Unable to browse different AD site after moving WINS to 2008 DC

Check DHCP Scope options to see what WINS server the DHCP clients are getting passed to them.

Then, go to the 2003 server and see if you have any event log errors in the 8000's like 8032 or 8021 that elude to a master browser conflict. They will say something like XXXcomputer thinks it is a master browser, the browser service has been stopped and an election has been forced.

Thanks Netman66 and ChiefIT for your suggestions....
To clarify: (Site 1) 2003 Member server and 2008 DC running WINS
DHCP scope options have member server as primary, and DC as secondary for WINS
(Site 2) Member server 2003 only is running WINS, DHCP scope options reflect that.
The 2008 DC is firewall enabled , and there is an exception for WINS traffic
Portqry to 2008 DC from WINS member server in same site (SITE 1) results in:
TCP port 137 FILTERED
UDP Port 137 (netbios-ns service) LISTENING or FILTERED
NetBIOS adapter status query to UDP 137: LISTENING
UDP port 42 (nameserver service): LISTENING or FILTERED
I will check the event logs for 8000 series entries and get back to you with my results.....thanks again to both of you.

I believe I see a couple problems:

1) You just brought a 2008 server on line. but the 2003 server has been on line as the domain master browser. Have you rebooted the 2003 server since? A reboot will force the election process again, so the 2003 server will recognize the 2008 server as the domain master browser.

2) You also have a firewall enabled:

There are two methods Netbios uses to populate a browselist. One is called netbios over TCP/IP and the other is netbios over SMB. These are their port numbers and applications.

Netbios over TCP, using WINS:
netbios-ns      137/tcp    NETBIOS Name Service    (WINS)
netbios-ns      137/udp    NETBIOS Name Service    (WINS)
netbios-dgm     138/tcp    NETBIOS Datagram Service
netbios-dgm     138/udp    NETBIOS Datagram Service
netbios-ssn     139/tcp    NETBIOS Session Service
netbios-ssn     139/udp    NETBIOS Session Service

Netbios over SMB:
microsoft-ds    445/tcp    Microsoft-DS
microsoft-ds    445/udp    Microsoft-DS
netbios-ssn     139/tcp    NETBIOS Session Service
netbios-ssn     139/udp    NETBIOS Session Service

Netbios broadcasts are used to populate WINS. So, when filtered WINS records don't update.

3) You might also want to check your node type passed down by DHCP:
It should be Hybrid node type.

http://support.microsoft.com/kb/160177

Though this will not effect site-to-site WINS connections, this may effect your browser services. I am pretty certain things are good there.

With the info I have, my best guess is a browser conflict between the site's DCs. You should see that in Event logs. But, the firewall is certainly a problem between the sites.  

Node type is hybrid (DHCP is running on member 2003 servers in Site 1 and Site 2 )
I did not reboot the former WINS server (2003 DC) after I promoted the 2008 DC.....will do that this evening.
When I referred to firewall enabled, I meant the Windows firewall on the 2008 DC itself.....there are no physical firewalls between sites, just routers (obviously) and a dedicated link.
It did all work fine before I brought the 2008 DC up and moved WINS to it......I will concentrate from the browser perspective.

Thank you.....will let you know how it goes.

Netman66,
I just re-read your post.....are you saying I should or can turn port filtering off on the 2008 DC for 137 tcp\udp ?

You should be able to modify the exception for WINS traffic by adding TCP 137 - you stated 137 UDP is listening.  I also saw port 42 listening or filtered - this needs to say listening.

OK....I added these as exceptions for Windows Firewall on the 2008 DC

@netman:

Port 42: isn't this for SANS?

Am I missing something?

http://www.iss.net/security_center/advice/Exploits/Ports/42/default.htm

Well, I rebooted the 2003 DC that used to host WINS and checked in the event logs for master browser conflicts and so far have found nothing....stiil having the browsing problem.
Will keep looking over my config......thanks all.

I have an article for you to read, that explains the master browser services to a T. Though it is a NT4 article, the browser service has not changed at all. Even the registry keys are the same, except one slight difference.

That difference would be:

NT4: the registry key is: ISDOMAINMASTERBROWSER
2000 server/client, xp, 2007 Windows, 2008 server, 2003 server the registry key is: ISDOMAINMASTER

Shouldn't need to be edited.

Now that the 2003 server has been rebooted and you are not seeing the browser conflict errors, you clients may need a reboot and they will start populating the browselist. It sounds like the 2008 server now knows it is the domain master browser.

Here is that NT4 article: (It also explains the WINS setup to work with the master browser services).
http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/chptr3.mspx?mfr=true

ChiefIT,

Thanks once again.....but I think I need to restate the problem.....I don't want to mislead anyone.
In both sites , the browse lists are populated, but only with machines from that respective site......
Both sites only see machines in their sites, where before you could browse both sites irrespective of the site you were physically located in.
I believe I'm looking at a replication problem across sites.....am I wrong ?

That's a problem with WINS and probably a replication problem.

The link between sites can not be made via netbios broadcasts. So, this is where WINS comes in handy. Netbios uses WINS as a crutch to route.

By the way, the port of interest for WINS are:

Port 137 UDP and TCP.

Correct.....understood....the native broadcasts can't traverse the routers, so, back to the replication issue between servers.
Have looked at the replication setup once again and this is what I have set:

Site 1 - two WINS servers (2008 DC, 2003 R2 Member server)--- these are replication partners Push\Pull
Site 2 - one WINS server (2003 R2 Member server)--- replication partner is 2008 DC in Site 1 Push\Pull
All WINS servers are pointing to themselves for WINS in TCP\IP properties
Can ping by name and ip all day across sites.....
My setup is not complicated, and at the risk of sounding like a broken record, it worked before I made the 2008 DC a WINS server....???

Troubleshooting WINS replication:
http://technet.microsoft.com/en-us/library/cc776938(WS.10).aspx

Unless you have static mappings, it might be prudent to delete all records from the 2008 server and it's replication partner in the other site  to see if 1) the 2008 repopulates from its local partner and 2) the replication partner offsite begins replicating with the 2008 box.  This will tell us which partner(s) are failing.

Ran browstat and the 2008 DC wasn't even listed.
Browser service was disabled on the server, so I started it and rebooted......
Chances of this contributing to my problem ?

Well, it was the stopped browser service on the 2008 DC that was the culprit .....
I believe this service is enabled by default on 2003 and earlier, that's why I didn't think about until I ran the browstat utility that ChiefIT suggested and didn't see the server listed.
Thanks to you both for your expertise !