Link to home
Avatar of MCPJoe
MCPJoeFlag for United States of America

asked on

Problem with old NT4 BDCs in a 2003 AD interim mode domain.

I have a NT4/2003 AD mixed environment.  I have a few (less than 4) NT4 domain controllers, and 4 NT4 servers running Exchange 5.5.  We have over 10 2003 AD controllers running our domain in 2003 interim mode.  The plan was to leave the NT4 DCs in place until they could be removed safely.  To get AD, we installed a new NT4 DC and made it the primary.  Then I upgraded it to 2003 and installed AD.  Just last week, we turned off that original upgraded NT4>2003 server in hopes of being able to remove it.  We moved the FSMO roles to another 2003 DC.  Recently I noticed the usrmgr is no longer working on the NT4 servers.  And today I had a new user I created who keeps getting prompted for his user credentials from one of the old Exchange 5.5 servers.  

I guess what I'm asking is, now the the upgraded NT4 server is powered off, the other NT4 BDCs are no longer able to function correctly.  If this is the case, is there any way I can get them working again by some type of configuration?  I tried altering the hosts/lmhosts files and pointing our domain to the 2003 DC that has the PDC Emulator role.  This has not helped.  I checked the syntax and structure of the hosts/lmhosts files and they are correct.  Should we not have moved the PDC Emulator from the upgraded DC until the other NT4 servers were decomissioned?  When I open usrmgr now I get the error that it can't find a PDC for the domain, so some domain wide functions will be disabled, but I can get in and see some servers.  I assume I don't want to make one of them a PDC since that would undo what I did for getting Active directory running.  But can I recover from this situation, getting the NT4 BDCs to see the new 2003 DCs?  

Any suggestions?

Thanks
Joe
Avatar of MCPJoe
MCPJoe
Flag of United States of America image

ASKER

Could I possibly power back on the upgraded DC and move the PDC emulator role back until our migration is finished?  Would that work?  So far only one new user seems to be affected by any type of problem with authentication, but I don't want this problem to spread.
Avatar of MCPJoe

ASKER

Or would it really be that bad to make one of the NT4 BDCs a PDC keeping AD in place?  Any advise?
Avatar of MCPJoe

ASKER

I should mention I still depend on Exchange 5.5, which runs on 4 separate NT4 servers (member servers).  I have to consider that with any possible solution.  In this case, do I really need to maintain NT4 BDCs at all, or can I rely on AD even when running Exchange 5.5 on NT4 members?
Avatar of Michael Pfister
Did you move all FSMO roles before switching off the migrated W2k3 server? Is your DNS correct?

Check your domain by running

 dcdiag /v

from a command window. You can post errors here.
NT4 member server can live even in a W2K3 native domain. Interrim is only required as long as your run NT4 BDCs.
Sorry, forgot to mention: you may need to install WIndows Support Tools to get dcdiag.
Avatar of MCPJoe

ASKER

Yes, all the FSMO roles have been moved to another server, that was a fresh install of Windows 2003 server.  The migrated NT4>2003 machine is still here, we just have it powered off.  I ran dcdiag without the /v switch yesterday and found no errors, but I'll run it again with the /v switch and post the results.  I know NT4 member servers are ok, but we have 2 NT4 BDCs that now don't see any PDC.  I guess I need to know if this is a problem, or if I can let them sit like this until the migration is done.  Obviously they won't get updated with any AD objects, but will they continue to authenticate users without the PDC present?
The NT4 BDC will be a problem if you modify a user in AD, i.e. reset a password or change a group. The new info won't be replicated to them and if they authenticate a user it will give you all kinds of probs.

If they are just BDCs you can turn them off. If there are some other services needed you need to migrate the services first.

Anyway: ydid you move all 5 FSMO roles?

Active Directory Users and Computers: PDC Emulator, RID Master, Infrastructure Master
Active Directory Domains and Trusts: Domain Naming Master
Active Directory Schema: Schema Master

Does the name resolution from your NT4 boxes to the AD domain controllers work?
Avatar of MCPJoe

ASKER

Ran dcdiag with the /v switch, again it passed all tests with no errors.  Nothing to report...  

So:

1. Is it safe to leave the NT4 BDCs in their state of not seeing a PDC?
2. Any way to force the NT4 BDCs to use a 2003 AD server as the PDC?
3. Do the NT4 member servers running Exchange 5.5 need the NT4 BDCs to function, or can we get rid of the BDCs?

Thanks
Joe
Avatar of MCPJoe

ASKER

Thats what I thought, I need to either fix the NT4 BDCs so they can function with AD (not sure if thats possible).   Or we need to try to get rid of them completely.  We still have some clients and perhaps a few old legacy servers that may be hard coded to use these old NT4 BDCs, so I'm afraid to shut them down just yet.  

Yes, all the FSMO roles are located on a new 2003 server, they have all been moved off the upgraded server.  We have no current issues with AD, only with NT4 not seeing a PDC.  Is there some way to force them to use an AD server as the PDC?  I have the PDC Emulator running on the new 2003 server I mentioned, I tried hard coding the hosts/lmhosts file with this naming and IP information of the 2003 server hosting this role, but the NT4 BDCs still don't see a PDC.

Yes, name resolution to the AD boxes works, I have all the info in the hosts/lmhosts files.  
If you have installed Supprt Tools, a

netdom query fsmo

shows a summary of FSMO roles and holders
Avatar of MCPJoe

ASKER

yes, this tool verifies that all the FSMO roles are located on a new 2003 server that I personally moved them to. All FSMO roles are located on a brand new fresh 2003 server.  
This is really strange, looks like you covered everything. Any helpful events on the NT4 boxes and/or W2K3 DCs?
After adding domain info to the lmhosts on NT4, did you reboot the NT4 box or issue a nbtstat -R  ?





The lmhosts on NT4 should look like:

<W2K3 PDC emulator IP> <W2K3 PDC emulator name> #PRE #DOM:<YourDomain>
Avatar of MCPJoe

ASKER

No useful events, just the normal warning that the upgraded box is down, since we powered it off.  

I did NOT reboot, but did issue the nbtstat -R and -RR commands.  In my lmhosts file I have the standard domain entry at the top with the IP of my AD DC running the PDC Emulator, and then I have the normal entries for the IP/host name wiht the #PRE and #DOM:DOMAIN and still nothing.  
Avatar of MCPJoe

ASKER

Thats correct, that is what I have.
Avatar of MCPJoe

ASKER

One thing I can tell you is that the NT4 servers we have, BDCs and all, still show the old NetBIOS domain name.  For example, say our domain is comanyA.private, the NT4 servers only show companyA, and most are still using hosts/lmhosts files with putlic DNS servers.  Would it help if we move all the files off of the NT4 BDCs that might need (some of them are used as file servers).  Then join them to the companyA.private domain?  (After switching them to internal DNS).  Or once an NT4 server is a BDC, you have to reload to make it anything else?  
Really running out of ideas .... did you turn on your migrated NT4 box and the problem disappears?

Ah, yes one more thing: how about name resolution from W2K3 DC with PDC emu to the NT4 BDCs? Is that ok?
Do you still run WINS servers? How about their status? Is all domain info correct in WINS?
Avatar of MCPJoe

ASKER

I am going to suggest powering back on the upgraded box until this is resolved, hopefully that will resolve the issue.  Name resolution from 2003 to NT4 BDCs works fine.  No problems, I can browse the server, ping, etc.  
Avatar of MCPJoe

ASKER

Just noticed on the NT4 member servers that the user manager and server manager also don't see the PDC for the domain.  This is going to cause us major problems.  
Avatar of MCPJoe

ASKER

We have never run WINS, its always been a manual process using lmhosts files.  Which I have verified to be correct.  Appears to be something wrong with communication between NT4 and the PDC Emulator.  
Avatar of MCPJoe

ASKER

I guess I just need to find a way to get my existing NT4 servers to work with AD like they should, then I can take off the NT4 BDCs and not have to worry about it anymore.  But if my NT4 servers running Exchange 5.5 lose communication with the domain because they are still using the NT4 BDCs, then I'm in trouble!  Is there anything on the AD side with the new 2003 servers I need to change to allow NT4 BDCs to see the PDC successfully?  I made sure the NT4 computer accounts that are BDCs are in the pre-windows 2000 compatability group.  Anything else I need to check?
Avatar of MCPJoe

ASKER

The box is turned back on but my NT4 servers still don't see the PDC.  Any other suggestions.  The server was only off for 3 or 4 days.  It looks like is able to replicate and logon and everything is working, but the NT4 servers still don't see it.
nltest from the Support Tools can show you to which DC your NT 4 member servers talk (may need to download NT4 Resource Kit for nltest for NT4).

NLTEST /SC_QUERY:<yourdomain>

NLTEST /SC_VERIFY:<yourdomain>

Different approach:
If you log on to an NT4 BDC, can you access ressources (like shares) on the W2K3 DC holding the PDC emulator?
i.e

net view \\W2K3PDCEMU

or

net use * \\W2K3PDCEMU\Share

Avatar of MCPJoe

ASKER

Query gives me:
Flags: 1 PARTIAL_SYNC  REPLICATION_NEEDED
Connection Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
Trusted DC Name
Trusted DC Connection Status Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
The command completed successfully

Avatar of MCPJoe

ASKER

Network path was not found when trying to may a drive to the admin share on the DC with the PDC Emulator.
Avatar of MCPJoe

ASKER

Ok, so I can ping the PDC Emulator by name, but can't map drives to it, and server still can't see PDC for the domain.  
This means NETBIOS name resolution is not working.

I don't have an NT4 box here but as far as I remember you have to tick somewhere in the TCP/IP properties to force TCP/IP to use hosts/lmhosts.

C:\WINNT\system32\drivers\etc\lmhosts  must not have ANY extension. There is a sample file called lmhosts.sam. If you modified this one rename it to lmhosts. on the command prompt.
Avatar of MCPJoe

ASKER

From the 2003 server running as the PDC Emulator, I can browse to the NT4 BDC and browse shares withouth a problem.
Avatar of MCPJoe

ASKER

Right, I have the check box checked to enable LMHOSTS file lookup.  And my files don't have any extensions.
NETBIOS name resolution is not working from NT4 to W2K3, thats a fact and the cause of your problems. It had nothing to do with you switching off your NT4>W2K3 migration server.

I really can't see why it isn't working. To me it looks like you did everything right.

You already said you never used WINS, but any (obsolete) WINS server set in the TCP/IP config of your NT4 boxes?
Avatar of MCPJoe

ASKER

Yeah I can't see a problem with the config anywhere, it just won't see the PDC for the domain.  I did try from the BDC thats not able to see any PDC, running server manager like this:  srvmgr \\upgradedNT4servername and it did see the account and showed it as a backup domain controller.  When you upgrade an NT4 PDC to 2003 and install AD, does it mark the server as a BDC or should it be saying PDC?
Avatar of MCPJoe

ASKER

Oh, and no obsolete WINS entries anywhere.  
Avatar of MCPJoe

ASKER

Just to verify, for the first line in my LMHOSTS file identifying an IP address to the DOMAIN, (in the part with the quotes and 20 character spaces), I want to put the IP of the 2003 server running the PDC Emulator right?  Or should it point to the upgraded NT4 server now running 2003?
The W2K3 holding the PDC emulator should be listed as PDC

Here is a modified sample how your lmhosts should look:


102.54.94.97     rhino         #PRE #DOM:networking

Note to remove the # from the beginning of the line
1st: IP address of PDC emulator W2K3
2nd: netbios name of PDC emulator W2K3
3rd: #PRE
4th: #DOM:<Netbios domain name> Do _not_ put full qualified domain name here!

All values seperated by one or more spaces.

Avatar of MCPJoe

ASKER

One thing I forgot to mention, synch was working ok on NT4 and 2003 AD, before I had to rename our DCs.  We were using temp names to do migration so we finally renamed 2003 AD DCs to new naming and assigned new IPs.  I've updated the names and IPs in the hosts/lmhosts files immediately, but I'm still getting the problems not finding a PDC for the domain.  All I did to the hosts/lmhosts files was replace the old names with the new names and IP, nothing else changed.  Could it have something to do with renaming the DCs?
If you have no WINS you may want to add your NT4 BDCs to the lmhosts, so it would look like this:

102.54.94.97     rhino         #PRE #DOM:networking
102.54.94.99     nt4bdc1    #PRE #DOM:networking
102.54.94.170   nt4bdc2    #PRE #DOM:networking


don't forget to issue a

nbtstat -R

to load the changes.
Avatar of MCPJoe

ASKER

Ok, thanks, yes thats how I have my format in my hosts/lmhosts files.  I can ping by name and name to IP resolution is working fine.  But still can't map drive to 2003 AD DC, still get path not found.  
Avatar of MCPJoe

ASKER

I do have all servers and even some PCs listed in the hosts/lmhosts files, so there should be nothing missing, all DC for 2003 and BDCs are in the list.
I don't know of any specific problems when renaming DCs.
Avatar of MCPJoe

ASKER

Are there any other tools to test NetBIOS name resolution?  I think your right and if I can fix that, it should alleviate my issues.
Can you map a drive by \\Ip-Address\share ?
from http://support.microsoft.com/kb/300986/en-us

o Test Connections by Using the NET VIEW Command
1.      Click Start, click Run, type cmd, and then press ENTER.
2.      At the command prompt, type net view \\computer name, and then press ENTER. A list of the file and print shares of a computer that is running Windows 2000 is generated by establishing a temporary NetBIOS connection. If there are no file or print shares available on the specified computer, you receive a "There are no entries in the list." message. If the command does not work, type net view \\IP address of the remote computer, and then press ENTER. If the command works, but a net view attempt to the computer name does not work, the computer name may be resolving to the wrong address. If the command does not work and generates a "System error has occurred" error message, verify that you typed the correct name of the remote computer, that the computer is operational (and is running the File and Printer Sharing for Microsoft Networks service), and that all of the gateways (routers) between the local computer and the remote host are operational by using the ping command.
Avatar of MCPJoe

ASKER

I just noticed that I can use a "net view \\servername" for all my BDCs and other 2003 AD servers, its only not working with the PDC Emulator server.  Net view still fails if I use the IP of the PDC Emulator, so I am guessing mapping a drive by its IP will also fail.
Avatar of MCPJoe

ASKER

on the NT4 BDC that still shows it can't find a PDC for the domain, nbtstat -c reveals that it is caching the name and IP for the PDC Emulator, the spelling is correct as is the IP.  I can ping the name just fine, but net view \\PDCEMulator fails with path not found, I also see system error 53 messages.  This is really strange.  The only thing different here, besides renaming the DC, is that it also has 2 IP addresses.  We left the old IP on there as well as giving it a new IP.  Any known issues with DCs with more than 1 IP address?
Can you remove the 2nd IP? I think this is your problem.
Avatar of MCPJoe

ASKER

I left the second IP because we had more NT4 servers and some old remote client PCs still configured to use the old name and old IP.  I could probably change it, but not sure if this is going to cause any problems.
ASKER CERTIFIED SOLUTION
Avatar of Michael Pfister
Michael Pfister
Flag of Germany image

Blurred text
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Do it while nobody is working. Just check if the NT4 BDCs will then replicate with your PDC emulator.
Avatar of MCPJoe

ASKER

THAT WAS IT!!!!!!!   Oh wow, thanks so much!  I can open user manager now and net view works perfectly to the PDC Emulator.  I can't believe it was something that stupid!  Good to know, thanks again so much, you've been a real help!  Its been so long since I've messed with NT4, and even though I support it still, Im definately no NT4 expert.  I don't know how people go along with NT4 back years ago, I'm so glad I primarily deal with 2003!!!
Glad it helped.