Hello All.
Recently I have been having some problems with my company's active directory. Initially we noticed that replication between Domain Controllers was not working. Later on our exchange server was playing up. Lately all hell has broke loose. Before a detailed problem explanation here is a schematic of the Servers, LAN, and Internet
I N T E R N E T
R O O T E R
-------------------------
| | | | |
| WWW | DNS1 |
| | |
EMAIL DNS2 PROXY
This is the Internet side... All servers have public IPs
The LAN side is as follows.
L A N
R O O T E R
--------------------------
----------
----------
-------
| | | | | | | | |
Email | DNS1 | PROXY | DC2 | WORKSTATIONS
WWW DNS2 DC1 OTHER
SRVs
All the servers that exist on both sides are done so by using 2 NICs with different IPs. DC2 is the GC for the domain and has all the FSMO's
What seems to happen is that somehow workstations cannot communicate with the domain controllers. At one point the first domain controller (say DC1) could not communicate with the second Domain Controller (say DC2) whereas DC2 could communicate with DC1. I repaired that problem by performing a "netdom reset" between DC1 and DC2. That seemed to fix the replication issue as well.
The next manifastation of the problem was that no workstation could contact the outside world. All workstations were set to only use DC1 and DC2 as DNS servers and DC2 somehow was propagating all unknown DNS queries to the proper DNS servers. (BTW now I get the error that I cannot set forwarders on the DNS server of DC1 and DC2 because they are root servers) This was somehow bypassed by setting a second DNS server entry on the Proxy server. This second DNS entry is the actuall DNS server from the ISP. Ideally DC's should pass the DNS queries to the DNS1 and DNS2... Am I correct in saying that or talking complete nosence.
I also tried to install a new Email exchange server (2003 on a new machine with 2 NICs) and I get the usual "You do not have admin rights" message when i run ForestPrep. But the user used is the Domain Admin with full rights (exchange schema admin etc..etc.). When I finally managed to achieve the password reset between the new mail server and the DC2 (which is also the full FSMO and GC for the domain) I achieved in running the Forest Prep but DomainPrep was now throwing an error. The error read that I had not run the ForestPrep.?!?!?!?
After a lot on tinkering I believe that the problem resides somewhere in the passwords and Kerberos. I dont exactly know how this works (Kerberos that is) but roughly workstation requests a key and KDC (kerberos distribution center or what ever is called) passes that key so that the workstation can talk to the domain. All the errors I was (and still are) getting are "Access Denied" errors.
Does anybody have any idea of what is happening. Am I correct in believing there is an issue with Kerberos. Can you help me. Ask me if you need any more information for debugging.
Regards
George
