Solved

Setting up additional domain controller and Exchange replication server.

Posted on 2004-04-13
12
947 Views
Last Modified: 2008-02-01
Hi Everyone,

I have to make some changes to my network and am just looking for some advice really.  I'm not partically clear on the best way to go forward...

We have two offices in our organisation.  At the head office I have a Windows 2000 Server running Exchange 2000 with Active Directory.  At the second office I have a Windows 2000 server which is just a file server really.  The two sites are linked via a site to site VPN, over a broadband connection (2 meg lease line at head office and 2 meg ADSL at second office).  At present the 10 people at the second site just login the the head office domain straight accross the VPN, they also login to the Exchange server to access email over the VPN.  This seems to be running pretty slow and was only ever intended as a tempory intergration (which was completed in a hurry).  Now I want to setup an additional domain controller down there using the 2000 server I have, do I set this as a child domain or whats the best way to set this up so they dont have to login accross the VPN, just the severs doing replication over the VPN.  I also have another copy of Exchange 2000, I wanted to setip a replicating server for Exchange down there so they can login to the server on site and use mail.  

Any advice is much appreciated.

Alan
0
Comment
Question by:Alan-Yeo
  • 6
  • 5
12 Comments
 

Expert Comment

by:superplay
ID: 10815695

I would set-up as follows:

Sites
-----
Cretae two "windows 2000 sites" one site for each physical location and keep both sites in one domain.
Set-up the site replicion on the "Site Link" to occur out of hours.

A windows site is the scope of replicaion.

DC
---
Install the DC at the second location and set this up as a Global Cataloge server, otherwise Exchange and user logons will need to cross the wan to reach a GC.

Excahnge
-----------
What you need to do is install the excahnge server as a secondary server into the forest and move the mailboxs across the the new server, so the remote users mailboxs are on thier local server.

Others
-------
You could look at replicaiing other services across the link such as DNS.

Super Play

0
 
LVL 16

Expert Comment

by:JamesDS
ID: 10815912
Alan-Yeo

Change your existing DNS to AD integrated

Promote the existing remote windows 2000 server to a Domain Controller using DCPROMO.EXE and select new domain controller in an existing domain.
Install the DNS service and configure it with the correct zone name
Once these servers are replicated you will be able to create a new AD site using the Active Directory Sites and Services MMC tool.

Create the new AD site and move the new DC into it - the site names are irrelevant and can be anything without a space in it.

Move the remote site subnets into the new AD site and use the replmon tool in the support tools pack on the CD (under \support) to ensure that replication is still going fine.

Ensure that both sites are in the sitelink for your site (usually called defaultfirstsitelink) under intersite transports in the Active Directory Sites and Services MMC tool.

Change your remote clients DNS settings so that they point to the new local DC/DNS server as the primary

I suggest that you leave the replication window as it is as you may have trouble with replication not occuring correctly - you can always change it later.

The exchange server should be setup as superplay say, but beware that exchange is resource hungry and may want a server on its own.

Cheers

JamesDS

0
 

Author Comment

by:Alan-Yeo
ID: 10848529
Hi Guys,

Thanks for you earlier posts, they were extremly helpfull.

I completed the first part of this last night, I have the additional domain controller setup with the two sites, replication and DNS working fine.  It went in relitivly trouble free, just a few DNS issues at the beginning.

Now I am moving onto setting up the additional Exchange Server.  I have installed Exchange on the new DC, I also installed the Exchange Active Directory Connector.  I then installed the Exchange Active Directory Connector on my Primary server as it wasn't already installed.  Now, if I go into Exchange System Manager on the second DC I can see both servers and am able to move mailboxes accross.  On the first server I still only see the Primary server and not the new Exchange server I just setup.  I have moved one mailbox to test.  You said in your earlier post that I need to set it up as a secondary server into the forest, well I'm not exactly sure how to configure this?  It seems to have just connected to my other Exchange server without any configuration.  With the user I have moved the mailbox on I am able to login to the new exchange server and all the mail is there, but if I send a new message it does come through.

Again, any help is much appreciated.

Thanks,

Alan
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 10848889
Alan-Yeo

I'm not an exchange chap (although you might want to check your global catalogs are all ok) but it sounds like you have just a last small hurdle to pass and all will be fine.

superplay, you about? then perhaps we can wrap this one up

Cheers

JamesDS
0
 

Author Comment

by:Alan-Yeo
ID: 10849056
Hi JamesDS,

Yes one last hurdle to go.  i have been doing some research and have found some problems which i think may be affecting this.  i receive the following message in the Directory services event log;

Source:    NTDS KCC
Category: Knowledge Consistency
Event ID: 1311

Description:

The Directory Service consistency checker has determined that either (a) there is not enough physical connectivity published via the Active Directory Sites and Services Manager to create a spanning tree connecting all the sites containing the Partition CN=Configuration,DC=REDHILL,DC=BUTLERINTERNATIONAL,DC=CO,DC=UK, or (b) replication cannot be performed with one or more critical servers in order for changes to propagate across all sites (most often due to the servers being unreachable).  

For (a), please use the Active Directory Sites and Services Manager to do one of the following:
1. Publish sufficient site connectivity information such that the system can infer a route by which this Partition can reach this site.  This option is preferred.
2. Add an ntdsConnection object to a Domain Controller that contains the Partition CN=Configuration,DC=REDHILL,DC=BUTLERINTERNATIONAL,DC=CO,DC=UK in this site from a Domain Controller that contains the same Partition in another site.  

For (b), please see previous events logged by the NTDS KCC source that identify the servers that could not be contacted.


I also receive erros if I run a DCdiag on my primary server;C:\WINNT\Profiles\Administrator>dcdiag

DC Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial non skippeable tests

   Testing server: Default-First-Site-Name\BSG-NT-SERVER
      Starting test: Connectivity
         ......................... BSG-NT-SERVER passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\BSG-NT-SERVER
      Starting test: Replications
         [Replications Check,BSG-NT-SERVER] A recent replication attempt failed:

            From CBSBUTLER2 to BSG-NT-SERVER
            Naming Context: CN=Schema,CN=Configuration,DC=REDHILL,DC=BUTLERINTER
NATIONAL,DC=CO,DC=UK
            The replication generated an error (8524):
            The DSA operation is unable to proceed because of a DNS lookup failu
re.
            The failure occurred at 2004-04-17 11:58.33.
            The last success occurred at 2004-04-17 00:24.00.
            8 failures have occurred since the last success.
            The guid-based DNS name 1b1aba48-c860-44b3-b1e5-126a01f6aa3d._msdcs.
REDHILL.BUTLERINTERNATIONAL.CO.UK
            is not registered on one or more DNS servers.
         [Replications Check,BSG-NT-SERVER] A recent replication attempt failed:

            From CBSBUTLER2 to BSG-NT-SERVER
            Naming Context: CN=Configuration,DC=REDHILL,DC=BUTLERINTERNATIONAL,D
C=CO,DC=UK
            The replication generated an error (8524):
            The DSA operation is unable to proceed because of a DNS lookup failu
re.
            The failure occurred at 2004-04-17 11:58.33.
            The last success occurred at 2004-04-17 00:24.00.
            8 failures have occurred since the last success.
            The guid-based DNS name 1b1aba48-c860-44b3-b1e5-126a01f6aa3d._msdcs.
REDHILL.BUTLERINTERNATIONAL.CO.UK
            is not registered on one or more DNS servers.
         [Replications Check,BSG-NT-SERVER] A recent replication attempt failed:

            From CBSBUTLER2 to BSG-NT-SERVER
            Naming Context: DC=REDHILL,DC=BUTLERINTERNATIONAL,DC=CO,DC=UK
            The replication generated an error (8524):
            The DSA operation is unable to proceed because of a DNS lookup failu
re.
            The failure occurred at 2004-04-17 11:58.33.
            The last success occurred at 2004-04-17 00:23.59.
            8 failures have occurred since the last success.
            The guid-based DNS name 1b1aba48-c860-44b3-b1e5-126a01f6aa3d._msdcs.
REDHILL.BUTLERINTERNATIONAL.CO.UK
            is not registered on one or more DNS servers.
         ......................... BSG-NT-SERVER passed test Replications
      Starting test: NCSecDesc
         ......................... BSG-NT-SERVER passed test NCSecDesc
      Starting test: NetLogons
         ......................... BSG-NT-SERVER passed test NetLogons
      Starting test: Advertising
         ......................... BSG-NT-SERVER passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... BSG-NT-SERVER passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... BSG-NT-SERVER passed test RidManager
      Starting test: MachineAccount
         ......................... BSG-NT-SERVER passed test MachineAccount
      Starting test: Services
         ......................... BSG-NT-SERVER passed test Services
      Starting test: ObjectsReplicated
         ......................... BSG-NT-SERVER passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... BSG-NT-SERVER passed test frssysvol
      Starting test: kccevent
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 04/17/2004   14:23:25
            Event String: All servers in site
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 04/17/2004   14:23:25
            Event String: The Directory Service consistency checker has
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 04/17/2004   14:23:25
            Event String: All servers in site
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 04/17/2004   14:23:25
            Event String: The Directory Service consistency checker has
         ......................... BSG-NT-SERVER failed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0xC0001B77
            Time Generated: 04/17/2004   13:59:46
            Event String: The Dell BaseBoard Agent service terminated
         An Error Event occured.  EventID: 0x0000010C
            Time Generated: 04/17/2004   14:05:14
            Event String: Server: "\\\REDHILL\\BSG-NT-SERVER" Alert:
         An Error Event occured.  EventID: 0xC0001B77
            Time Generated: 04/17/2004   14:06:00
            Event String: The DELL_SERVER service terminated unexpectedly.
         ......................... BSG-NT-SERVER failed test systemlog

   Running enterprise tests on : REDHILL.BUTLERINTERNATIONAL.CO.UK
      Starting test: Intersite
         ......................... REDHILL.BUTLERINTERNATIONAL.CO.UK passed test
 Intersite
      Starting test: FsmoCheck
         ......................... REDHILL.BUTLERINTERNATIONAL.CO.UK passed test
 FsmoCheck

C:\WINNT\Profiles\Administrator>


If I run DCdiag on my second DC it passes everything.

Any ideas, I'm lost :(

Thanks,

Alan

0
 
LVL 16

Accepted Solution

by:
JamesDS earned 500 total points
ID: 10849765
Alan

Go to each DC and check that they are both set up as AD integrated DNS Servers and pointing to EACH OTHER as primary and themselves as secondary DNS in the IP settings.

At the command line for each DC run the following commands:

IPCONFIG /FLUSHDNS
IPCONFIG /REGISTERDNS
NLTEST /DSREGDNS

If your DNS has been setup correctly then this will fix the missing DNS DNS entries.
Wait 15 minutes and check the event logs for KCC Errors
RUN REPLMON.EXE from the support tools pack on the CD

Let me know how it goes.

Cheers

JamesDS
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:Alan-Yeo
ID: 10849966
Hi JamesDS,

Ok, the DNS server were pointing at themselves as primary and each other as secondary.  I have now changed this round.

I ran IPCONFIG /FLUSHDNS and IPCONFIG /REGISTERDNS on both servers.  I couldn't run the NLTEST /DSREGDNS command as I wasn't sure how to use it correctly, it just showed the usage options when I entered it as above.

Anyway, we had success.  If I run DCdiag both server pass all tests now.  The Replmon also reports that both servers are successfully replicating.

The new Exchange server is still not operating correctly though.  If I move a mailbox to the second DC and then try and logon to Exchange from the client machine it gives me an error saying it failed to logon.  

Having both DC's pass a DCdiag was a pre-requisite for installing Exchange 2000.  I failed to test this before I installed.  Do you think I should remove Exchange on the second server and re-install.  If so I could do with some help with how exactly you configure it to be a secondary server in the forest.  Weather I should be installing the Active Directory Connector for Exchange on both servers.  And weather I need to install a site replication service or not.

Thanks V much for you help!

Alan

P.S i dont know if its possible to give more points than 500?  you deserve um.
0
 

Author Comment

by:Alan-Yeo
ID: 10850101
Just an update...

I can now login to the exchange mailbox I transferred from the Primary server to the remote server.  I am able to send messages from an external account to this account, but if I reply I receive a failed receipt that says the following:

"The e-mail system was unable to deliver the message, but did not report a specific reason."

I can send an internal email and it gets through ok, but again when I reply it doesn't come through and I dont get any failed receipt this time.

Nearly there :)

Thanks,

Alan
0
 

Author Comment

by:Alan-Yeo
ID: 10851441
Another update...

I can now send and receive external emails from the mail account/mailbox I moved over to the new DC.  I added the second DC under Administrative Groups, First Administrative Group, Routing Groups, Connectors, (my connector) and Local Brideheads.  I think this is what got external mail working for the mailbox on the second DC.  I just cant send internal messages, they leave the client machine but never get delivered, no failed delivery receipt or error message.

Thanks,

Alan
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 10852878
Alan

I am not an exchange guru (not since v5.5)
As we have answered the Windows 2003 section of your question I recommend that your repost the remaining bits of your problem in the Exchange section of EE and close this one down.

If you want to award more than 500 points you can set up a new question in the Windows 2003 area called "points for ..." and then accept the first post from your chosen benefactor. This is reasonably common on EE.

When you post your new question I recommend you don't include everything that went before as it will confuse the issue, but do say that you had DNS issues that you believe were the root cause, but these have now been resolved and you need to clean up the mess and get it working.

Post back here is there is anything else I can help with.

Cheers

JamesDS
0
 

Author Comment

by:Alan-Yeo
ID: 10853219
JamesDS,

I will re-post the Exchange issue in the relivant section.  Thanks for all your help on this, much appreciated.

Points are coming your way.

Alan
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 10854379
Alan

Welcome, and thank you for the points
Cheers

JamesDS
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now