Solved

DNS - Forward lookup zone disappears?

Posted on 2007-11-28
17
1,929 Views
Last Modified: 2012-06-27
Upgrading a 2000 server from member status to domain controller status in Brazil.  Dcpromo working well at replication stage all seemed well.  About 3 hrs later, noticed that users having issues with name resolution, checking DNS in a 16 dc child domain I noticed that the child domain forward lookup zone was disappearing on 12 of the dc.  During the investigation, the other 4 dc lost this zone as well, had to recreate the zone from a secondary zone server.

All dc were set to Active Directory Primary Integrated status, pulling from a master server at the forest level not sure why or how these could be overwritten or allow the forward zone to be removed.  Opened call with Microsoft, they are slow on the response so looking for other ideas.  We are in process of upgrading all DC from 2000 to 2003 with 13 at 2003 (fsmo role holders complete) and 5 left at 2000.
0
Comment
Question by:Lombwar
  • 8
  • 3
  • 3
  • +1
17 Comments
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 20369030
wait - you mention that they are all AD integrated zones - yet you mention pulling from the root forest - thats a confliction of terms....AD integrated zones dont pull from anywhere....they are all part of AD replication....

I am guessing you host the zone for the child domain in the root domain? what is your replication scope set too? Forest or Domain? if the zone is hosted in the Parent, it will need to be set to forest level replication
0
 

Author Comment

by:Lombwar
ID: 20369249
Sorry mixed terms, good catch!  We are running AD integrated zones at the child level only, the link back to the master is for reverse lookup zones that are set for secondary.  We host the zone for the child domain in the child domain and add any records that are global in scope for name resolution to the root domain.

During this event the child domain was the only one affected, the root domain did not experience any issues.  Guess the question is how could this have happened during a dcpromo command which is what Microsoft is telling me occurred.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 20369317
ah gotcha, i see what you mean now. hmmmm I have never seen DCPromo wipe out a zone let alone across that many servers......If there is on guy that does, its Chris, ill email him and ask him his thoughts and get him to comment for you - this dude knows more about DNS than the rest of us do about breathing :)

James
0
 

Author Comment

by:Lombwar
ID: 20369443
GREAT!!!  Waiting for Microsoft I might as well watch the grass grow!
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 20369536
lol they have been pretty good at at least getting something in the end, but Chris may have seen this in the past -i have mailed him for you
0
 

Author Comment

by:Lombwar
ID: 20369761
thanks
0
 
LVL 12

Assisted Solution

by:Amit Bhatnagar
Amit Bhatnagar earned 75 total points
ID: 20371852
Do you see any 4515 in DNS Event ID within Windows 2003? Also, Use ADSIEDIT to view the Zones in AD and check whether you see any corrupt AD information in AD DNS. Steps on how to use ADSIEDIT to view DNS Information in AD are provided under article including the solution for 4515. It is a normal csae when you upgrade from 2000 to 2003 as the AD DNS structure for both is quite different.

http://support.microsoft.com/kb/867464
0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 175 total points
ID: 20372547

Hey guys,

Bamit does raise a good point.

With 2003 Server the DNS Zones were moved out of the Directory Partition (CN=MicrosoftDNS,CN=System,DC=...) and out to two separate Application Partitions (CN=MicrosoftDNS,DC=ForestDNSZones,DC=... and CN=MicrosoftDNS,DC=DomainDNSZones,DC=...). This was done to reduce the load on the Global Catalog as it removes the need for a partial set of DNS Data there.

Oddly enough 2003 Native Mode isn't a requirement for this functionality (if I remember correctly), only that you have a 2003 DC in the domain, and the Domain Naming Master is 2003.

It is possible that in the shift of the zones to the new application partition that it deleted it from the Directory Partition and was then waiting for Replication to complete for the servers to see it in it's new Application Partition.

If you have the Support Tools installed you can see where it's gone and put the Zones with:

dnscmd /EnumZones

It will show:

AD-Domain for zones stored in CN=MicrosoftDNS,DC=DomainDNSZones,DC=<child domain>
AD-Forest for zones stored in CN=MicrosoftDNS,DC=ForestDNSZones,DC=<root domain>
AD-Legacy for zones stored in CN=MicrosoftDNS,CN=System,DC=<child domain>

Chris
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 

Author Comment

by:Lombwar
ID: 20373210
I will check into this.  The odd thing is that this member server was the 11th system in the line to promote to Win 2k03 so would think that the first couple would have encountered this design change, worked through it that by time got to this one would not have been shock to system.  Also have upgraded others since that time successfully.

The only catch here is this was an existing member server running DNS instead of other upgrades were existing DC running 2000 upgraded to 2003.
0
 

Author Comment

by:Lombwar
ID: 20373251
Ran the dnscms /enumzones command and it did not show that information Chris had listed.  Instead it showed the zones on the DC, if they are secondary or primary and the properties which for the zone in question is set for Update.

If you run dnscmd /info it returns this information
DS container             = cn=MicrosoftDNS,cn=System,
builtin domain partition = ForestDnsZones
builtin forest partition = DomainDnsZones
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 20373456

Near enough.

It's a bit of an unlikely choice really, but there's little else that would cause deletion of the zone like that.

Chris
0
 

Author Comment

by:Lombwar
ID: 20373534
Not sure I understand, you think that with the change from 2000 to 2003 that the structure of DNS altered and put the dns zone in a different area of Active directory causing the deletion?

I will check ADSIedit and look in the spots you suggested, only thing struggling with that analogy is because many others were updated prior so not sure why this one would have sent a domino effect of commands through to delete this zone.
0
 
LVL 12

Expert Comment

by:Amit Bhatnagar
ID: 20374641
Hi, I am not sure if this point has been taken up here or not but let me bring tis up anyways, 2003 DNS Server has three replication scope "To all DNS in Entire Forest", "To All DNS in Entire Doman" and "To All DCs in XYZ Domain". (All these options are under Replication Scope of DNS). Windows 2000 only has the last option where it replicates the entire information with all the DCs in the entire Domain. Which means that the first two options should be only be used if you have a Windows 2003 Native Domain.

But incase if first two options are used in the presence of a Windows 2000 DC (Mixed More environment) then we tend to see such behaviour(Missing or incomplete Zones) as the information copied over to these two partitions\replication scopes does not show up in Windows 2000 as it does not understand the first two Replication Partition. And as you know, AD only requires a single mistake, the rest of the Domino effect is then automatically taken care by AD Replication..:)..

P.S : Incase you have a Windows 2000 DC in your Domain....Do NOT use the first two options that I mentioned. They might be the reason on how the zones got deleted at first place.
0
 

Author Comment

by:Lombwar
ID: 20375142
Good thought.  The challenge that I have is that this all occurred during the replication process between the Brazil DC and which ever DC it connected to for the replication part of the dcpromo command.  Microsoft seems to think something happened during the dcpromo that kicked a conflicting command back through the chain causing as Bamit99 put it "domino effect" for the other DCs that were successfully upgraded to Win 2k03.

On a different subject we are 3 DC's away from having a native domain, any other gottchas that we might run into to push to native for this child domain?  We already have the Forest root FSMO role holders upgraded to Win2k03.
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 20375289

Shouldn't be anything else really. It's worth converting the zones into the Application Partitions once you're in Native Mode though.

Chris
0
 
LVL 12

Expert Comment

by:Amit Bhatnagar
ID: 20379886
Yeah, few more things to think about...once in 2003 native mode, make sure that the MSDCS folder on the Root of the forest is set to "Entire Forest" Replication Scope as within 2003, DCs do not register their GUIDs(Global Unique Identifiers)  in themselves if they are at child level. So don't be surprised if you don't see the GUID of the child DCs. All GUIDs only get registered at the root domain level. Besides this, everything remains the same. Also, it seems you already have a SRX case with Microsoft. Who are you working with if you dont mind telling..:)
0
 

Author Comment

by:Lombwar
ID: 20442920
April is the contact name but that is part of the problem in that there are 3 people now and none of them have gotten back to me in over a week.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Companies that have implemented Microsoft’s Active Directory need to ensure that the Active Directory is configured and operating properly. If there are issues found and not resolved, it eventually leads the components to fail or stop working and fi…
Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now