Solved

authentication failed after turning off one of DC's

Posted on 2012-03-19
12
163 Views
Last Modified: 2013-10-01
Hello,
My situation:
We have DC in Central Office and 5 DC's in branches. Two days ago we had maintenance works in Central Office and we disabled DC in HQ. After that authentication in branches was failed.
The question is: why?
What i did wrong with installation DC's in branches?

OS WIndows Server 2008 R2
0
Comment
Question by:Andrey_Gorohov
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
  • 3
  • +1
12 Comments
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 37737504
Do you have AD Sites setup? Is the other DCs pointing to themselves for DNS? Are the remove DCs Global Catalogs?
0
 
LVL 17

Expert Comment

by:James Haywood
ID: 37737873
The DC you removed was probably the only Global Catalog in the domain. Enable Branch Office DCs as Global Catalogs

Active Directory Sites and Services
Sites
Select Relevant DC
Right Click NTDS settings
General Tab, check 'Global Catalog'
0
 

Author Comment

by:Andrey_Gorohov
ID: 37738635
yes, we have AD Sites. about DNS i have to check...
they are all has GC role... that's why it's strange for me...
Actualy, i don't think they have to be GC for normal authentication. Authentication should work without GC role on DC.

btw
DC was not removed, it was disabled for some time. And till it was disabled authentication does not worked in branches.
0
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

 
LVL 29

Expert Comment

by:pwindell
ID: 37739306
Get the DC back up.
They aren't like other member servers,...you cannot leave them down.   Replication has to be maintained.    If you cross the tombstone period you'll make a mess out of everything.

Shutting down a DC almost always has side-effects.   DCs are not equal and they are not "fault-tolerant".  Apart from the Sites -vs- WAN links situation the main reason for multiple DCs is so that losing one does not lose the AD Database,...it is not so that you can loose one and "transparently" and smootly keep on going,...because that won't happen.   DCs are not "clusters" and they are not "arrays", nor do they act like they are one.
0
 

Author Comment

by:Andrey_Gorohov
ID: 37739397
Replication is OK! DC was down about 10 hours, it is not so big time to destroy replication...
The problem is authentication stoped working at the same time when we turned off one DC in CO...
How to check, where client was authenticated (to get access to some share for example)?
0
 
LVL 29

Expert Comment

by:pwindell
ID: 37739412
The command line echo %logonserver%  will show their logon server when you run that from their machine.
0
 

Author Comment

by:Andrey_Gorohov
ID: 37739426
Hm... logonserver is DC in branch...
I din't know what else i have to check... :(
0
 
LVL 17

Expert Comment

by:James Haywood
ID: 37739476
What authentication issues are you having?

Problems logging on?
Exchange/Sharepoint Issues?
0
 
LVL 29

Accepted Solution

by:
pwindell earned 300 total points
ID: 37739478
There are interdependencies between DCs.  They need to all be running at all times.   If one is going to be removed for a long period of time it needs to be DCPromo'ed to a Member Server so all the Roles gracefully move to other DCs and the DC identifiers are removed from DNS.   It can be DCPromo'ed back in when it is brought back.

I have never seen a DC be powered down for more than a few minutes without some level of disruption somewhere.  Even if it has no Roles and is not a GC,...it can still be the last DNS that a Client queried, and a DNS Client will always query the same DNS is did last time,...if it can't reach that DNS, at minimum, there will be a lag before the Client Side Resolver "gives up" and tries a different listed DNS.  So there is always going to be negative effects of a DC being down,...it is just a question of how much negative effects you will see.
0
 

Author Comment

by:Andrey_Gorohov
ID: 37739485
Yes. logging on problem. Share access problem... Exchange/Sharepoint did not check, but i thik will be the same....
0
 
LVL 17

Expert Comment

by:James Haywood
ID: 37739542
As pwindell says it sounds more like a DNS issue than a Kerberos issue. Can you confirm DNS settings on a couple of clients and see what is going on?

Can you also check if the DC that is offline has any of the FMSO roles?
0
 

Author Comment

by:Andrey_Gorohov
ID: 37739571
Ok... i'll check DNS on clients... Look's like you are right and the problem in DNS...
Now all DC's is online and DC which was offline has no FSMO role.
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Exchange 2010 mailbox move 7 51
Copy delete file if connection drops. 2 34
How to use Powershell data from SQL 151 62
Export AD group members. 1 25
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question