.ChicagoTech.net
This posting is provided "AS IS" with no warranties.
thanks for reply. when examining the event log for "File replication
service" i see Event ID 13508

-----------------------------------------------------------------------------------------------------------------
The File Replication Service is having trouble enabling replication from
\\dserver.domain.COM to BSERVER for c:\windows\sysvol\domain using the DNS
name \\dserver.domain.COM. FRS will keep retrying.

Following are some of the reasons you would see this warning.


[1] FRS can not correctly resolve the DNS name \\dserver.domain.COM from
this computer.

[2] FRS is not running on \\dserver.domain.COM.

[3] The topology information in the Active Directory for this replica has
not yet replicated to all the Domain Controllers.


This event log message will appear once per connection, After the problem is
fixed you will see another event log message indicating that the connection
has been established.

-----------------------------------------------------------------------------------------------------------------

dserver is old 2000 DC, bserver is new 03 DC and is set to look at its self
for DNS resolution.

could this be somthing to do with it ?

thanks

scott

 

[scott]

thanks again.

1.How to Move the Global Catalog Role to Another Domain Controller

bserver (new dc) hosts global cat after rebooting both DCs.



2.How to view and transfer FSMO roles in the graphical user interface

previously this was ok (displayed bserver my new server for all) now im
getting the following after rebooting both DCs


ROLE where server

SCHEMA AD schema snapin error

NAMING AD domains + trusts bserver

INFRASTRUCTURE AD Users+C error

RID AD Users+C error

PDC AD Usere+C error



I guess i need to seize the roles. It will not let me change as it cant see
BSERVER.

3. Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

i want to check this is a good idea before trying in light of the above ?

 

[scott]

Hi Richard,

Unforruntrly when the first dc (dserver) is down a and one client is reboot
it cant browse the network i.e when it tries to access a server/drive its
prompted for a user + pass i.e user cannot be authticated on domain. As my
new DC (bserver) host wins and dns i guess thats why the client can see
other machine when browsing + why it has net access.

When runnnig dcdiag /v i get the following results :

as you can see BSERVER (according to BSERVER where dcdiag was run) seems to
hold all roles. The catalog hoever still seems to be retained by DSERVER.

Any idea what i should do from here ?

Thanks
Scott



----------------------------------------------------
Domain Controller Diagnosis

Performing initial setup:
* Verifying that the local machine bserver, is a DC.
* Connecting to directory service on server bserver.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 2 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\BSERVER
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... BSERVER passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\BSERVER
Starting test: Replications
* Replications Check
* Replication Latency Check
* Replication Site Latency Check
......................... BSERVER passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions Check for
DC=ForestDnsZones,DC=domain,DC=com
(NDNC,Version 2)
* Security Permissions Check for
DC=DomainDnsZones,DC=domain,DC=com
(NDNC,Version 2)
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=domain,DC=com
(Schema,Version 2)
* Security Permissions Check for
CN=Configuration,DC=domain,DC=com
(Configuration,Version 2)
* Security Permissions Check for
DC=domain,DC=com
(Domain,Version 2)
......................... BSERVER passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
......................... BSERVER passed test NetLogons
Starting test: Advertising
Warning: DsGetDcName returned information for \\dserver.domain.COM,
when we were trying to reach BSERVER.
Server is not responding or is not considered suitable.
The DC BSERVER is advertising itself as a DC and having a DS.
The DC BSERVER is advertising as an LDAP server
The DC BSERVER is advertising as having a writeable directory
The DC BSERVER is advertising as a Key Distribution Center
The DC BSERVER is advertising as a time server
The DS BSERVER is advertising as a GC.
......................... BSERVER failed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Domain Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role PDC Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Rid Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Infrastructure Update Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
......................... BSERVER passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 2101 to 1073741823
* bserver.domain.COM is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 1601 to 2100
* rIDPreviousAllocationPool is 1601 to 2100
* rIDNextRID: 1601
......................... BSERVER passed test RidManager
Starting test: MachineAccount
* SPN found :LDAP/bserver.domain.COM/domain.com
* SPN found :LDAP/bserver.domain.COM
* SPN found :LDAP/BSERVER
* SPN found :LDAP/bserver.domain.COM/domain
* SPN found
:LDAP/41a036d2-d434-4d3d-aa0b-3fb95a176fd4._msdcs.domain.com
* SPN found
:E3514235-4B06-11D1-AB04-00C04FC2DCD2/41a036d2-d434-4d3d-aa0b-3fb95a176fd4/domain.com
* SPN found :HOST/bserver.domain.COM/domain.com
* SPN found :HOST/bserver.domain.COM
* SPN found :HOST/BSERVER
* SPN found :HOST/bserver.domain.COM/domain
* SPN found :GC/bserver.domain.COM/domain.com
......................... BSERVER passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: Idomainerv
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: w32time
* Checking Service: NETLOGON
......................... BSERVER passed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
BSERVER is in domain DC=domain,DC=com
Checking for CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com in
domain DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
in domain CN=Configuration,DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
......................... BSERVER passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
The registry lookup failed to determine the state of the SYSVOL.
The

error returned was 0 (The operation completed successfully.).
Check

the FRS event log to see if the SYSVOL has successfully been
shared.
......................... BSERVER passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
There are warning or error events within the last 24 hours after
the

SYSVOL has been shared. Failing SYSVOL replication problems may
cause

Group Policy problems.
An Warning Event occured. EventID: 0x800034FE
Time Generated: 09/12/2005 11:47:08
Event String: File Replication Service is scanning the data in

the system volume. Computer BSERVER cannot become

a domain controller until this process is

complete. The system volume will then be shared

as SYSVOL.



To check for the SYSVOL share, at the command

prompt, type:

net share



When File Replication Service completes the

scanning process, the SYSVOL share will appear.



The initialization of the system volume can take

some time. The time is dependent on the amount of

data in the system volume.
An Warning Event occured. EventID: 0x800034C4
Time Generated: 09/12/2005 11:48:52
Event String: The File Replication Service is having trouble

enabling replication from \\dserver.domain.COM to

BSERVER for c:\windows\sysvol\domain using the

DNS name \\dserver.domain.COM. FRS will keep

retrying.

Following are some of the reasons you would see

this warning.



[1] FRS can not correctly resolve the DNS name

\\dserver.domain.COM from this computer.

[2] FRS is not running on \\dserver.domain.COM.

[3] The topology information in the Active

Directory for this replica has not yet replicated

to all the Domain Controllers.



This event log message will appear once per

connection, After the problem is fixed you will

see another event log message indicating that the

connection has been established.
An Warning Event occured. EventID: 0x800034C4
Time Generated: 09/12/2005 11:56:53
Event String: The File Replication Service is having trouble

enabling replication from DSERVER to BSERVER for

c:\windows\sysvol\domain using the DNS name

dserver.domain.COM. FRS will keep retrying.

Following are some of the reasons you would see

this warning.



[1] FRS can not correctly resolve the DNS name

dserver.domain.COM from this computer.

[2] FRS is not running on dserver.domain.COM.

[3] The topology information in the Active

Directory for this replica has not yet replicated

to all the Domain Controllers.



This event log message will appear once per

connection, After the problem is fixed you will

see another event log message indicating that the

connection has been established.
......................... BSERVER failed test frsevent
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the last 15
minutes.
......................... BSERVER passed test kccevent
Starting test: systemlog
* The System Event log test
Found no errors in System Event log in the last 60 minutes.
......................... BSERVER passed test systemlog
Test omitted by user request: VerifyReplicas
Starting test: VerifyReferences
The system object reference (serverReference)

CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com and backlink on

CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com

are correct.
The system object reference (frsComputerReferenceBL)

CN=BSERVER,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domain,DC=com

and backlink on CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com
are

correct.
The system object reference (serverReferenceBL)

CN=BSERVER,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domain,DC=com

and backlink on

CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com

are correct.
......................... BSERVER passed test VerifyReferences
Test omitted by user request: VerifyEnterpriseReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : domain
Starting test: CrossRefValidation
......................... domain passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... domain passed test CheckSDRefDom

Running enterprise tests on : domain.com
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the
scope

provided by the command line arguments provided.
......................... domain.com passed test Intersite
Starting test: FsmoCheck
GC Name: \\dserver.domain.COM
Locator Flags: 0xe00001fc
PDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Time Server Name: \\dserver.domain.COM
Locator Flags: 0xe00001fc
Preferred Time Server Name: \\dserver.domain.COM
Locator Flags: 0xe00001fc
KDC Name: \\dserver.domain.COM
Locator Flags: 0xe00001fc
......................... domain.com passed test FsmoCheck

 

[scott]

after a restart of BSERVER im now getting this (note dserver is available).


Starting test: FsmoCheck
Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355
A Global Catalog Server could not be located - All GC's are down.
PDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Time Server Name: \\dserver.domain.COM
Locator Flags: 0xe00001f8
Preferred Time Server Name: \\dserver.domain.COM
Locator Flags: 0xe00001f8
KDC Name: \\dserver.domain.COM
Locator Flags: 0xe00001f8
......................... SMS.com failed test FsmoCheck



did a search on this error Warning: DcGetDcName(GC_SERVER_REQUIRED)
call failed, error 1355
A Global Catalog Server could not be located - All GC's are down.
and found thus article

http://support.microsoft.com/default.aspx?scid=kb;en-us;q316790

which im about to try.

 

[scott]

that seemed to help.

Starting test: FsmoCheck
GC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
PDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Preferred Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
KDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
......................... domain.com passed test FsmoCheck

 

[scott]

all roles now look at bserver and DCDIAG looks ok (unless anyone tells me
different). SYSLOGON scripts and NETLOGON stil not available however and i
have not drive switching off dserver (old dc) yet.


Domain Controller Diagnosis

Performing initial setup:
* Verifying that the local machine bserver, is a DC.
* Connecting to directory service on server bserver.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 2 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\BSERVER
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... BSERVER passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\BSERVER
Starting test: Replications
* Replications Check
[Replications Check,BSERVER] A recent replication attempt failed:
From DSERVER to BSERVER
Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=com
The replication generated an error (8524):
The DSA operation is unable to proceed because of a DNS lookup
failure.
The failure occurred at 2005-09-12 14:14:30.
The last success occurred at 2005-09-12 13:54:15.
1 failures have occurred since the last success.
The guid-based DNS name
d01b35d9-1284-4cb0-9cd8-ae9d5c7bb186._msdcs.domain.com
is not registered on one or more DNS servers.
[Replications Check,BSERVER] A recent replication attempt failed:
From DSERVER to BSERVER
Naming Context: CN=Configuration,DC=domain,DC=com
The replication generated an error (8524):
The DSA operation is unable to proceed because of a DNS lookup
failure.
The failure occurred at 2005-09-12 14:14:30.
The last success occurred at 2005-09-12 13:54:14.
1 failures have occurred since the last success.
The guid-based DNS name
d01b35d9-1284-4cb0-9cd8-ae9d5c7bb186._msdcs.domain.com
is not registered on one or more DNS servers.
[Replications Check,BSERVER] A recent replication attempt failed:
From DSERVER to BSERVER
Naming Context: DC=domain,DC=com
The replication generated an error (8524):
The DSA operation is unable to proceed because of a DNS lookup
failure.
The failure occurred at 2005-09-12 14:14:30.
The last success occurred at 2005-09-12 13:54:14.
1 failures have occurred since the last success.
The guid-based DNS name
d01b35d9-1284-4cb0-9cd8-ae9d5c7bb186._msdcs.domain.com
is not registered on one or more DNS servers.
* Replication Latency Check
* Replication Site Latency Check
......................... BSERVER passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions Check for
DC=ForestDnsZones,DC=domain,DC=com
(NDNC,Version 2)
* Security Permissions Check for
DC=DomainDnsZones,DC=domain,DC=com
(NDNC,Version 2)
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=domain,DC=com
(Schema,Version 2)
* Security Permissions Check for
CN=Configuration,DC=domain,DC=com
(Configuration,Version 2)
* Security Permissions Check for
DC=domain,DC=com
(Domain,Version 2)
......................... BSERVER passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
......................... BSERVER passed test NetLogons
Starting test: Advertising
The DC BSERVER is advertising itself as a DC and having a DS.
The DC BSERVER is advertising as an LDAP server
The DC BSERVER is advertising as having a writeable directory
The DC BSERVER is advertising as a Key Distribution Center
The DC BSERVER is advertising as a time server
The DS BSERVER is advertising as a GC.
......................... BSERVER passed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Domain Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role PDC Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Rid Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Infrastructure Update Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
......................... BSERVER passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 2101 to 1073741823
* bserver.domain.COM is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 1601 to 2100
* rIDPreviousAllocationPool is 1601 to 2100
* rIDNextRID: 1601
......................... BSERVER passed test RidManager
Starting test: MachineAccount
* SPN found :LDAP/bserver.domain.COM/domain.com
* SPN found :LDAP/bserver.domain.COM
* SPN found :LDAP/BSERVER
* SPN found :LDAP/bserver.domain.COM/domain
* SPN found
:LDAP/41a036d2-d434-4d3d-aa0b-3fb95a176fd4._msdcs.domain.com
* SPN found
:E3514235-4B06-11D1-AB04-00C04FC2DCD2/41a036d2-d434-4d3d-aa0b-3fb95a176fd4/domain.com
* SPN found :HOST/bserver.domain.COM/domain.com
* SPN found :HOST/bserver.domain.COM
* SPN found :HOST/BSERVER
* SPN found :HOST/bserver.domain.COM/domain
* SPN found :GC/bserver.domain.COM/domain.com
......................... BSERVER passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: Idomainerv
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: w32time
* Checking Service: NETLOGON
......................... BSERVER passed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
BSERVER is in domain DC=domain,DC=com
Checking for CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com in
domain DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
in domain CN=Configuration,DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
......................... BSERVER passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... BSERVER passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
There are warning or error events within the last 24 hours after
the

SYSVOL has been shared. Failing SYSVOL replication problems may
cause

Group Policy problems.
An Warning Event occured. EventID: 0x800034C4
Time Generated: 09/12/2005 14:36:31
Event String: The File Replication Service is having trouble

enabling replication from DSERVER to BSERVER for

c:\windows\sysvol\domain using the DNS name

dserver.domain.COM. FRS will keep retrying.

Following are some of the reasons you would see

this warning.



[1] FRS can not correctly resolve the DNS name

dserver.domain.COM from this computer.

[2] FRS is not running on dserver.domain.COM.

[3] The topology information in the Active

Directory for this replica has not yet replicated

to all the Domain Controllers.



This event log message will appear once per

connection, After the problem is fixed you will

see another event log message indicating that the

connection has been established.
......................... BSERVER failed test frsevent
Starting test: kccevent
* The KCC Event log test
An Error Event occured. EventID: 0xC0000466
Time Generated: 09/12/2005 14:29:01
Event String: Active Directory was unable to establish a

connection with the global catalog.



Additional Data

Error value:

1355

The specified domain either does not exist or could not be contacted.



Internal ID:

3200caf



User Action:

Make sure a global catalog is available in the

forest, and is reachable from this domain

controller. You may use the nltest utility to

diagnose this problem.
......................... BSERVER failed test kccevent
Starting test: systemlog
* The System Event log test
An Error Event occured. EventID: 0x0000164A
Time Generated: 09/12/2005 14:34:51
Event String: The Netlogon service could not create server

share C:\WINDOWS\SYSVOL\sysvol\domain.COM\SCRIPTS.

The following error occurred:

%%2
......................... BSERVER failed test systemlog
Test omitted by user request: VerifyReplicas
Starting test: VerifyReferences
The system object reference (serverReference)

CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com and backlink on

CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com

are correct.
The system object reference (frsComputerReferenceBL)

CN=BSERVER,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domain,DC=com

and backlink on CN=BSERVER,OU=Domain Controllers,DC=domain,DC=com
are

correct.
The system object reference (serverReferenceBL)

CN=BSERVER,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domain,DC=com

and backlink on

CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com

are correct.
......................... BSERVER passed test VerifyReferences
Test omitted by user request: VerifyEnterpriseReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : domain
Starting test: CrossRefValidation
......................... domain passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... domain passed test CheckSDRefDom

Running enterprise tests on : domain.com
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the
scope

provided by the command line arguments provided.
......................... domain.com passed test Intersite
Starting test: FsmoCheck
GC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
PDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Preferred Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
KDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
......................... domain.com passed test FsmoCheck

 

[scott]

ok. dcdiag on dserver seems to report all 5 roles on BSERVER which is nice.
although this is a worry.


The DC DSERVER is advertising itself as a DC and having a DS.
The DC DSERVER is advertising as an LDAP server
The DC DSERVER is advertising as having a writeable directory
The DC DSERVER is advertising as a Key Distribution Center
The DC DSERVER is advertising as a time server






DC Diagnosis

Performing initial setup:
* Verifing that the local machine dserver, is a DC.
* Connecting to directory service on server dserver.
* Collecting site info.
* Identifying all servers.
* Found 2 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial non skippeable tests

Testing server: Default-First-Site-Name\DSERVER
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... DSERVER passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DSERVER
Starting test: Replications
* Replications Check
......................... DSERVER passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=domain,DC=com
* Security Permissions Check for
CN=Configuration,DC=domain,DC=com
* Security Permissions Check for
DC=domain,DC=com
......................... DSERVER passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
......................... DSERVER passed test NetLogons
Starting test: Advertising
Warning: DsGetDcName returned information for \\bserver.domain.COM,
when we were trying to reach DSERVER.
Server is not responding or is not considered suitable.
The DC DSERVER is advertising itself as a DC and having a DS.
The DC DSERVER is advertising as an LDAP server
The DC DSERVER is advertising as having a writeable directory
The DC DSERVER is advertising as a Key Distribution Center
The DC DSERVER is advertising as a time server
......................... DSERVER failed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Domain Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role PDC Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Rid Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
Role Infrastructure Update Owner = CN=NTDS
Settings,CN=BSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
......................... DSERVER passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 2101 to 1073741823
* (null) is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 1101 to 1600
* rIDNextRID: 1185
* rIDPreviousAllocationPool is 1101 to 1600
......................... DSERVER passed test RidManager
Starting test: MachineAccount
* SPN found :LDAP/dserver.domain.COM/domain.com
* SPN found :LDAP/dserver.domain.COM
* SPN found :LDAP/DSERVER
* SPN found :LDAP/dserver.domain.COM/domain
* SPN found
:LDAP/d01b35d9-1284-4cb0-9cd8-ae9d5c7bb186._msdcs.domain.com
* SPN found
:E3514235-4B06-11D1-AB04-00C04FC2DCD2/d01b35d9-1284-4cb0-9cd8-ae9d5c7bb186/domain.com
* SPN found :HOST/dserver.domain.COM/domain.com
* SPN found :HOST/dserver.domain.COM
* SPN found :HOST/DSERVER
* SPN found :HOST/dserver.domain.COM/domain
* SPN found :GC/dserver.domain.COM/domain.com
......................... DSERVER passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: Idomainerv
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: RPCLOCATOR
* Checking Service: w32time
* Checking Service: TrkWks
* Checking Service: TrkSvr
* Checking Service: NETLOGON
......................... DSERVER passed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
DSERVER is in domain DC=domain,DC=com
Checking for CN=DSERVER,OU=Domain Controllers,DC=domain,DC=com in
domain DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS
Settings,CN=DSERVER,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com
in domain CN=Configuration,DC=domain,DC=com on 1 servers
Object is up-to-date on all servers.
......................... DSERVER passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service Event log test
Error: No record of File Replication System, SYSVOL started.
The Active Directory may be prevented from starting.
There are errors after the SYSVOL has been shared.
The SYSVOL can prevent the AD from starting.
An Warning Event occured. EventID: 0x800034FD
Time Generated: 09/12/2005 14:34:51
Event String: File Replication Service is initializing the

system volume with data from another domain

controller. Computer DSERVER cannot become a

domain controller until this process is complete.

The system volume will then be shared as SYSVOL.



To check for the SYSVOL share, at the command

prompt, type:

net share



When File Replication Service completes the

initialization process, the SYSVOL share will

appear.



The initialization of the system volume can take

some time. The time is dependent on the amount of

data in the system volume, the availability of

other domain controllers, and the replication

interval between domain controllers.
An Warning Event occured. EventID: 0x800034D0
Time Generated: 09/12/2005 14:34:51
Event String: The File Replication Service moved the

preexisting files in c:\winnt\sysvol\domain to

c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog.





The File Replication Service may delete the files

in

c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog

at any time. Files can be saved from deletion by

copying them out of

c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog.

Copying the files into c:\winnt\sysvol\domain

may lead to name conflicts if the files already

exist on some other replicating partner.



In some cases, the File Replication Service may

copy a file from

c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog

into c:\winnt\sysvol\domain instead of

replicating the file from some other replicating

partner.



Space can be recovered at any time by deleting

the files in

c:\winnt\sysvol\domain\NtFrs_PreExisting___See_EventLog.


......................... DSERVER passed test frssysvol
Starting test: kccevent
* The KCC Event log test
An Warning Event occured. EventID: 0x800004F1
Time Generated: 09/12/2005 14:40:56
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x800004F1
Time Generated: 09/12/2005 14:40:56
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x800004F1
Time Generated: 09/12/2005 14:40:56
(Event String could not be retrieved)
......................... DSERVER failed test kccevent
Starting test: systemlog
* The System Event log test
Found no errors in System Event log in the last 60 minutes.
......................... DSERVER passed test systemlog

Running enterprise tests on : domain.com
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the
scope

provided by the command line arguments provided.
......................... domain.com passed test Intersite
Starting test: FsmoCheck
Warning: Couldn't verify this server as a GC in this servers AD.
GC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Warning: Couldn't verify this server as a PDC using DsListRoles()
PDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
Preferred Time Server Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
KDC Name: \\bserver.domain.COM
Locator Flags: 0xe00003fd
......................... domain.com passed test FsmoCheck

 

[scott]

PROBLEMS

when rebooting a clinet and entering "echo %logonserver%" i still get
dserver.

dcdiag on dserver still gives me this (although i have not demoted it yet so
maybe this is normal)
The DC DSERVER is advertising itself as a DC and having a DS.
The DC DSERVER is advertising as an LDAP server
The DC DSERVER is advertising as having a writeable directory
The DC DSERVER is advertising as a Key Distribution Center
The DC DSERVER is advertising as a time server

netlogon and sysvol still not replicated on new dc.

Thanks for any advice
Scott

 

[scott]

Been through most of the articles but they seem reference problems with FSMO roles now only. DCDIAG reports that all FMSO roles (according to bserver and dserver) reside with bserver (which it right i think).

SCHEMA bserver bserver

NAMING bserver bserver

INFRASRRUCTURE bserver bserver

RID bserver bserver

PDC bserver bserver

GLOBAL CATALOG bserver bserver



NETLOGON and SYSVOL still not replicated on bserver from deserver, think this is the problem now.

Thanks
Scott

 

[Phillip Windell]

At the risk of stating the obvious,....do the Clients have *all* of your
DC/DNS Servers listed in their network settings? If they only have the
one,...then the one is all they will work with,...shut it down and they will
fail and will not see the other DC/DNSs you may have.


--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

 

[Richard G. Harper]

To add to what Phillip said, you also need to be sure that the old server is
looking at the NEW server for its DNS - it probably is looking at itself,
but since you now want the new server to be the master you need to be sure
that the old one points to the new one for name resolution. That should
clear up any remaining problems I think.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Been through most of the articles but they seem reference problems with FSMO
roles now only. DCDIAG reports that all FMSO roles (according to bserver
and dserver) reside with bserver (which it right i think).

SCHEMA bserver bserver

NAMING bserver bserver

INFRASRRUCTURE bserver bserver

RID bserver bserver

PDC bserver bserver

GLOBAL CATALOG bserver bserver



NETLOGON and SYSVOL still not replicated on bserver from deserver, think
this is the problem now.

Thanks
Scott

 

[scott]

Hi,

Im quite happy to accept the obvious troubleshooting tips as well as any
others, such is my lack of knowledge with this. All clients are looking at
the NEW DC for DNS resolution. This new DC is supposed to be taking over
(old DC will be formated and brought on line as 03 member server).

At the moment new DC is looking at old DC for DNS resolution. The new DC has
relicated polices + scripts but im missing NETLOGON from both servers. Is it
possible to recerate ?

Thanks again for your time
Scott

 

[Phillip Windell]

The New DC needs to have itself listed first in the network settings and
then list the other (old) DC after that, so it will always look to itself
first and only look to the other (old) DC if its own DNS Service had quit
running (which isn't likely). Any external DNS Server (like the ISPs) needs
to be configured as a Forwarder on the Forwarders List of *all* of your
DC/DNSs. All your DC/DNSs need permissions at the Firewall to make DNS
Queries to the Internet based on the DNSs listed in the Forwarders List.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp