Solved

Access Denied between Domain Controllers

Posted on 2006-10-29
18
1,010 Views
Last Modified: 2008-01-09
Hi,

I have a lot of problems between two DC (Windows 2003 Server) of the SAME DOMAIN (no firewalls - hardware or software - between them).

One of them is DC with GC, Files and printers and the other is a DC with GC and Exchange 2003 (all updates are installed).

From the Exchange Server to the other Server I got an Access Denied for every Admin or policy tool I use when a data exchange is needed with the other DC. I cannot also access Administrative Share (c$) on the other server (it works from the data server to the Exchange server).

I've check my DNS configuration and everything is ok.

If I try to demote/promote the Exchange server I get also an "Access Denied".

Here is also some other error I see in the Event Log :

Data Server
--------------
Kerberos, Event Id 4 (KRB_AP_ERR_MODIFIED)
NtFrs, Event Id 13508


Exchange Server
-------------------
Kerberos, Event Id 4 (KRB_AP_ERR_MODIFIED)
Userenv, Event Id 1058 (Access Denied)
NtFrs, Event Id 13508
SRMSVC, Event Id 12317 (Access Denied)

Some DCDiag errors:
NetLogons : An net use or LsaPolicy operation failed with error 5, Win32 Error 5
MachineAccount : Could not open pipe with [SERVERNAME]: failed with 5: Win32 Error 5, Could no get NetBIOSDomainName, Failed can not test for HOST SPN
Services : Could not open Remoteipc to [SERVERNAME]: failed with 5: Win32 Error 5
frssysvol : [SERVERNAME] An net use or LsaPolicy operation failed with error 5, Win32 Error 5. The registry lookup failed to determine the state of the SYSVOL. The error returned was 5. Check the FRS event log to see if the SYSVOL has successfully been shared.

URGENT HELP IS NEEDED
0
Comment
Question by:Evolutis
  • 8
  • 5
  • 2
  • +3
18 Comments
 
LVL 39

Assisted Solution

by:redseatechnologies
redseatechnologies earned 150 total points
ID: 17828156
Hi Evolutis,

WHOA!,

Don't ever try to DCPROMO an Exchange server - that is not supported, and bound to break something!

As for your problem, I had a similar issue, here it is -> http:Q_21998810.html

Basically, there were major problems with my DNS settings, and I had to recreate them from scratch to get it up and running again.  By recreate, I mean, delete the zones and recreate them again.

Hope that helps,

-red
0
 

Author Comment

by:Evolutis
ID: 17828304
Hi Red,

Thanks for your help.

The DNS configuration is as it :
- Exchange Server : DNS Master
- Data Server : DNS (Secondary).

I've delete zones on both servers and recreate it.

I still have the same problems after a reboot of both servers (and an ipconfig /registerdns to be sure).

It really seems that there is rights problems or something like that.

One other information : FRSDiag tells me that SYSVOL junction points are missing but that's wrong, they exists.

Evolutis
0
 
LVL 39

Expert Comment

by:redseatechnologies
ID: 17828309
Can you ping from one server to another?

Can you paste an ipconfig /all from both servers so we can see what is going on.

-red
0
 

Author Comment

by:Evolutis
ID: 17828358
Red,

Yes, ping is working from one server to another.

Here is the ipconfig results

DATA SERVER :
Windows IP Configuration
    Host Name .................... : <DATASERVERNAME>
    Primary Dns Suffix ......... : <domain name>
    Node Type .................... : Hybrid
    IP Routing Enabled ......... : No
    WINS Proxy Enabled ....... : No
    DNS Suffix Search List .... : <domain name>
Ethernet adapter Local Area Connection :
    Connection-specific DNS suffix :
    Description .......................... : Intel(R) PRO/100+ PCI Adapter
    Physical Address .................. : <MAC Address>
    Dhcp Enabled ....................... : No
    IP Address ........................... : 192.168.14.11
    Subnet Mask ........................ : 255.255.255.0
    Default Gateway ................... : 192.168.14.1
    DNS Servers ........................ : 192.168.14.12
                                                  192.168.14.11
    WINS Server ........................ : 192.168.14.12

EXCHANGE SERVER :
Windows IP Configuration
    Host Name .................... : <DATASERVERNAME>
    Primary Dns Suffix ......... : <domain name>
    Node Type .................... : Hybrid
    IP Routing Enabled ......... : No
    WINS Proxy Enabled ....... : No
    DNS Suffix Search List .... : <domain name>
Ethernet adapter Local Area Connection :
    Connection-specific DNS suffix :
    Description .......................... : IEmbedded Broadcom NetXtreme 5721 PCI-E Gigabit NIC
    Physical Address .................. : <MAC Address>
    Dhcp Enabled ....................... : No
    IP Address ........................... : 192.168.14.12
    Subnet Mask ........................ : 255.255.255.0
    Default Gateway ................... : 192.168.14.1
    DNS Servers ........................ : 192.168.14.12
                                                  192.168.14.11
    WINS Server ........................ : 192.168.14.12

Evolutis
0
 
LVL 39

Expert Comment

by:redseatechnologies
ID: 17828379
That all looks good, which means it is something else (which will be harder to find).

I hate posting links to eventid, but there really are too many possible options to try and list them.  1058 is the ID that is showing up with a heap of hits (as it is a vague error) so that is the best place to start.

http://www.eventid.net/display.asp?eventid=1058&eventno=1752&source=Userenv&phase=1

Sticking out to me is anti-virus scanning the sysvol folders, other than that, there is nothing obvious.

Let me know if you find anything, otherwise I will look around for something else (and try to attract other experts)

-red
0
 

Author Comment

by:Evolutis
ID: 17828396
Yes, it ssems to be really hard to resolve...

I saw this web page but nothing seems to work.

Another thing is that Exchange Information Store dont want to start anymore (0x80004005).

I'm becoming crazy with this issue !

Evolutis
0
 
LVL 39

Expert Comment

by:redseatechnologies
ID: 17828415
This is getting ugly,

http://support.microsoft.com/kb/822579
http://support.microsoft.com/kb/923171

I would make a copy of your EDB and STM files, and then work on the DNS/Connectivity issues that you are having.

-red
0
 

Author Comment

by:Evolutis
ID: 17828491
Yes, I backup all my MDBDATA folder to be sure that I'll loose nothing.

822579 is OK
923171 is not applicable.

It seems that problem is around DFS/FRS/GPO/AD.

Do you have any other idea ???

Evolutis
0
 
LVL 104

Assisted Solution

by:Sembee
Sembee earned 100 total points
ID: 17828934
Considering that you have Exchange on a domain controller, I would start considering some drastic measures.

Specifically I would be looking to move all domain roles on to that Exchange server, then dcpromo out the other domain controller. Get down to one DC and ensure that everything is working correctly. If that other machine will not DCPROMO out, then it will have to be forced removed.

The idea being to get it down to one machine that you can repair or ensure is working correctly.

Then bring up another temporary machine (a workstation or virtual machine will do) and attempt to DCPROMO it in.

However your better option may well be to stump up the fee and call Microsoft.

Simon.
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 70

Assisted Solution

by:Chris Dent
Chris Dent earned 80 total points
ID: 17828990

Just curious.. are both machines in the Domain Controllers OU? And is the Default Domain Controllers Policy intact?

Chris
0
 

Author Comment

by:Evolutis
ID: 17829035
Hi Sembee,

You're right, that's not really recommended to have the DC role on an Exchange Server, but this have been done by the previous IT services company.

The problem is that the Exchange Server cannot access correctly Active Directory to publish informations through Outlook or OWA.

Hi Chris-Dent,

Both machines are in the Domain Controllers OU but I can access to the Default Domain Controller policy only from the Data server (Access Denied if I try from the mail server).

Evolutis
0
 
LVL 7

Accepted Solution

by:
CharliePete00 earned 150 total points
ID: 17829709
Hate to suggest this but it sounds a lot like SYSVOL is forked on one of the DCs (prob Exchange).  Let's take a look to make sure (I'd start with the Exchange server).

1.  Restart the File Replication Service and note any errors that pop up in the event log
2.  Execute the following from the command-line and note any failure:
         dcdiag /test:netlogons

If FRS throws nonsecurity errors on restart SYSVOL and/or NETLOGON are prob corrupt and may need to be rebuilt.  If restarting FRS throws no errors or only security errors (access denied) and executing "dcdiag /test:netlogons" reports failures it may just a Rights/Permissions issue with SYSVOL/NETLOGON which may be easily fixed.
0
 
LVL 48

Assisted Solution

by:Jay_Jay70
Jay_Jay70 earned 20 total points
ID: 17830373
looks like a security issue to me....its not all that uncommon for the trust between two DC's to fall out of whack....you can use the netdom tool to reset the machine accounts password

http://support.microsoft.com/kb/325850
0
 

Author Comment

by:Evolutis
ID: 17837832
Hi Everybody,

I finally resolve it, here are details :

The replication of SYSVOL was not working because of an error between the Default Domain Controllers policy (Digitally sign communications for Microsoft network server and Microsoft network client was set to disabled) and the registry (HKLM\system\CurrentControlSet\Services\lanmanserver\parameters\requiresecuritysignature was set to 1).

I also followed this article : http://support.microsoft.com/default.aspx?scid=kb;en-us;315457

Here is also some useful articles :

http://support.microsoft.com/?kbid=842162
http://support.microsoft.com/kb/292438
http://support.microsoft.com/kb/329491
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/stgmgmt/fs/file_replication_service_reference.asp
http://www.microsoft.com/windowsserver2003/technologies/storage/dfs/tshootfrs.mspx
http://technet2.microsoft.com/WindowsServer/en/library/7636aede-a944-4765-8973-40dc1e1f2d561033.mspx?mfr=true

After having solved the errors in active Directory, my Exchange Server went back online completely.

Thanks to all of you that have helped me !

Here is how and why I sent points to you :

redseatechnologies : 200 points because you was the faster to reply and DNS settings had te be rebuild
Sembee : 150 points because you told wich actions have to be avoid on an Exchange Server and I know that you're a God with Exchange (you saved my life already one time...  ;-) )
Chris-Dent : 100 points because the Default Domain Controller Policy was one of the reason of this mess
Jay_Jay70 : 50 points, you've tried to help me also.

Thanks again to everybody.

Cheers

Evolutis.
0
 

Author Comment

by:Evolutis
ID: 17837857
... I forgot CharliePete00 that was the closer, so here is how redistribute points :

redseatechnologies : 150 points
Sembee : 100 points
CharliePete00 : 150 points
Chris-Dent : 80 points
Jay_Jay70 : 20 points

Evolutis
0
 
LVL 39

Expert Comment

by:redseatechnologies
ID: 17837915
You realise that you haven't split the points, right?

If you want to, one of the PEs that was involved in this thread may be able to reopen it for you

-red
0
 

Author Comment

by:Evolutis
ID: 17837927
Right, I thought I can do it but I didn't find where...

I've just sent an email to info@experts-exchange.com to telle them to split the points.

Hope it will be done quickly.

Best regards.

Evolutis
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 17838319
Dont worry about the points for me, I didnt get you anywhere. Just use the split points down the bottom

James
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
Learn about cloud computing and its benefits for small business owners.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now