asked on

AD checks before adding new DC

I am planning on adding a second DNS/DC to my network. What utilities/checks should I run on my existing server to make sure things are healthy before adding another machine?

SOLUTION

Greg Jacknow

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

smantz

ASKER

I ran straight DCdiag, without any switches, and all tests passed, anything else?

SOLUTION

dhruvarajp

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Mike Kline

I also like repadmin (not needed in your case with only one DC)
CHeck your event logs too.
A decent health checklist is here http://msmvps.com/blogs/ad/archive/2008/06/03/active-directory-health-checks-for-domain-controllers.aspx
Make the new DC a GC...and try and get it up as soon as you can...gives you redundancy.
Thanks
Mike

Krzysztof Pytko

additionally you can also check your DNS condition before setting up new DNS server

use also dcdiag with patameter /test:dns

dcdiag /test:dns

Greg Jacknow

If those are clean, there is not much else to it. You can check you event logs to make sure there is nothing alarming.
As for DNS, I prefer to have the new DNS server without DNS and pointing to the existng one for the install, and then add DNS.
Greg J

smantz

ASKER

Hey,
I ran the netdiag /q and received a failurel for the default gateway test: FATAL no gateways are reachable. My NIC is configured properly and I can reach the interenet and I'm using remote desktop with server. I'm sure this is related to my event system error DCOM 10009. Any ideas?

ASKER CERTIFIED SOLUTION

ChiefIT

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ChiefIT

Also, Windows firewall will block AD authentication and netlogon services. Watch out for that, if confiigured on the new DC.

ChiefIT

I see that you have a multihomed DC. "One nic for the network, and the other as a private link to your firewall." I never recommend multihoming a DC and would suggest you only use one network adapter to communicate with on a DC.

Mike Kline

good point about the multihomed DC Chief.

Please look at this great blog entry from Ace
http://msmvps.com/blogs/acefekay/archive/2009/08/17/multihomed-dcs-with-dns-rras-and-or-pppoe-adapters.aspx

thanks

Mike

smantz

ASKER

Negative on the multihome. One NIC, configured with static ip address, DNS pointing to itself,and plugged into a switch that goes to the backbone and private interface of the firewall. As for my error, I noticed that I have DNS forwarding set to the default gateway. I'm sure this has to do with my OpenDNS and firewall rules to allow some sites to some and some not to others. Comments?

ChiefIT

There is no issue with having your forwarders set to the Gateway IP, IF and only IF your ISP is providing you with a dynamic IP and their DNS servers on the WAN interface of the router. This configuration set up will make your ISP's forwarders dynamic. In other words, if your ISP makes changes to their servers, you automatically get those changes, because they are dynamically passing down to you the ISP's DNS servers.

It's actually a pretty cool trick..

smantz

ASKER

The dns on the gateway goes to OpenDNS. That works as it should. I've since rebooted and I will watch for any other issues like the DCOM 10009 event. Thanks for all the help.
--Steve