Solved

Inter-forest DNS error

Posted on 2010-11-14
6
777 Views
Last Modified: 2012-05-10
Hi,

We have a forest with four single domain trees (A, B, C, D). One of the trees, site A, was created recently. Sites B, C and D existed already.

In trying to get site B to resolve the name of site A I manually set up a primary AD-integrated zone for it. After the fact I realised that the zone for site A had not replicated to site B because site A's DNS was not configured to do forest wide replication. Anyway when I realised this, I deleted the zone for it on site B's DNS server. Yes, big mistake.

Now site B's DNS is throwing out a lot of errors such as:

Event ID 4004
"The DNS server was unable to complete directory service enumeration of zone C.  This DNS server is configured to use information obtained from Active Directory for this zone and is unable to load the zone without it.  Check that the Active Directory is functioning properly and repeat enumeration of the zone. The extended error debug information (which may be empty) is "". The event data contains the error."

Event ID 4004
"The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error."

Event ID 4521
"The DNS server encountered error 32 attempting to load zone A from Active Directory. The DNS server will attempt to load this zone again on the next timeout cycle. This can be caused by high Active Directory load and may be a transient condition."

In addition, in Active Directory Sites and Services on the DC in site B, if I try to force it to replicate now with site A it gives the error:
"The following error occurred during the attempt to synchronize naming context Configuration from domain controller (DC in Site A) to domain controller (DC in Site B):
The naming context is in the process of being removed or is not replicated from the specified server.

This operation will not continue."

I've no idea where to go with this. Have googled it but there are so many similar dns and AD issues..

Help! :o)

Thanks,
Conor
0
Comment
Question by:Eirejp
  • 3
  • 3
6 Comments
 
LVL 5

Assisted Solution

by:balmasri
balmasri earned 500 total points
ID: 34130607
I suppose that A, B, C & D are separte domains &  Site (A, B, C ,D ) are Active directory sites . right ?

If A , B , C D are child domains , then Recreate the DNS zone as AD integrated zones and domain wide zones. Create delegation for each zone.
Forest wide only for _MSDC.domain.com zone.
Restart Services :   DNS client , DHCP Clinet , Netlogon. DNS Server.
0
 
LVL 1

Author Comment

by:Eirejp
ID: 34130676
Yes, A,B,C & D are seperate domains each within their own tree but all within the same forest, and yes Site (A, B, C and D) are AD sites.

The forest root domain is C.

How do I recreate the zone? Should I delete the zone for A on server A (i.e. its own domain controlller)? All zones are already AD integrated zones, though like I said, the zone for A is not replicating on the site B domain controller.

Should I be doing this on zone B? Restarting the services and changing the DNS zones?

Thanks.
0
 
LVL 5

Accepted Solution

by:
balmasri earned 500 total points
ID: 34130707
No just recreate the deleted zone.

There is no need to replicate the zones between domains.Create delegation ( conditional forwarding)  is enough.
Only the domain controllers zone ( _msdcs.yourdomain.com) should be forest wide.

Restarting these services will re-register the records of domain controllers to this zone. ( Host A , GC, LDAP, etc) so the _msdcs zone will be re-populated again.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 1

Author Comment

by:Eirejp
ID: 34161191
I have tried recreating but no joy.. When I try to replicate AD it gives an error about "RPC server is unavailable" and if I try to rebuild the application partition in DNS it gives me an error about credentials. I might try to manually delete the zone in the child domain and then recreate it and see if that resolves it. I can try this at the weekend.

I'm not sure if I can delete the dns zone on the only dns server in the domain though - will it impact Active Directory if I do?

Thanks,
Conor
0
 
LVL 5

Expert Comment

by:balmasri
ID: 34182104
RPC server is not available is usually a DNS client configuration. Check the DNS settings .
0
 
LVL 1

Author Closing Comment

by:Eirejp
ID: 34204721
Still an issue.. think there is a corruption related to this zone in AD.. Will raise a new question about it with more information rather than continuing this.

Thanks for your help though!
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Resolve DNS query failed errors for Exchange
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now