Access Denied between Domain Controllers

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Red,

Thanks for your help.

The DNS configuration is as it :
- Exchange Server : DNS Master
- Data Server : DNS (Secondary).

I've delete zones on both servers and recreate it.

I still have the same problems after a reboot of both servers (and an ipconfig /registerdns to be sure).

It really seems that there is rights problems or something like that.

One other information : FRSDiag tells me that SYSVOL junction points are missing but that's wrong, they exists.

Evolutis

Can you ping from one server to another?

Can you paste an ipconfig /all from both servers so we can see what is going on.

-red

ASKER

Red,

Yes, ping is working from one server to another.

Here is the ipconfig results

DATA SERVER :
Windows IP Configuration
Host Name .................... : <DATASERVERNAME>
Primary Dns Suffix ......... : <domain name>
Node Type .................... : Hybrid
IP Routing Enabled ......... : No
WINS Proxy Enabled ....... : No
DNS Suffix Search List .... : <domain name>
Ethernet adapter Local Area Connection :
Connection-specific DNS suffix :
Description .......................... : Intel(R) PRO/100+ PCI Adapter
Physical Address .................. : <MAC Address>
Dhcp Enabled ....................... : No
IP Address ........................... : 192.168.14.11
Subnet Mask ........................ : 255.255.255.0
Default Gateway ................... : 192.168.14.1
DNS Servers ........................ : 192.168.14.12
192.168.14.11
WINS Server ........................ : 192.168.14.12

EXCHANGE SERVER :
Windows IP Configuration
Host Name .................... : <DATASERVERNAME>
Primary Dns Suffix ......... : <domain name>
Node Type .................... : Hybrid
IP Routing Enabled ......... : No
WINS Proxy Enabled ....... : No
DNS Suffix Search List .... : <domain name>
Ethernet adapter Local Area Connection :
Connection-specific DNS suffix :
Description .......................... : IEmbedded Broadcom NetXtreme 5721 PCI-E Gigabit NIC
Physical Address .................. : <MAC Address>
Dhcp Enabled ....................... : No
IP Address ........................... : 192.168.14.12
Subnet Mask ........................ : 255.255.255.0
Default Gateway ................... : 192.168.14.1
DNS Servers ........................ : 192.168.14.12
192.168.14.11
WINS Server ........................ : 192.168.14.12

Evolutis

That all looks good, which means it is something else (which will be harder to find).

I hate posting links to eventid, but there really are too many possible options to try and list them. 1058 is the ID that is showing up with a heap of hits (as it is a vague error) so that is the best place to start.

http://www.eventid.net/display.asp?eventid=1058&eventno=1752&source=Userenv&phase=1

Sticking out to me is anti-virus scanning the sysvol folders, other than that, there is nothing obvious.

Let me know if you find anything, otherwise I will look around for something else (and try to attract other experts)

-red

ASKER

Yes, it ssems to be really hard to resolve...

I saw this web page but nothing seems to work.

Another thing is that Exchange Information Store dont want to start anymore (0x80004005).

I'm becoming crazy with this issue !

Evolutis

This is getting ugly,

http://support.microsoft.com/kb/822579
http://support.microsoft.com/kb/923171

I would make a copy of your EDB and STM files, and then work on the DNS/Connectivity issues that you are having.

-red

ASKER

Yes, I backup all my MDBDATA folder to be sure that I'll loose nothing.

822579 is OK
923171 is not applicable.

It seems that problem is around DFS/FRS/GPO/AD.

Do you have any other idea ???

Evolutis

SOLUTION

Sembee

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

Chris Dent

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Sembee,

You're right, that's not really recommended to have the DC role on an Exchange Server, but this have been done by the previous IT services company.

The problem is that the Exchange Server cannot access correctly Active Directory to publish informations through Outlook or OWA.

Hi Chris-Dent,

Both machines are in the Domain Controllers OU but I can access to the Default Domain Controller policy only from the Data server (Access Denied if I try from the mail server).

Evolutis

ASKER CERTIFIED SOLUTION

CharliePete00

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

Jay_Jay70

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Everybody,

I finally resolve it, here are details :

The replication of SYSVOL was not working because of an error between the Default Domain Controllers policy (Digitally sign communications for Microsoft network server and Microsoft network client was set to disabled) and the registry (HKLM\system\CurrentControlSet\Services\lanmanserver\parameters\requiresecuritysignature was set to 1).

I also followed this article : http://support.microsoft.com/default.aspx?scid=kb;en-us;315457

Here is also some useful articles :

http://support.microsoft.com/?kbid=842162
http://support.microsoft.com/kb/292438
http://support.microsoft.com/kb/329491
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/stgmgmt/fs/file_replication_service_reference.asp
http://www.microsoft.com/windowsserver2003/technologies/storage/dfs/tshootfrs.mspx
http://technet2.microsoft.com/WindowsServer/en/library/7636aede-a944-4765-8973-40dc1e1f2d561033.mspx?mfr=true

After having solved the errors in active Directory, my Exchange Server went back online completely.

Thanks to all of you that have helped me !

Here is how and why I sent points to you :

redseatechnologies : 200 points because you was the faster to reply and DNS settings had te be rebuild
Sembee : 150 points because you told wich actions have to be avoid on an Exchange Server and I know that you're a God with Exchange (you saved my life already one time... ;-) )
Chris-Dent : 100 points because the Default Domain Controller Policy was one of the reason of this mess
Jay_Jay70 : 50 points, you've tried to help me also.

Thanks again to everybody.

Cheers

Evolutis.

ASKER

... I forgot CharliePete00 that was the closer, so here is how redistribute points :

redseatechnologies : 150 points
Sembee : 100 points
CharliePete00 : 150 points
Chris-Dent : 80 points
Jay_Jay70 : 20 points

Evolutis

You realise that you haven't split the points, right?

If you want to, one of the PEs that was involved in this thread may be able to reopen it for you

-red