Urgent problem: Event ID 5781 in Win2003, and clients cannot log on.

http://www.eventid.net/display.asp?eventid=5781&eventno=167&source=NETLOGON&phase=1

this should provide some possible solutions on the server side.

Look at the servers event viewer and the event viewer on the root domain server as well.

Look at your Active Directory Sites & Services and see if your domain is generating a lot of KCC errors.

Generally in a well connected network the sites will set themselves up with the root server but you want to check that with each domain controller that you bring up, especially from a remote site.

Admin3k, I've signed up to this site for help, I don't want to sign up to eventid.net too, and it won't let me look at any of the links without doing so.

Enc, I've taken a look and there are no KCC errors. I've got a couple of new 2088 errors that have just apopeared in the Directory Service Log though. Does that tell you anything?

Thanks

For the 2088 error look here:
http://technet.microsoft.com/en-us/library/cc949121.aspx

For resolution of what might be causing the DNS problem look here:
http://technet.microsoft.com/en-us/library/cc949127.aspx

you do not have to sign up , just read through the comments & proposed solutions on that main page.

When you promote the servers in these remote sites to DCs are you installing DNS first and then promoting them or are you just allowing the DC to install the DC DNS with promotion?

Please allow MBAM to fix the problems , currently no Action taken , MBAM just detected the infections , you have to let it fix it.

Please ignore my last post :)

This issue is mainly mainly a DNS server configuration issue if you will refer to the Event ID link.

Admin: What?

Enc: I promote them and allow the DC to install DNS. The thing is it was working perfectly for a couple of days, and then after a reboot of the server it started coming up with this.

I now have about 40 remote sites around the world.  I generally install DNS first as a secondary zone and then promote the server to a DC.  I used to do what you're doing but I had problems too which is why I began installing DNS first.

Have you run dcdiag on both the root server and the affected Domain Controller?

DCdiag can resolve and ping the server name, but not the GUID DNS CNAME. Also it says the server is not responding to directory requests, although it didn't say that earlier. It also can't find the PDC. I'm getting out of my depth here, it seems to be getting worse by the minute!

That is on the DC on the problem site btw. The others, including the one with the PDC role are passing all tests.

You could demote it back to a member server - then install DNS as a secondary from the root DC and then re-promote it.  That will require a couple of reboots but it will clean everything up.

It seems to be having problems communicating with the root server.

Actually you could attempt to install DNS as a secondary to the root server as well and see if that helps the server to communicate properly with the root DC.

Either of those might be quicker that trying to diagnose the internal communication problem the remote DC is having.

From the Primary root server - under sites and services - is the new DC in the root servers NTDS settings?

New development: I was wondering why the Remote desktop connection to the server was slow, and upon investigating I found that the link to the site is dodgy. ping times are between 300 and 3000ms, and packets keep dropping.

I'm guessing that this is at least partly responisible for the issues? What can I do to solve this once the ISP stabilises the connection, or will everything magically start working again?

I can't demote the Controller because it can't contact another DC to verify the account or upload its data to.

Well that depends - if the connection is lousy then proper replication between the sites could be a factor.  Especially if there are drops occasionally.

Is the ISP involved in the case for the degraded connection?

Yes, I'm waiting for a call back at the moment.

Assuming that is the problem, is it likely to resolve once the conection is better?

Well it will make everything a whole lot easier that's for sure.  The connection would have had to be degraded for awhile though but if it is restored it is quite possible that the replication will clean itself up.

Interesting that from the root DC side everything seems well and good to the root DC.  I would imagine you'd see a few warnings about communication but perhaps from its perspective it is getting enough response through the dirty connection that it thinks things are fine.

There is enough degradation to cause the DC to have problems authenticating the users permissions properly though.  It's not getting the full AD database updated properly which is why your users cannot get to local shares.  I have seen that before.  I changed the default to 7 days so that if a remote site loses connectivity the users on that site can at least log on and get to their local shares off of the server.

Sorry, changed the default what?

Ok, the site link is fixed and I've rebooted the server but it still has the same issues. Netlogon logs three 5781 errors whenever it starts. DNS has no errors, everything else seems absolutely fine. SYSVOL is shared, Netlogon is running and users can sometimes log on with no problems, but still the server often won't find the profiles, or group policies won't be applied.

dcdiag output is atached. despite the problems reported with resolving the GUID entry for the server, there is an entry for it in DNS and an nslookup produces the correct result. The server is a GC server.

Help!!

Domain Controller Diagnosis
 
Performing initial setup:
   * Verifying that the local machine wlspdc01, is a DC. 
   * Connecting to directory service on server wlspdc01.
   * Collecting site info.
   * Identifying all servers.
   * Identifying all NC cross-refs.
   * Found 7 DC(s). Testing 1 of them.
   Done gathering initial info.
 
Doing initial required tests
   
   Testing server: Shepperton\WLSPDC01
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         The host fb82ba6a-dceb-4878-81a7-0f0ab138eda9._msdcs.wlmg.local could not be resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         Although the Guid DNS name
 
         (fb82ba6a-dceb-4878-81a7-0f0ab138eda9._msdcs.wlmg.local) couldn't be
 
         resolved, the server name (wlspdc01.wlmg.local) resolved to the IP
 
         address (10.169.149.1) and was pingable.  Check that the IP address is
 
         registered correctly with the DNS server. 
         ......................... WLSPDC01 failed test Connectivity
 
Doing primary tests
   
   Testing server: Shepperton\WLSPDC01
      Skipping all tests, because server WLSPDC01 is
      not responding to directory service requests
      Test omitted by user request: Topology
      Test omitted by user request: CutoffServers
      Test omitted by user request: OutboundSecureChannels
      Test omitted by user request: VerifyReplicas
      Test omitted by user request: VerifyEnterpriseReferences
      Test omitted by user request: CheckSecurityError
   
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   
   Running partition tests on : wlmg
      Starting test: CrossRefValidation
         ......................... wlmg passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... wlmg passed test CheckSDRefDom
   
   Running enterprise tests on : wlmg.local
      Starting test: Intersite
         Skipping site Shepperton, this site is outside the scope provided by
 
         the command line arguments provided. 
         Skipping site Ruislip, this site is outside the scope provided by the
 
         command line arguments provided. 
         Skipping site Slough, this site is outside the scope provided by the
 
         command line arguments provided. 
         Skipping site HighWycombe, this site is outside the scope provided by
 
         the command line arguments provided. 
         Skipping site Eastcote, this site is outside the scope provided by the
 
         command line arguments provided. 
         Skipping site Hanwell, this site is outside the scope provided by the
 
         command line arguments provided. 
         Skipping site WooburnMoor, this site is outside the scope provided by
 
         the command line arguments provided. 
         Skipping site MillHill, this site is outside the scope provided by the
 
         command line arguments provided. 
         ......................... wlmg.local passed test Intersite
      Starting test: FsmoCheck
         GC Name: \\wlspdc01.wlmg.local
         Locator Flags: 0xe00001fc
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         Time Server Name: \\wlspdc01.wlmg.local
         Locator Flags: 0xe00001fc
         Preferred Time Server Name: \\wlspdc01.wlmg.local
         Locator Flags: 0xe00001fc
         KDC Name: \\wlspdc01.wlmg.local
         Locator Flags: 0xe00001fc
         ......................... wlmg.local failed test FsmoCheck
      Test omitted by user request: DNS
      Test omitted by user request: DNS
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114: