[Webinar] Streamline your web hosting managementRegister Today

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1599
  • Last Modified:

windows 2008r2 DNS failure

Our FSMO domain controller suddnely lost connectivity to the DNS server (it is the DNS server). no reason

teh only error message is this:

"Event Type:      Error
Event Source:      DNS
Event Category:      None
Event ID:      4000
Date:            10/31/2011
Time:            5:43:38 PM
User:            N/A
Computer:      vail.fai.net
The DNS server was unable to open Active Directory.  This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it.  Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: 0000232d "

Every time we try to connect we get "you do not have permissions to connect."

Click on the DNS icon and the DNS server comes up with the red sign with minus in it.
Click on action in the mmc is all greyed out. clicking on the server name gives only the DNS event viewer logs

The error message  is:

"The dns server was unable to open Active directory the dns server is contfigured to obtain..."  Event ID: 4000

The weird part is that an old Domain controller showed up in the DNS zone.

Not sure what to do next to bring it back online.

I could restore, but the problem will persist...

Using dnscmd I get error_access_denied 5 0x5

I have tried

dnscmd.exe /Config /RpcAuthLevel 0

to not avail.

Any advice would be helpful!

  • 2
  • 2
1 Solution
Are you rinnung IPv6 on that server?  although some may disagree, if you're not using IPv6, disable,  it can cause these types of DNS problems.  mostly because the Ipv6 address of your domain controller is normally set for DHCP,
05fdmlAuthor Commented:
yes, it was running. Thanks for the tip!

the question is how to bring the DNS server back.
Suddenly lost connection?  Was there any events preceding that?
What other events in the logs?
Was this after a reboot?

Are there any other events in any of the event logs (warnings or errors?)
Is the DNS Server service running?

-- In bizarre situations as this, I usually start by running a CHKDSK /F C: and rebooting, just to make sure there are no underlying disk errors causing the problem.
jr has a good point.  You can also try unregistering an re-rgistering the DNS suffix in the NIC porerties and running ipconfig /flushdns and ipconfig /registerdns
When a Domain Controller cannot find the DNS server, it is not lost due to a standard host record. It is the _MSCDS that are causing it problems.

Like any other object on a network (such as a username) - it gets a GUID, and it refers to that GUID behind the scenes.  Well, domain controllers use the CNAME to discover its environment:

da5f3e67-48f9-4b5b-857b-d0d61dce205c._msdcs.exampledomain.local is a CNAME that points to

When a DC1 complains it cannot find DC2, and you can ping DC2 from DC1, it is because of the _MSCDS info.

SO, what is happening, is that your DC cannot find its DNS info, even when using both hands...

I would try changing the IP address of your dns server so that it looks to a different server first for its dns, and remove itself from any DNS lookups.

Featured Post

Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now