Solved

Netdiag shows that DC not properly registered

Posted on 2008-10-19
35
933 Views
Last Modified: 2008-10-29
Having a problem with a remote Domain Controller.  In trying to solve a "domain disappearing" issue, we've managed to track down the fact that one of the DCs is having DNS issues.  After running netdiag on the remote DC we get the following:

DNS test . . . . . . . . . . . . . : Failed
  [FIX] re-register DC DNS entry 'domain_name.local.' on DNS server '10.0.101.200' succeed.
  FIX PASS - netdiag re-registered missing DNS entries for this DC successfully on DNS server '10.0.101.200'.
  [FATAL] No DNS servers have the DNS records for this DC registered.

We've tried:

Nbtstat -RR
ipconfig /dnsflush
ipconfig /registerdns
Restarting netlogon service
Going to sites and services and having the domain replicate now.

Anyone soirt out this sort of issue before?

Tia
0
Comment
Question by:lmkandia
  • 19
  • 15
35 Comments
 
LVL 18

Expert Comment

by:sk_raja_raja
Comment Utility
1.Please run netdiaf /fix
2.Post the event logs for this issue
0
 
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 500 total points
Comment Utility
Make sure you have no external DNS servers listed in your TCP\IP properties. Only local DNS servers should be listed. Can you do a netdiag /test:dns then post results.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
sk:
we've run netdiag /fix multiple times.
we get exactly what I've posted, after running netdiag /fix:
DNS test . . . . . . . . . . . . . : Failed
  [FIX] re-register DC DNS entry 'domain_name.local.' on DNS server '10.0.101.200' succeed.
  FIX PASS - netdiag re-registered missing DNS entries for this DC successfully on DNS server '10.0.101.200'.
  [FATAL] No DNS servers have the DNS records for this DC registered.

It appears to fix, but it doesn't.
Dari:
No external dns servers.  Only the two domain DNS servers - each listing themselves as primary and each other as secondary.
I will post the netdiag /test:dns in a sec.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility

Here is netdiag /v /test:DNS
Easy enought to see that there are a lot of differences between the two DNS servers.
But how to fix?  :)

Gathering IPX configuration information.
   Querying status of the Netcard drivers... Passed
   Testing Domain membership... Passed
   Gathering NetBT configuration information.
   Testing DNS
   [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.101.200'. Please wait for 30 minutes for DNS server replication.
   [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.100.200'. Please wait for 30 minutes for DNS server replication.
       [FATAL] No DNS servers have the DNS records for this DC registered.
    Tests complete.

    Computer Name: CITY2_DC
   DNS Host Name: CITY2_DC.domain_name.local
   DNS Domain Name: domain_name.local
   System info : Microsoft Windows Server 2003 R2 (Build 3790)
   Processor : x86 Family 6 Model 15 Stepping 11, GenuineIntel
   Hotfixes :
       Installed?      Name
          Yes          KB921503
          Yes          KB924667-v2
          Yes          KB925398_WMP64
          Yes          KB925902
          Yes          KB926122
          Yes          KB927891
          Yes          KB929123
          Yes          KB930178
          Yes          KB931784
          Yes          KB932168
          Yes          KB933729
          Yes          KB933854
          Yes          KB935839
          Yes          KB935840
          Yes          KB936021
          Yes          KB936357
          Yes          KB936782
          Yes          KB938127
          Yes          KB938127-IE7
          Yes          KB941202
          Yes          KB941568
          Yes          KB941569
          Yes          KB941644
          Yes          KB942615
          Yes          KB942615-IE7
          Yes          KB942763
          Yes          KB942840
          Yes          KB943460
          Yes          KB943485
          Yes          KB944653
          Yes          Q147222

Netcard queries test . . . . . . . : Passed
    Information of Netcard drivers:
    ---------------------------------------------------------------------------
   Description: Broadcom NetXtreme Gigabit Ethernet
   Device: \DEVICE\{6DDBC110-D91C-4C70-B776-3149A00A1A73}
    Media State:                     Connected
    Device State:                    Connected
   Connect Time:                    12 days, 03:59:09
   Media Speed:                     100 Mbps
    Packets Sent:                    7318910
   Bytes Sent (Optional):           0
    Packets Received:                4369390
   Directed Pkts Recd (Optional):   4262122
   Bytes Received (Optional):       0
   Directed Bytes Recd (Optional):  0
    ---------------------------------------------------------------------------
   [PASS] - At least one netcard is in the 'Connected' state.
 
Per interface results:
    Adapter : Local Area Connection
       Adapter ID . . . . . . . . : {6DDBC110-D91C-4C70-B776-3149A00A1A73}
        Netcard queries test . . . : Passed

Global results:

Domain membership test . . . . . . : Passed
   Machine is a . . . . . . . . . : Domain Controller
   Netbios Domain name. . . . . . : domain_name
   Dns domain name. . . . . . . . : domain_name.local
   Dns forest name. . . . . . . . : domain_name.local
   Domain Guid. . . . . . . . . . : {B2AA25D1-CE6C-4369-8E4B-A8BE93CAE50A}
   Domain Sid . . . . . . . . . . : S-1-5-21-3359117839-3512801811-3033766667
   Logon User . . . . . . . . . . : serveradmin
   Logon Domain . . . . . . . . . : domain_name

NetBT transports test. . . . . . . : Passed
   List of NetBt transports currently configured:
       NetBT_Tcpip_{6DDBC110-D91C-4C70-B776-3149A00A1A73}
   1 NetBt transport currently configured.

DNS test . . . . . . . . . . . . . : Failed
     Interface {6DDBC110-D91C-4C70-B776-3149A00A1A73}
       DNS Domain:
        DNS Servers: 10.0.101.200 10.0.100.200
        IP Address:         Expected registration with PDN (primary DNS domain name):
         Hostname: CITY2_DC.domain_name.local.
         Authoritative zone: domain_name.local.
         Primary DNS server: CITY2_DC.domain_name.local 10.0.101.200
         Authoritative NS:10.0.100.200 10.0.101.200
Check the DNS registration for DCs entries on DNS server '10.0.101.200'
The Record is different on DNS server '10.0.101.200'.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.101.200 is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY_DC.domain_name.local
            SRV 0 100 389 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.gc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.gc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local
            SRV 0 100 3268 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.b2aa25d1-ce6c-4369-8e4b-a8be93cae50a.domains._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.b2aa25d1-ce6c-4369-8e4b-a8be93cae50a.domains._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY_DC.domain_name.local
            SRV 0 100 389 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = gc._msdcs.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.101.200 is:
DNS NAME = gc._msdcs.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._tcp.dc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _kerberos._tcp.dc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY_DC.domain_name.local
            SRV 0 100 88 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.dc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.dc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _kerberos._tcp.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY_DC.domain_name.local
            SRV 0 100 88 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _gc._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _gc._tcp.domain_name.local
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local
            SRV 0 100 3268 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._udp.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _kerberos._udp.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY_DC.domain_name.local
            SRV 0 100 88 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kpasswd._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _kpasswd._tcp.domain_name.local
DNS DATA =
            SRV 0 100 464 CITY_DC.domain_name.local
            SRV 0 100 464 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kpasswd._udp.domain_name.local.
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _kpasswd._udp.domain_name.local
DNS DATA =
            SRV 0 100 464 CITY_DC.domain_name.local
            SRV 0 100 464 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = DomainDnsZones.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.101.200 is:
DNS NAME = DomainDnsZones.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.DomainDnsZones.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.DomainDnsZones.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY_DC.domain_name.local
            SRV 0 100 389 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = ForestDnsZones.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.101.200 is:
DNS NAME = ForestDnsZones.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.101.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.101.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.ForestDnsZones.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.101.200 is:
DNS NAME = _ldap._tcp.ForestDnsZones.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY_DC.domain_name.local
            SRV 0 100 389 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.101.200'.
    [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.101.200'. Please wait for 30 minutes for DNS server replication.
Check the DNS registration for DCs entries on DNS server '10.0.100.200'
The Record is different on DNS server '10.0.100.200'.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.100.200 is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.gc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.gc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 3268 CITY_DC.domain_name.local
            SRV 0 100 3268 CITY2_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.b2aa25d1-ce6c-4369-8e4b-a8be93cae50a.domains._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.b2aa25d1-ce6c-4369-8e4b-a8be93cae50a.domains._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = gc._msdcs.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.100.200 is:
DNS NAME = gc._msdcs.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._tcp.dc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _kerberos._tcp.dc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local
            SRV 0 100 88 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.dc._msdcs.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.dc._msdcs.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _kerberos._tcp.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local
            SRV 0 100 88 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _gc._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _gc._tcp.domain_name.local
DNS DATA =
            SRV 0 100 3268 CITY2_DC.domain_name.local
            SRV 0 100 3268 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kerberos._udp.domain_name.local.
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _kerberos._udp.domain_name.local
DNS DATA =
            SRV 0 100 88 CITY2_DC.domain_name.local
            SRV 0 100 88 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kpasswd._tcp.domain_name.local.
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _kpasswd._tcp.domain_name.local
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local
            SRV 0 100 464 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _kpasswd._udp.domain_name.local.
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _kpasswd._udp.domain_name.local
DNS DATA =
            SRV 0 100 464 CITY2_DC.domain_name.local
            SRV 0 100 464 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = DomainDnsZones.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.100.200 is:
DNS NAME = DomainDnsZones.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.DomainDnsZones.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.DomainDnsZones.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = ForestDnsZones.domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.100.200 is:
DNS NAME = ForestDnsZones.domain_name.local
DNS DATA =
            A  10.0.101.200
           A  10.0.100.200
+------------------------------------------------------+
The Record is different on DNS server '10.0.100.200'.
DNS server has more than one entries for this name, usually this means there are multiple DCs for this domain.
Your DC entry is one of them on DNS server '10.0.100.200', no need to re-register.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = _ldap._tcp.ForestDnsZones.domain_name.local.
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local.
The record on DNS server 10.0.100.200 is:
DNS NAME = _ldap._tcp.ForestDnsZones.domain_name.local
DNS DATA =
            SRV 0 100 389 CITY2_DC.domain_name.local
            SRV 0 100 389 CITY_DC.domain_name.local
+------------------------------------------------------+
The Record is correct on DNS server '10.0.100.200'.
    [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.100.200'. Please wait for 30 minutes for DNS server replication.
   [FATAL] No DNS servers have the DNS records for this DC registered.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Can you do an ipconfig all for both servers and post for  me?
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Ipconfig /all as requested:
Main DNS and PDC:
C:\Documents and Settings\Administrator>ipconfig /all
Windows IP Configuration
   Host Name . . . . . . . . . . . . : CITY_DC
   Primary Dns Suffix  . . . . . . . : domain_name.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain_name.local
Ethernet adapter Local Area Connection:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II GigE (NDIS VBD Client)
   Physical Address. . . . . . . . . : 00-1C-23-CE-42-4C
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 10.0.100.200
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.100.1
   DNS Servers . . . . . . . . . . . : 10.0.100.200
                                                   10.0.101.200
Secondary DNS and Second DC

Windows IP Configuration
   Host Name . . . . . . . . . . . . : CITY2_DC
   Primary Dns Suffix  . . . . . . . : domain_name.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain_name.local
Ethernet adapter Local Area Connection:
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 00-18-8B-16-7B-76
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 10.0.101.200
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.101.1
   DNS Servers . . . . . . . . . . . : 10.0.101.200
                                                    10.0.100.200
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Are these DCs listed in two subnets? The current config is you have two DCs in two different subnets.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Two different subnets.  Correct.  One box is here in our CITY while the other one is in another town called CITY2.  They talk to each other via a hardware VPN tunnel.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Make sure your ports are opened correct. Do you have AD integrated zones?

http://technet.microsoft.com/en-us/library/bb727063.aspx
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Yes, we have AD integrated zones.
Sonicwall hardware VPN tunnels between the two sites, making the IPSEC stuff transparent to the DCs which are also DNS servers.  
Never knew this problem existed UNTIL we ran netdiag on both DCs.  The PDC comes up clean.  The netdiag /test:DNS comes up clean on the PDC.  However comes up with the [FATAL] message on the remote DC.
We've been having a major issue with the PDC shutting down its domain (domain literally disappears).  We've run some diags and came up with this error which might be a symptom of a bigger problem (I have another question open for THAT issue).
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Send me the link for the other question. Go to the remote DC then do a netdiag /fix then do the same on the PDC. Then go to AD sites and services to replicate. Do you have two NICs on either server?
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23825838.html
We've tried all that.  But I shall do so again - just in case I missed a step.  Where should I replicate from/to?

Single nic - each server - someone from the other question went there and thats pretty well where the discussion has stopped.  Thought I might involve someone from the DNS zone.
 
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Do it both ways just in case. Are you sure the correct ports are open? When you replicate check the logs for any errors or warnings
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
To be honest, I didn't think that you had to open up any ports "thru" the VPN tunnel.  I'll have to check out the settings for the VPN tunnel to see if I can (or need to) open anything up in addition to whats there already.  I remember seeing only 1 thing to ENABLE and DISABLE and that was NetBIOS broadcasts.
Which logs do you speak of?  DNS?  NTFRS?
Thanks for the help!
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
All logs.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Nothing.  Nada.
Very quiet.  DNS - starting DNS and stopping.  Application - nothing.  Server - nothing.  NTFRS - nothing.
But the Verbose log on netdiag /test:DNS shows me the problem.  
snippet again -
DNS test . . . . . . . . . . . . . : Failed
    Interface {6DDBC110-D91C-4C70-B776-3149A00A1A73}
      DNS Domain:
        DNS Servers: 10.0.101.200 10.0.100.200
        IP Address:         Expected registration with PDN (primary DNS domain name):
        Hostname: CITY2_DC.domain_name.local.
        Authoritative zone: domain_name.local.
        Primary DNS server: CITY2_DC.domain_name.local 10.0.101.200
        Authoritative NS:10.0.100.200 10.0.101.200
 
Check the DNS registration for DCs entries on DNS server '10.0.101.200'
The Record is different on DNS server '10.0.101.200'.
+------------------------------------------------------+
The record on your DC is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.101.200
The record on DNS server 10.0.101.200 is:
DNS NAME = domain_name.local.
DNS DATA =
            A  10.0.100.200

Where the heck is this info coming from?  
Its telling me that the domain's DNS server on the Domain controller is 10.0.101.200 and yet on the DNS server the record for the domain is 10.0.100.200 (which is the OTHER DNS server).  This is ok.  Its just that the A record for 10.0.101.200 is missing.
I checked every folder, line for line in both DNS servers.  They were identical.  When I found some errant entries (in one case a workstation was missing and an old one was in there) in the forward lookup zone, I would toast the errant entries from one and then toast it from the other.  I would then log into the workstation that was NOT in DNS, browse around for a few minutes and then check DNS.  It was now registering in the Primary DNS server.  Within minutes its record was at the remote DNS server.

So where do I put that A record?
Or is it easier to rebuild DNS?
tia
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
I think (there's a stretch) I know what is wrong.
Somehow I have two forward zones.
I looked at another multi-dns server network we look after to glean that fact.

One of the zones is correct.

The "good zone" is "domain_name.local"
The  "bad" zone, is "_msdcs.domain_name.local"
The key here, is that the entire _msdcs key is empty under the domain_name.local, save for the name servers.  It looks almost like it was accidentally moved and turned into a forward zone!
I can't creat keys in DNS.  So where do I modify this info?  I can easily toast the "bad" forward zone.  But how do I recreate that key in the good zone?  Is this a registry thing?
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Can you delete the whole DNS zone?
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
What are the ramifications?
Can I toast the DNS and rebuild it all the while keeping Active Directory intact?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Yes, that is not a problem but rebuild it quickly or change the clients and server to point to the other DNS server for DNS resolution.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
The I will perform the deletion tonite.  I am going to try to delete the _msdsc forward zone first and then do a netdiag /fix.  If that doesn't work I'll have to rebuild DNS.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility

Ok.
So I toasted the

_msdcs.domain_name.local

Forward Lookup zone.  Big mistake.  Even tho it wasn't supposed to be there, it was being used (I also didn't turn the DNS server into a NON-Active Directory Integrated DNS Server first, thereby toasting some AD entries - or so the warning went).
After that, tons of errors in netdiag.  Yeesh.  No better after netdiag /fix.

Tried calling Micro$oft.  They were all in bed.  Promised me a call back in 2 hours.  Still waiting.

So I had 2 options.  System Restore.  Or try toasting the whole forward lookup zone and rebuild it.  Went with option 2.

Toasted forward lookup zone:
domain_name.local

AFTER making the zone NON-ACTIVE DIRECTORY INTEGRATED.  Don't know if that helped much.  Most posts suggest to do so, so I did.
The recreated the zone with the same name:

domain_name.local

Made it the Primary Zone, ACTIVE DIRECTORY INTEGRATED checked ON at the bottom.
Netdiag comes up clean!  Nice!
The zone looks like all the other zones I've dealt with:

_msdcs
_sites
_tcp
_udp
DomainDNSZones
ForestDNSZones

I then went to the remote DC and opened up DNS and toasted the forward zone there.  I read your thread and someone else's thread about DNS (I think it was the DNS god Chris Dent :) and went to Sites and Services and started a replication between Domain Controllers which SHOULD rebuild the Forward Lookup Zone.  IT DID!  Woohoo.
Alas, all good things must come to an end.  We STILL have the netdiag error on the remote DC:

DNS test . . . . . . . . . . . . . : Failed
   [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.101.200'. Please wait for 30 minutes for DNS server replication.
   [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.0.100.200'. Please wait for 30 minutes for DNS server replication.
   [FATAL] No DNS servers have the DNS records for this DC registered.

Netdiag /fix:

DNS test . . . . . . . . . . . . . : Failed
   [FIX] re-register DC DNS entry 'greatcanadian.local.' on DNS server '10.0.101.200' succeed.
   FIX PASS - netdiag re-registered missing DNS entries for this DC successfully on DNS server '10.0.101.200'.
   [FATAL] No DNS servers have the DNS records for this DC registered.

So while we've corrected the "visual" problem of the Forward Lookup zone _msdcs, the original problem remains - a netdiag error.
The only thing that I can think that I didn't do, was get rid of the DNS subdirectory and the netlogon files.  Might that make a difference?
Ouch!
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
I'm thinking that the VPN might be the problem with the errors with DNS. There are some commands in the article below that will allow you to troubleshoot deeper. Are you running 64-bit or 32-bit? If you add and A record in one DNS server then force replication does it replicate to the othe server?


http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/distrib/dsbi_add_xvuo.mspx?mfr=true
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Good article.  I was either given that link by someone on the other question or found it on my own yesterday.  Lots to go thru there.  And lots of dead ends - check for this.  Ok.  I HAVE that error.  Now what?  :)
That's pretty well where we're at with this one.

We have a netdiag error.  We have a remote DC that has a DNS server that is Active Directory Integrated that appears to get everything from the local DC once replication happens.  However IT has an error in netdiag.  The local DC and DNS server does not.

Replication is happening.  I toasted the entire Forward Lookup zone on both the local and remote DNS servers.  Re-created it ONLY on the local DNS server.  Then went to AD Sites and Services.  Highlighted the remote DC, NTDS Settings and in the rhs window, highlighted the settings, right clicked and chose "REPLICATE NOW".

I then checked in a few minutes at the remote DNS server, and the forward lookup zone had been recreated.  I just received a call from the remote office.  Outlook couldn't find the exchange server.  Realized that I hadn't logged out or into the exchange server since the DNS changes and that once I did, the exchange server would be listed in the forward lookup zone.

I'll take a better look at that document you cited.  I'm sure the answer is close.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Correction.  I had to do an "ipconfig /registerdns" on the Exchange server.  That got it back into the forward lookup zone.  I left things alone this time.  About 30 minutes later, the Exchange server's A record was at the remote DNS server.  With the same netdiag error:
DNS test . . . . . . . . . . . . . : Failed
    [WARNING] The DNS entries for this DC are not registered correctly on DNS se
rver '10.0.101.200'. Please wait for 30 minutes for DNS server replication.
    [WARNING] The DNS entries for this DC are not registered correctly on DNS se
rver '10.0.100.200'. Please wait for 30 minutes for DNS server replication.
    [FATAL] No DNS servers have the DNS records for this DC registered.

Going deeper into that document you cited above.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
How is it going?
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
nothing yet.
I've tried almost everything that I've read up on.
I know what the output of netdiag /v /test:DNS is.
Its wrong.
But kind of at a dead end as to how to fix it :)

I have MS on a next business day callback.
Seeing if they can help solve what EE people helped find :)
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
Are you running 64-bit or 32-bit? This error also comes up when you run the wrong bit verison of the support tools.
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
32 bit.
How can you tell what version of OS its written for?

0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
No, the first one is the correct the link you provided is SP1
0
 
LVL 2

Author Comment

by:lmkandia
Comment Utility
Those are the admin tools.
active directory computers and users,
active directory sites and services.
netdiag doesn't come in that pack
in comes in the link that I pasted - support tools :)
0
 
LVL 2

Accepted Solution

by:
lmkandia earned 0 total points
Comment Utility
btw
a MS tech helped me solve the issue
I had inadvertently put the following line in the remote dc's host file:
10.0.100.200       domain_name.local

I did that over 8 months ago.
Finally came back to haunt me now.

:)

thanks for all your help!
0
 
LVL 59

Expert Comment

by:Darius Ghassem
Comment Utility
You are right. Wrong link. My brain was saying something else then my eyes were seeing.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
Resolve DNS query failed errors for Exchange
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now