Solved

Windows Server 2008 Active Directory

Posted on 2010-11-16
34
363 Views
Last Modified: 2012-05-10
I have a 2003 Domain Controller and added in a 2008 Domin Controller a few months ago - everything seemed to install successfully.
When the W2003 DC is switched off, none of the clients can authenticate against the 2008 DC. DNS is also insalled on the 2008 DC.
I have transferred all the roles to the 2008 DC sucessfully. When I turn the 2003 DC off, and open Active Directory Users and Computers on the 2008DC it does not show any users. If the 2003 DC is online, the AD Users and Computers opens fine.
I need to format the 2003 Server and reinstall it as a 2008 DC but cannot do this until my issue is resolved.. any suggestions?
0
Comment
Question by:syssol52
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 14
  • 10
  • 7
  • +1
34 Comments
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 34145239
Stuff to check first.
(1) DNS is installed on the 2008 server, but what is everything configured to use for DNS?  (If DNS of the workstations is still pointed at the server that is now off... well... that won't work.)
(2) When you turned the the 2003 DC server, did you remove demote the server to a member server first?
(3) When you open Active Directory Users and Computers, in the pane, where it says "Active Directory Users and Computers", it should tell you what it is connected to... what does it say it's connected to?  If you right click, and specify the 2008 server, do you see your users/computers?
0
 
LVL 13

Expert Comment

by:haim96
ID: 34145422
do you have any replication errors?

when you promoted the 2008 server, did you let him finish the replication or did you tell him finish replication later?

0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34145720
First thing you need to make sure the Windows 2008 Server is a Global Catalog. Make sure this server is pointing to itself. Make sure clients are now only pointing to this server for DNS.

Run dcdiag post results
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 30

Expert Comment

by:Rich Weissler
ID: 34145939
Actually... and all the FSMO processes... make certain you moved all the FSMO processes to the new machine too.
0
 

Author Comment

by:syssol52
ID: 34146060
I set the DNS Settings on the Clients to look at the new 2008 Server
(Still not working)
I didn;t demote the 2003 Server yet as wanted to ensure the 2008 Server would work independently before demoting i.e. all users etc were replicating across
When I open AD Users and Computers it is connected to the W2008 DC but doesn't show the users unless the 2003 DC is turned on?

When I promoted the 2008 DC I let it finish replication

The 2008 server is a GC

I have moved (transferred not seized) all FSMO Roles

DCDIAG Results:

Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\administrator.OLAP>cd\

C:\>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = OLAPSERVER2
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\OLAPSERVER2
      Starting test: Connectivity
         ......................... OLAPSERVER2 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\OLAPSERVER2
      Starting test: Advertising
         Warning: DsGetDcName returned information for
         \\OLAPSERVER.olap.portal, when we were trying to reach OLAPSERVER2.
         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
         ......................... OLAPSERVER2 failed test Advertising
      Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... OLAPSERVER2 failed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... OLAPSERVER2 failed test DFSREvent
      Starting test: SysVolCheck
         ......................... OLAPSERVER2 passed test SysVolCheck
      Starting test: KccEvent
         ......................... OLAPSERVER2 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... OLAPSERVER2 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... OLAPSERVER2 passed test MachineAccount
      Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=ForestDnsZones,DC=olap,DC=portal
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=DomainDnsZones,DC=olap,DC=portal
         ......................... OLAPSERVER2 failed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\OLAPSERVER2\netlogon)
         [OLAPSERVER2] An net use or LsaPolicy operation failed with error 67,
         The network name cannot be found..
         ......................... OLAPSERVER2 failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... OLAPSERVER2 passed test ObjectsReplicated
      Starting test: Replications
         ......................... OLAPSERVER2 passed test Replications
      Starting test: RidManager
         ......................... OLAPSERVER2 passed test RidManager
      Starting test: Services
         ......................... OLAPSERVER2 passed test Services
      Starting test: SystemLog
         ......................... OLAPSERVER2 passed test SystemLog
      Starting test: VerifyReferences
         ......................... OLAPSERVER2 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : olap
      Starting test: CheckSDRefDom
         ......................... olap passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... olap passed test CrossRefValidation

   Running enterprise tests on : olap.portal
      Starting test: LocatorCheck
         ......................... olap.portal passed test LocatorCheck
      Starting test: Intersite
         ......................... olap.portal passed test Intersite

C:\>


Any help is much appreciated..
0
 
LVL 13

Expert Comment

by:haim96
ID: 34146320
it seems like you have problems with SYSVOL which may indicate that SYSVOL
doesn't finished to replicate and SYSVOL share doesn't exist on the server.
if it true that mean that directory services doesn't really working on this server.

SYSVOL continue to replicate after the initial AD replication when promote a server.
and only after it finished and the SYSVOL share is created the server can fully operate as DC.

make sure you have SYSVOL share.
look for the event that said that SYSVOL is created.
if there no such event so there is your problem.


0
 

Author Comment

by:syssol52
ID: 34146442
Thanks
I'll check this out..
If there is an issue with the SYSVOL share, can this be repaired / recreated ? Or, what do I do from here..?
0
 
LVL 13

Expert Comment

by:haim96
ID: 34146498
It should be created automatcly once the replication work
You have separated event log for the nfs replication. Check for events there
0
 

Author Comment

by:syssol52
ID: 34146632

I've looked at the events and apart from one or two errors (which appear to have fixed themselves shortly afterwards) I cannot see anything that suggests what the issue is.
I've attached a copy of the DFS Events from event viewer but had to rename to .txt (please rename to evtx to view)
thanks
DFS-Events..txt
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34146644
Here are a couple of links to check out.
http://support.microsoft.com/kb/967336
http://support.microsoft.com/kb/947022/en-us

Try the links if these don't work let me know will move to the next steps
0
 

Author Comment

by:syssol52
ID: 34146718
will try now and let you know..
thanks for your help
0
 

Author Comment

by:syssol52
ID: 34146853
I've done what the second link suggests but on the first link that refers to an entry in the registry is not there - see picture attached.
Will I add it to the registry? - thanks
Registry-Pic.png
0
 
LVL 13

Expert Comment

by:haim96
ID: 34146931
can you ping the other server (2003) with short name? (netbios name)
0
 

Author Comment

by:syssol52
ID: 34146953
yes, i can ping by ip and netbios ??
0
 
LVL 13

Expert Comment

by:haim96
ID: 34147005
???

is that mean that you can ping?  :)
or you asking?

sorry.. couldn't understand...

what i'm trying to say is that DFSR need to be able to connect with the short name.
so you need WINS or add DNS suffix to your network configuration.

just to make sure it's not the problem...


0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34147009
You are not running DFSR then which is fine.

Reboot the server.

Run dcdiag post results.
0
 

Author Comment

by:syssol52
ID: 34147057
i've noticed that when i browse the network to the server 2003 machine there is a netlogon and sysvol folder shared..
the sysvol folder is the only one shred on 2008 dc and there is no netlogon folder shared
0
 

Author Comment

by:syssol52
ID: 34147070
to answer you question regarding ping - yes i can ping by ip address and netbios name.
sorry for confusing you with ?
0
 
LVL 13

Expert Comment

by:haim96
ID: 34147086
it seems like this:
http://support.microsoft.com/kb/947022

without netlogon your DC cannot fully operate
 
0
 
LVL 13

Expert Comment

by:haim96
ID: 34147100
ohhh... you already got this... sorry... :)

did you try it?
0
 

Author Comment

by:syssol52
ID: 34147135
yes, i did this but should I reboot?
The server is been used at the moment and I will not be able to reboot until tonight (GMT)
I will try rebooting later and rerun dcdiag and post results..
thank you for your help so far
0
 
LVL 13

Expert Comment

by:haim96
ID: 34147181
you welcome....

hope it will resolve you issue....


0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34147590
Restart the netlogon service
0
 

Author Comment

by:syssol52
ID: 34156223
thanks for all your help..
the problem is that currently the server is in use by customers for running reports and we have to schedule downtime (even to reboot)
I will be spending time on thurs morning to troubleshoot and will post results then
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34156836
Restart the netlogon service will not cause downtime
0
 

Author Comment

by:syssol52
ID: 34157058
yes, i restarted this morning but if i put 2003 domain controller offline to check if users and computers show up in active directory on 2008 dc, any users trying to connect in the meantime will not be able to {providing that the issue was not resolved by restarting netlogon)
thanks
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34157072
Run dcdiag post results now after restart the services
0
 

Author Comment

by:syssol52
ID: 34157426
my 2008 dc is called olapserver2 and the 2003 dc is called olapserver



Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\administrator.OLAP>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = OLAPSERVER2
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\OLAPSERVER2
      Starting test: Connectivity
         ......................... OLAPSERVER2 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\OLAPSERVER2
      Starting test: Advertising
         ......................... OLAPSERVER2 passed test Advertising
      Starting test: FrsEvent
         ......................... OLAPSERVER2 passed test FrsEvent
      Starting test: DFSREvent
         ......................... OLAPSERVER2 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... OLAPSERVER2 passed test SysVolCheck
      Starting test: KccEvent
         ......................... OLAPSERVER2 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... OLAPSERVER2 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... OLAPSERVER2 passed test MachineAccount
      Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=ForestDnsZones,DC=olap,DC=portal
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=DomainDnsZones,DC=olap,DC=portal
         ......................... OLAPSERVER2 failed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\OLAPSERVER2\netlogon)
         [OLAPSERVER2] An net use or LsaPolicy operation failed with error 67,
         The network name cannot be found..
         ......................... OLAPSERVER2 failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... OLAPSERVER2 passed test ObjectsReplicated
      Starting test: Replications
         ......................... OLAPSERVER2 passed test Replications
      Starting test: RidManager
         ......................... OLAPSERVER2 passed test RidManager
      Starting test: Services
         ......................... OLAPSERVER2 passed test Services
      Starting test: SystemLog
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   16:55:34
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:00:36
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:05:38
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:10:41
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:11:21
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:15:43
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:20:45
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:25:47
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:30:50
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:35:52
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:40:54
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:45:56
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         An Error Event occurred.  EventID: 0x00000422
            Time Generated: 11/17/2010   17:50:58
            Event String:
            The processing of Group Policy failed. Windows attempted to read the
 file \\olap.portal\sysvol\olap.portal\Policies\{31B2F340-016D-11D2-945F-00C04FB
984F9}\gpt.ini from a domain controller and was not successful. Group Policy set
tings may not be applied until this event is resolved. This issue may be transie
nt and could be caused by one or more of the following:
         ......................... OLAPSERVER2 failed test SystemLog
      Starting test: VerifyReferences
         ......................... OLAPSERVER2 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : olap
      Starting test: CheckSDRefDom
         ......................... olap passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... olap passed test CrossRefValidation

   Running enterprise tests on : olap.portal
      Starting test: LocatorCheck
         ......................... olap.portal passed test LocatorCheck
      Starting test: Intersite
         ......................... olap.portal passed test Intersite

C:\Users\administrator.OLAP>
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 34157807
Still failing NETLOGON but your server is at leaste advertising as a DC now. Go through the link about the missing netlogon folder one more time
0
 

Author Comment

by:syssol52
ID: 34162643
thanks for your help..
i think i have it working now so will leave the 2003dc offline for a day or so and kep an eye on it..
who do i award the points to.. - as both dariusq and haim96 have been very helpful..??
0
 
LVL 13

Expert Comment

by:haim96
ID: 34162661
go for split... :)
0
 
LVL 13

Accepted Solution

by:
haim96 earned 500 total points
ID: 34171433
i think he made a mistake with the points split...
he wanted to give points to me (haim96) and dariusq.



0
 

Author Closing Comment

by:syssol52
ID: 34173427
Sorry if mistake was made..
not too sure about awarding points
0

Featured Post

Guide to Performance: Optimization & Monitoring

Nowadays, monitoring is a mixture of tools, systems, and codes—making it a very complex process. And with this complexity, comes variables for failure. Get DZone’s new Guide to Performance to learn how to proactively find these variables and solve them before a disruption occurs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question