[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

ID 4010 in DNS zone _msdcs.domain.local 2003 after create this zone manually

Posted on 2005-04-12
8
Medium Priority
?
3,725 Views
Last Modified: 2012-05-05
Hello All, I did install new 2003 server and by acident I delete _msdcs.domain.local zone in the root of forward lookup zone. Tried to fix it by recreating _msdcs zone folder under domain.local forward lookup zone and it successfully did it the same way as win2000 server dns structure, but not like required by win2003 server. After reading some articles I create  _msdcs.domain.local manually and register dns, stop and start netlogon services and DNS zone folders return to the original 2003 server configuration, all dcdiag test is passed, but each time I restart DNS I have error msg ID 4010 about The DNS server was unable to create a resource record for  96ad9995-4c01-42c7-99a8-85812e2f6361._msdcs.domain.local. in zone domain.local. The Active Directory definition of this resource record is corrupt or contains an invalid DNS name. The event data contains the error. It look’s like it try to create record based on native win2000 dns structure. The question is how can I avoid this behavior and this error.

0
Comment
Question by:henz99
  • 4
  • 3
8 Comments
 
LVL 16

Expert Comment

by:JamesDS
ID: 13764786
henz99
delete the _MSDCS sub zone you created and do this:
restart the netlogon service on each one of your domain controllers.
IPCONFIG /flushDNS
IPCONFIG /REGISTERDNS

AD will put the missing records back for you.

Cheers

JamesDS
0
 

Author Comment

by:henz99
ID: 13765043
If understand this right I need to delete _msdcs (gray out color)  under my domain.local  and do not touch _msdcs.domain.local I create manually?
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 13765152
henz99
no, the other way around.
The gray one is the delegation - it should delegate to the server you tried to create it manually on. If you delete this then a new yellow one (sub-domain) will be created in it's place at the same level, and that's not what you want.

The yellow one that you created is the one that will be recreated.

Cheers

JamesDS
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:henz99
ID: 13765336
I have this current DNS structure like this:

Forward Lookup Zones
_msdcs.domain.local
domain.local
  _msdcs(gray)
  _sites
  _tcp
  _udp
  DomainDnsZones
  ForestDnsZones

I follow your recommendation and delete _msdcs.domain.local after the fact it didn't recreat _msdcs.domain.local, so I have to do this manual and problem is come back when you stop and start DNS  
0
 
LVL 16

Accepted Solution

by:
JamesDS earned 1000 total points
ID: 13765395
henz99
The gray version is the delegation. Check that it is configured to delegate to the server you are trying to create the yellow version on. If the gray version is corrupt, it can be deleted but must be recreated by hand - practice with a different name to get it right, but it is simple as there are only a couple of settings to configure.

Once the delegation is operational you can delete the yellow version and re-create the new zone as and AD Integrated zone, replicating to ALL servers in the forest (NOT just the DOMAIN!).

The commands I gave you will work to re-populate the newly re-created zone.

Cheers

JamesDS
0
 

Author Comment

by:henz99
ID: 13765638
It is only one AD server in this domain, what i did now is add manualy in _msdcs folder under domain.local statment 96ad9995-4c01-42c7-99a8-85812e2f6361._msdcs.domain.local, so now I have 2 records one as i added and other was by default as NS servername.domain.local, then I start and restart DNS with no errors, I'm not shure if it is correct work around?
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 13765865
henz99
The _MSDCS zone should contain several sub-domains as well as the resource record you just created.

Running the commands I gave you will put these back.

Cheers

JamesDS
0
 

Expert Comment

by:ShermC
ID: 24508278
I followed these steps. I found that they did not fix my problem, which was the same as the one discussed here. This information, however, put me on the right path to fixing it for my system. First, I will share my analysis and conclusions, then I will tell you how I fixed it (and hopefully you can too!).
1) It is significant that the error I had was also generated on the DNS record that contains the long GUID value in it. The error message says that "The Active Directory definition of this resource record is corrupt or contains an invalid DNS name." So, I assumed something about this message was true, and I searched for what the corruption or invalid DNS name could be. I had the luxury of having another almost-identical server with which to compare settings and values that was not having the error. Because I could see no corruption or invalid DNS name for the record when checking it using DNS Manager, I looked for a way to examine the underlying Active Directory entry, to see if it would show me the corruption or invalid DNS name that was causing the problem. So, I used adsiedit.msc on both servers to look at the Active Directory entries. I browsed down to the following folder: Domain/DC=mydomain,DC=com/CN=System/CN=MicrosoftDNS, and found important differences between the two almost-identical servers. What I found was that on the server without the problem, there were only folders for the reverse-DNS zone and "DC=RootDNSServers". The folders for my main domain zone (okdomain.local) and for my sub-domain (_msdcs.okdomain.local) were not there. On the server with the problem, however, the main domain zone (mydomain.local) was there. In fact, when I looked at the entries within that folder, the entry with the long GUID was there. I examined it carefully and found no corruption or invalid DNS name. I was thinking that there had to be some way to remove the record and have Windows recreate the record with valid values. I then realized what later proved to be the problem: the reason this error has been so hard to fix is that there is really nothing wrong with the record! The problem is that the record is located in the wrong Active Directory container, and Windows cannot create a resource record for it from there. It is wrong because of its location, not its content.
Note: Please read all the following steps and understand them before trying to follow them. If they are confusing or baffling to you, please get a technically-knowledgeable friend to help you fix the error and not make it worse.
2) Here's how I fixed it: I remembered that there are three different AD containers in which DNS information is stored, the "Active Directory Zone Replication Scopes". This problem happens when the sub-domain zone is configured to use the legacy Windows 2000 DNS Server-compatible container. I fixed the error by deleting and recreating my main domain zone and the sub-domain zone to use the correct containers, and letting Windows repopulate the zone with dynamic update records. So here's what I did:
A) I made a record of all the manually-added resource records in my main domain zone and my sub-domain zone. In my case, only one resource record had been manually added, the rest were created by Windows from dynamic updates. It's likely that your situation is the same. You should also record all customized settings for the two zones.
B) I then deleted the main domain zone (mydomain.local) and the sub-domain zone (_msdcs.mydomain.local). The only sure way to fix this problem is to delete and recreate the zones. Do not delete your Reverse DNS zone, leave it alone.
C) I then ran the DNS wizards for two new zones and one new delegation. I did not leave it up to Windows to create the zones, only the records in the zones! This part can be a bit tricky, I had to delete and create my zones several times before I got the structure I wanted.
First, we'll create the sub-domain zone. Select "Forward Lookup Zones", right-click to choose "New Zone...". For Zone Type, choose Primary zone and Store the zone in Active Directory. This is important--for "Active Directory Zone Replication Scope" you must choose the first choice, "To all DNS servers in the Active Directory FOREST mydomain.local" for the sub-domain zone. Zone Name has this structure: _msdcs.mydomain.local (you put your domain in place of "mydomain"). Choose "Allow only secure dynamic updates", and complete the wizard.
Second, we'll create the main domain zone. Select "Forward Lookup Zones", right-click to choose "New Zone...". For Zone Type, choose Primary zone and Store the zone in Active Directory. This is important--for "Active Directory Zone Replication Scope" you must choose the second choice, "To all DNS servers in the Active Directory DOMAIN mydomain.local" for the main domain zone. Zone Name has this structure: mydomain.local (you put your domain in place of "mydomain"). Choose "Allow only secure dynamic updates", and complete the wizard.
Now create a new delegation. Right-click on the "mydomain.local" folder and choose "New Delegation...". For the Deligated domain, enter _msdcs so that the FQDN matches the name of the first zone you created, _msdcs.mydomain.local. For Name Servers, add the fully qualified domain name and the internal IP address of the server you are working on, because it will host the delegated zone for you. Check your settings and complete the wizard.
You are done--now you want to see it populate correctly. First, the two zone folders you made are yellow and the delegation is a gray sub-folder beneath your main domain zone folder. If not, you need to do the steps over with adjustments to timing and such to get this result.
D) Restart netlogon service on all of your domain controllers. Run ipconfig/flushdns and ipconfig/registerdns on your server. Wait up to 5 minutes for Windows to make initial updates to your zones, then right-click on each of your two zones and choose "Reload..." (BTW, this reload is very poorly explained by the DNS program. Unless you already know the answer, you can't figure out where the zone will be reloaded from or to...). This will reload the DNS zone data you are looking at with current data stored in Active Directory. (If you assumed it would keep them real-time synced for you, you would be wrong.) If all is well, you should see your DNS records and folders appear.
E) To prove that you have fixed the problem, restart the DNS Server service and examine the DNS Server event log to confirm that the error did not occur.
Also, you will want to re-enter your custom DNS records into your newly-generated zones.
I hope that these details help you fix this error as easily as possible.
0

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

by Batuhan Cetin In this article I will be guiding through the process of removing a failed DC metadata from Active Directory (hereafter, AD) using the ntdsutil tool in a Windows Server 2003 environment. These steps are not necessary in a Win…
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?

868 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question