[Last Call] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2831
  • Last Modified:

cannot contact domain controllers when dcpromo - windows 2008 R2

Hi experts,

I am trying to dcpromo a server to a DC at branch office. I got the follow error:

DNS was successfully queried for the service location (SRV) resource record used to locate a domain controller for domain "my.domain.name".

The query was for the SRV record for _ldap._tcp.dc._msdcs.my.domain.name

the following domain controllers were identified by the query:

however no domain controllers could be contacted

common causes of the error include:
- host (A) or (AAAA) records that map the names of the domain controllers to their IP adresses are missing or contain incorrect addresses.

- domain controllers registered in DNS are not connected to the network or are not running.

I checked the A record for both DC are in place and also i can contract the DC by ping, ldp.

any one can help me with this issue?

4 Solutions
Mike KlineCommented:
What DNS server is the branch DC pointing to?  Are there any firewalls between the boxes?


nokypleaseAuthor Commented:
it is pointing to the main office dns server (dc1.my.domain.name)

there is a firewall between 2 site, however i checked all traffic are allowed to dc1.my.domain.name, while the traffic is blocked for all connections to dc2.my.domain name as dc2 is actually in another subnet.

do i need to allow the branch office server to talk to both DCs, i thought it only need to have either one.
Mike KlineCommented:
Is DC1 the box that holds all your FSMO roles, are there any health/replication issues between DC1 and DC2?

Check the dcpromo log files    http://technet.microsoft.com/en-us/library/cc961809.aspx

You could run a network sniffer during promo to see if there are any issues there too.


Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Both side should be able to talk to each other.Below port should be open for AD replication.

Port Assignments for Active Directory Replication.
Service Name  UDP    TCP
LDAP                389   389
LDAP                         636
GC                             3268
Kerboros           88    88
DNS                   53    53
smb over IP       445   445

Refernce linl:http://technet.microsoft.com/en-us/library/bb727063.aspx
Jason WatkinsIT Project LeaderCommented:
Yes. Ports 53, 389 should be open at the very least. How do you normally send DS traffic over the WAN? A VPN between each site would be great.
nokypleaseAuthor Commented:
I can finally dcpromo my server in the branch office after allowing the traffic to go to both dc1 and dc2.

many thanks for all the help!
Mike KlineCommented:
Nice work!!   Ports and DNS are the two biggest issues when it comes to AD.  If those are working then AD is usually happy :)

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now