after demoting DC, can't contact domain controller

Posted on 2008-11-17
Last Modified: 2013-12-24
Computers on domain dont get connected to shares or printers automatically (can be mapped manually).
active directory is configured improperly somewhere and its not recognizing 2k3 DC "a" as the DC since the original 2k DC was demoted  (I swear I followed all appropriate steps  by transfering FSMO roles and seizing the them on the old DC).  The AD is visible and running.  However, it's not being acknowledged that 2k3 DC "a" as the primary DC.  I thought it might be because its 2k3, but its running in mixed mode which means it can play with 2k servers.  I checked the following:
-srv records on the dns server (which is not a DC) and appears that all the neccessary entries exist
-nslookup, set type=all,  Type _ldap._tcp.dc._msdcs.(Domain_Name) and responded with the right ip addresses
-ran netdiag and notice this error message: "the system volume has not been completely replicated to the local machine. this machine is not working properly as a dc".

Appears that the old 2k DC was holding on to something and it didn't properly transfer over.  I don't know what i missed; i thought all i had to do was transfer FSMO roles, seize the old one, and soon as i demoted, "can't contact domain controller".  
Question by:eelmazovski
    LVL 70

    Expert Comment

    I'm a bit confused since you talk of transfering the FSMO roles then seizing the them - if you did a clean transfer, then there is no need to seize.

    Did yoi make the new server a Global Catalog Server ?  To make the new machine a global catalog server, go to Administrative Tools, Active Directory Sites and Services, Expand, Sites, Default first site and Servers. Right click on the new server and select properties and tick the Global Catalog checkbox. (Global catalog is essential for logon as it needs to be queried to establish Universal Group Membership)

    Did you install DNS on the new server and configure you clients to use the new server for their DNS server ?

    Author Comment

    Yes, I made the new server a GC following those steps.  I didn't make the new server the dns server. there's a 2k server that handles that for us.  As far as i know, that dns is running fine.
    LVL 70

    Expert Comment

    Is there any special reason that you are not using AD integrated DNS on the domain controllers, it makes far more sence to use Active Directory Integrated DNS in most cases, its much more efficient, less troublesome and secure.

    I assume the Old DC is not functioning anymore - did you do a DCPROMO on it to remove Active Directory from it?

    Author Comment

    thanks for the quick response. the dns has been setup on that server since the begininng of time and it wasn't changed by the previous admin..yes, i ran the dcpromo on the original dc and it apparently ran succesfully; the AD isn't no longer there on that server.  as soon as that was successful, computers are failing "to contact domain controller".  the 2k3 dc is not being picked up by the network and i'm worried that the domain settings were damaged during this demoting process. i can access shares by entering the paths whether by name or ip (it will prompt me for a user id and password), i can get on the web, i can print to network servers; so, dhcp is working, dns apparently is working; sysvol directory exists; ...i don't know, first time i encountered an AD issue on this level and it's very frustrating.

    Author Comment

    I tried setting up another server as a DC and receive the message: "An Active Directory domain controller for the domain my.domain could not be contacted.  Ensure that the DNS name is typed correctly.  if the domain is correct then click details for troubleshooting information."  i do that and it lists common causes:
    -Host (A) records that map the domain controller to its IP addresses are missing or contain incorrect addresses.
    -Domain controllers registered in DNS are not connected to the network or are not running.
    It's definetly not the second cause because it's online; it can be accessed by other workstations including the server.  pls help

    Accepted Solution

    It's resolved...the sysvol and netlogon folders weren't shared.

    kb290762 and 315457

    thanks for your efforts KCTS

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    This article explains all about SQL Server Piecemeal Restore with examples in step by step manner.
    Creating and Managing Databases with phpMyAdmin in cPanel.
    Video by: Steve
    Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    12 Experts available now in Live!

    Get 1:1 Help Now