Solved

Cannot find Global Catalog

Posted on 2010-08-26
19
972 Views
Last Modified: 2012-06-21
Greetings!

I manage a small 80+ user shop with a single domain controller and a seperate, dedicated Exchange server.  (All 2003, Sp2)

When running Active Directory Users & Computers on anyother system, other than the DC, I run into error warnings.

For example, when clicking on the 'Members' tab of a security group, I get this message:

"A global catalog cannot be located to retrieve the icons for the members list..."

This does NOT happen when I am using ADUC on the Domain Controller.

My Question:
What could prevent Global Catalog from being available to other member servers or workstations?    (Yes, Global Catalog IS checked in NTDS settings in ADSS -- there is only 1 DC.) I sometimes get similar errors from Outlook.

BTW, Exchange is working fine -- but there are problems when adding new users mailboxes when I use the ADUC on the exchange server.  Fine when on DC.

Thanks in advance!!!

Jon
0
Comment
Question by:graceout
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 4
  • 2
  • +1
19 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33531332
Could you take print screen from command-line where you run command

ipconfig /all

please?

I suppose that is a problem of DNS server misconfiguration.
0
 
LVL 24

Expert Comment

by:Mike Thomas
ID: 33531370
Check member server and client ip configuration settings, maybe flush their dns cache using ipconfig/flushdns, hve you changed IP of the DC's or anything like that recently?
0
 
LVL 7

Accepted Solution

by:
SjoerdvW earned 250 total points
ID: 33531391
Sounds like a DNS problem. Can you run the following command to confirm that the GC is registered to DNS properly

nslookup gc._msdcs.[yourdomain.com]
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 

Author Comment

by:graceout
ID: 33531420
All servers and workstation have the DC's IP addreess as the Primary DSN server.

The secondary is the DNS server across the WAN in Corporate which forwards to the ISP.

I have forwarding set up on the DC's DNS AD zone which also points to this secondary.
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33531445
Please restart your netlogon service on DNS server.

net stop netlogon
net start netlogon

and check again
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33531467
If it won't help run DNS test from command-line and put results here

dcdiag /test:dns

thanks in advance
0
 

Author Comment

by:graceout
ID: 33531485
SjoerdvW:  this command returns "*** Can't Find __________: Non existent domain."

In fact, I usually get errors from "nslookup [hostname]" even though I've checked through DNS server properties and reverse lookups.

0
 

Author Comment

by:graceout
ID: 33531715
DCDIAG was run FROM the Exchange server, but added the /s: tag which identifies BALAD as the DC.
The DC IS 1292.168.7.10

Definately something funky going on.  It's like our DNS server is forwarding everything...
DNStest.jpg
0
 

Author Comment

by:graceout
ID: 33531795
In fact, ANY "nslookup [hostname] returns:  *** dc.domain.com can't find hostname: Query refused.

Again, all primary dns servers ARE the domain controller AND dns server.
0
 
LVL 24

Assisted Solution

by:Mike Thomas
Mike Thomas earned 250 total points
ID: 33531806
Create a new forward lookup zone named _msdcs.mydomain.com , Store it in AD,
allow dynamic updates, then restart the Netlogon service byt typing "net stop netlogon && net start netlogon"
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
ID: 33531814
do you have more than 1 nic on dns server?
0
 

Author Comment

by:graceout
ID: 33531979
Only 1 NIC on DC/DNS server.

iSiek:  I have just done this -- although there WAS a _msdcs folder inside the AD zone.

Still getting 'Cant find ... query refused' on all nslookups.
0
 

Author Comment

by:graceout
ID: 33532198
Starting to think the real question is:  Why is my DNS server refusing queries?
0
 

Author Comment

by:graceout
ID: 33532440
I guess everyone is giving up, but I wanted to mention one other thing I noticed:

When I perform "nslookup hostname" it fails as before, but when I perform

"nslookup hostname.fully.qualified.domain.name" it suceeds.

Any final ideas?
0
 
LVL 7

Expert Comment

by:SjoerdvW
ID: 33532943
Can you add fully.qualified.domain.name to the "DNS suffix for this connection" in the ip properties of you're network connection?

(this can also be done through DHCP, Server Options, 15 DNS domain Name)
0
 

Author Comment

by:graceout
ID: 33532975
SjoerdvW:  This is already done -- and if also done mannually, does not resolve this problem.

Adding this "DNS Suffix" only insures that connections  (pings, etc.) get resolved within the domain.  One can ping HOSTNAME without needing to qualify it.


0
 

Author Comment

by:graceout
ID: 33533385
SjoerdvW:

You asked me to do this: "Can you run the following command to confirm that the GC is registered to DNS properly:  nslookup gc._msdcs.[yourdomain.com] "

What do I need to do to properly register GC in DNS?

You get full points when you show me how.

Thanks!
0
 

Author Closing Comment

by:graceout
ID: 33535388
Comments led me to my own resolution, but did not provide a solution.
0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Here's a look at newsworthy articles and community happenings during the last month.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question