Solved

Cant login with secondary domain controller windows server  2003

Posted on 2009-06-28
6
465 Views
Last Modified: 2012-05-07
Ive created a secondary domain controller, until now, Ive done this:


1. Installed 2003 server, joined the domain and runned DCPROMO
2. Ive installed and configure DHCP and DNS.
3.Ive checked that both servers are global catalog servers.

My Primary Sever ip is 10.0.0.1, and my secondary is 10.0.0.5
All clients have DNS 10.0.0.1 and 10.0.0.5 (configured through DHCP)

Ive made a test disconnecting the primary domain controller, and after rebooting all client computers are unable to login, they can only login with user credentials already used in that client.

Can you help me?
Thank you.

0
Comment
Question by:_the_reverend
  • 2
  • 2
  • 2
6 Comments
 
LVL 16

Expert Comment

by:PaciB
ID: 24732432
Hi,

Can you verify that the SYSVOL share exists on the second DC. A new DC does not bring up the SYSVOL share until it has successfully finished an Active Directory replication, and by the way it also refuse to authenticate anyone.

Did you install the "Support Tools" and check the result of DCDIAG and NETDIAG commands ? These commands will show you a precise report of Active Directory status.
(the support tools are on the Windows 2003 CD).

Have a nice day


0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24732610
Hi there. As mentioned by PaciB, a DCDIAG and NETDIAG should root out any issues on the DCs.
Have you confirmed that the new IP config (ie both DNS servers listed) is actually applying to your clients? Did you configure these options on both scopes? If your first DC was also a DHCP server, your clients will continue to try to contact it to renew the lease. They won't automatically go through a full broadcast DORA process and speak to the new DHCP server until 50% (i think) of the existing lease has passed. From memory, they'll try to contact the source DHCP server, if they can't, then they continue with their existing lease, and therefore not get the config you have put on the new server. Just a thought.
0
 

Author Comment

by:_the_reverend
ID: 24732640
Ive Attached the results of both diagnostics, but I dont understand them completley and as how to correct those tests that didnt pass.
Thank you.
dcdiag.txt
netdiag.txt
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 27

Accepted Solution

by:
bluntTony earned 500 total points
ID: 24732661
Are these on the new or old server? I'm guessing it's the new?
Why has the NIC on this server got two IP addresses? Is this intentional? It would cause problems on a DC. Remove the .8 address in the properties of the NIC TCP/IP settings, then run the following commands on the DC:
ipconfig -flushdns
ipconfig -registerdns
net stop netlogon
net start netlogon
This should correct DNS records. Then jut check in your forward lookup zone that you only have one Host (A) record for the server, and that it points to the .5 address.
See if this helps...
0
 

Author Closing Comment

by:_the_reverend
ID: 31597718
Thank you, that did it, we used a virtual IP (.8) to avoid SPAMERS using our SMTP server. Dont know how exactly but that was the reason. Why can this virtual ip cause problems to the DC?
Thank you.
0
 
LVL 16

Expert Comment

by:PaciB
ID: 24732781
Hi,

Your DC is a multi-homed server, meaning it has several netcards et several IP addresses.
You must ensure that your DC has NOT registered itself in DNS with bad IP, like these on the "Realtek NIC" : 201.134.44.xxx

If your DC is register in DNS with a IP address that is not reachable from clients you can have trouble like you described. As an exemple let's suppose your secondary DC is registered in DNS with multiple IP addresses : 10.0.0.5 (the good one) and 201.134.44.172 (a bad address coming from the Realtek NIC).
When your first DC is offline, clients request the secondary DNS 10.0.0.5 asking for another DC for the ponderosa.local domain.
The DNS only knows one other DC : monterrey5.ponderosa.local... But it has multiple addresses for this DC. So the DNS server choose one of the addresses for monterrey5 and give it to the client.
Let's suppose the DNS choosed 201.134.44.172. The client cannot reach the DC on this address. The the client suppose this DC is offline and ask the DNS for one more DC but there is no more DC in the list.

You can check which IP addresses are returned by the DNS server byt typing these two commands several times :

IPCONFIG /FLUSHDNS
PING monterrey5.ponderosa.local

The first command force the client to empty its DNS cache
Now that the DNS cache is empty, the second command force the client to request the DNS server.

Doing this several times you will have several answers. In normal situation all the answer should give you the same IP address. If not then you DNS is polluted with bad IP addresses and you have to fix the IP configuration on the DC.

Have a nice day.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now