troubleshooting Question

Active Directory Internal Problems. Server miscommunicating. Kerberos at fault.?????

Avatar of gxa
gxaFlag for Greece asked on
ExchangeActive DirectoryMicrosoft Server OS
6 Comments1 Solution2051 ViewsLast Modified:
Hello All.

Recently I have been having some problems with my company's active directory. Initially we noticed that replication between Domain Controllers was not working. Later on our exchange server was playing up. Lately all hell has broke loose. Before a detailed problem explanation here is a schematic of the Servers, LAN, and Internet

 I N T E R N E T
   R O O T E R
|   |           |      |         |
|  WWW   |   DNS1   |
|               |               |

This is the Internet side... All servers have public IPs

The LAN side is as follows.

             L  A  N  
         R  O  O  T  E  R
|          |     |           |     |            |     |         |        |  
Email   |    DNS1   |   PROXY   |    DC2    |       WORKSTATIONS
        WWW         DNS2        DC1        OTHER

All the servers that exist on both sides are done so by using 2 NICs with different IPs. DC2 is the GC for the domain and has all the FSMO's

What seems to happen is that somehow workstations cannot communicate with the domain controllers. At one point the first domain controller (say DC1) could not communicate with the second Domain Controller (say DC2) whereas DC2 could communicate with DC1. I repaired that problem by performing a "netdom reset"  between DC1 and DC2. That seemed to fix the replication issue as well.

The next manifastation of the problem was that no workstation could contact the outside world. All workstations were set to only use DC1 and DC2 as DNS servers and DC2 somehow was propagating all unknown DNS queries to the proper DNS servers. (BTW now I get the error that I cannot set forwarders on the DNS server of DC1 and DC2 because they are root servers) This was somehow bypassed by setting a second DNS server entry on the Proxy server. This second DNS entry is the actuall DNS server from the ISP. Ideally DC's should pass the DNS queries to the DNS1 and DNS2... Am I correct in saying that or talking complete nosence.

I also tried to install a new Email exchange server (2003 on a new machine with 2 NICs) and I get the usual "You do not have admin rights" message when i run ForestPrep. But the user used is the Domain Admin with full rights (exchange schema admin etc..etc.). When I finally managed to achieve the password reset between the new mail server and the DC2 (which is also the full FSMO and GC for the domain) I achieved in running the Forest Prep but DomainPrep was now throwing an error. The error read that I had not run the ForestPrep.?!?!?!?

After a lot on tinkering I believe that the problem resides somewhere in the passwords and Kerberos. I dont exactly know how this works (Kerberos that is) but roughly workstation requests a key and KDC (kerberos distribution center or what ever is called) passes that key so that the workstation can talk to the domain. All the errors I was (and still are) getting are "Access Denied" errors.

Does anybody have any idea of what is happening. Am I correct in believing there is an issue with Kerberos. Can you help me. Ask me if you need any more information for debugging.

Brett Danney
IT Architect

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 6 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 6 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros