?
Solved

Domain Controller and Bes Server Interaction

Posted on 2008-02-05
8
Medium Priority
?
2,698 Views
Last Modified: 2008-06-09
Okay I am trying to decomission a WIN2k Domain Controller that acts as a Global Catalog. I already have two Win2k3 Servers that are holding all DC roles as well as one that is a GC. I shutdown the WIN2K DC to see what would break if anything before I decomissioned.

Sure Enough the BES server stopped sending out Message to Blackberries. I check the Log and I have tons of Error Messages. When I turned the Win2k DC back on and rebooted the BES server everything worked fine. Now I rebooted the BES server prior to turning up the WIN2K DC figuring I just needed to re authenticate to the Domain with the service account but no good...

Bottom line is how can I make sure that the BES server is going to work off the WIN2K3 DC's?  
0
Comment
Question by:Infinityinfo
8 Comments
 
LVL 6

Expert Comment

by:AJermo
ID: 20824473
Most likely the BES is contacting it's closest DC which happens to be offline. It does this by a DNS lookup. IF you actually and correctly remove the DC from AD then BES will contact a new DC after restarting the services.
0
 
LVL 1

Author Comment

by:Infinityinfo
ID: 20824605
But when I shut down the WIN2K DC shouldnt it have gone to the next available DC regardless of whether I properly decomissioned it or not? I mean I rebooted the BES after shutting down the WIN2K DC after which shouldnt it have found the WIN2K3 Server that is acting as GC which I am going to assume if the hitch to all this.... Similiar to Exchange.....
0
 
LVL 5

Expert Comment

by:Greg Jacknow
ID: 20824628
Interesting....

Reboting the BES server after turning off the win2k machine was a good idea, I am surprised that it did not authenticate with a good DC when it came back up.  While turning off the DC is not a perfect test as you Ad is "broken" at that point.  It should work, at least after a reboot all machines should use the good DCs.  I am not aware of any ways to specifically point something on BES to a particular DC.

What were the error messages after rebooting the BES server with the DC down?  

Could you log on to the BES service account on the BES console?

Have you checked the DNS ssetting of the BES server so they point to the new DC/DNS servers.  (I am assuming here that you are doing dynamic DNS on your DCs)

All you really should have to do is to correctly (and fully) remove the win2k DC from your AD.  

Removing it as a GC would be good first and then demoting it.

Below are some articles I found usefull when the demotion did not go smoothly.

Greg J


How to remove data in Active Directory after an unsuccessful domain controller demotion
http://support.microsoft.com/kb/216498

Forcibly Removing Active Directory from a DC
http://www.petri.co.il/forcibly_removing_active_directoy_from_dc.htm
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 5

Accepted Solution

by:
Greg Jacknow earned 2000 total points
ID: 20824675
I just thought of somethng else.

Since BES needs to talk to Exchange, if the exchange servers are trying to authenticate to that downed DC that would cause problems as well.  You may want to try the test where you turn off the win2k DC and then reboot the exchage then the BES machines.

Greg J

PS  or just go for it and remove it from the AD. :)
0
 
LVL 1

Author Comment

by:Infinityinfo
ID: 20884003
Okay I shutdown the 2K DC and rebooted Exchange and then rebooted the BES server and I am looking good right now.. If I make it through the day like that gjacknow1 you will get all the points... That is awesome because I can confidently decomission this last 2kDC.... Thanks!
0
 
LVL 5

Expert Comment

by:Greg Jacknow
ID: 20885667
Cool, I hope it keeps working.

I am always annoyed that exchange does not start using a different DC more quickly when one goes down.

Don't forget to decomision your DC "gracefully" with the dcpromo command.

Greg J
0
 
LVL 1

Author Comment

by:Infinityinfo
ID: 20894116
Yeah its just that this DC was the original and first... So I wanted to make sure I Was good before I proceeded with decomissioning it properly....
0
 

Expert Comment

by:jfsheaco
ID: 21556950
alternetly you can lookup the DC with the problem in the registry and edit the key to point to the new Domain Controller, be sure to reboot after you do this. BES users a MAPI profile that has the key in Registry that doesnt change unless you reboot or change it manually. BEST to change it manually, you might be able to just restart the BES services but that's up to you.
0

Featured Post

Easily manage email signatures in Office 365

Managing email signatures in Office 365 can be a challenging task if you don't have the right tool. CodeTwo Email Signatures for Office 365 will help you implement a unified email signature look, no matter what email client is used by users. Test it for free!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
You have missed a phone call. The number looks like it belongs to the bunch of numbers which your company uses. How to find out who has just called you?
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question