Problems with Virtual Server on a 2008 Domain Controller

Posted on 2008-11-18
Last Modified: 2012-05-05
I am setting up two new servers using Windows Server 2008.  After setting up thier roles, all is well and they replicated properly.  Then I reach the final step, installing Virtual Server 2005 R2 SP1 on the PDC.

After installing the Virtual Server app, the domain starts giving all types of errors.  This is without even setting up any VM instances and happens as soon as the installation completes.  At this point the DC's give errors when foring a replication throught the AD Sites and Services console.

When forcing replication to the secondary DC: "The target principle name is incorrect."
When forcing replication to the primary with Virtual server: "A security package specific error occured."

The Virtual Server itself provides two errors when the service starts.
1. The service principal names for Virtual Server could not be registered. Constrained delegation cannot be used until the SPNs have been registered manually. Error 0x80072098 - Insufficient access rights to perform the operation.
2. An error has occured during the creation of Service Connection points for Virtual Server in Active Directory. Either a domain controller is not available to complete the operation or there is a security problem accessing the domain. This operation will be retried the next time the service starts. Error 0x80070005 - Access is denied.

Strangely, if I load a Virtual server the instance runs properly and can access the DC.

Here is the real kicker.  If I simply uninstall Virtual Server 2005, all problems go away and replication works fine.
Question by:travis87
    LVL 18

    Accepted Solution

    Some brief googling shows lots of people have had issues with this as well.

    Here's a link to a fix that worked for VS on a 2003 DC

    I don't know about the AD issues you're seeing.  Could be specific to 2008.

    I would have to say, in short, running VS on a DC is not exactly a good idea, for lots of reasons...

    LVL 6

    Author Comment

    Thanks for the link.  Adding the network account to the computer in AD allowed the VS to udate the Ldap and stop complaining.

    The bigger issue is the problems with replication.  Why would AD just stop replicating after installing VS.

    You are right about using a DC to run VS but it's a budget issue.
    LVL 18

    Expert Comment

    When LDAP was updated on the computer account it very likely could have broken AD..  Honestly, I haven't worked with VS at all (I'm a VMware shop), so I'm not 100% sure what changes are made..

    Can you post the before and after of the "LDAP updates"?

    LVL 6

    Author Comment

    What finally fixed AD...

    The atricle that was sent stated that I needed to allow a higher privelage the the NetworkService account on the DC.  That resolved the errors on the Virtual Server wbe interface but did not fix AD.   In fact the Virtual Server installation broke active directory (LDAP).  After uninstalling VS, Active Directory was again working.

    Re-installing VS with the elevated NetworkService privelages made everything happy.  VS had no more SPN problems or errors and AD was able to replicate sites without error.

    Thanks for the help!

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    Few best practices specific to Network Configurations to be considered while deploying a Hyper-V infrastructure. It may not be the full list, but this could be a base line. Dedicated Network: Always consider dedicated network/VLAN for Hyper-V…
    Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
    This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
    This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now