Solved

Making a MS 2008 DNS server the authority for a domain

Posted on 2012-04-02
20
431 Views
Last Modified: 2012-04-06
Hi

I have an AD domain that originally had one Win 2003 Server as the only DC for the domain. This server also provided DHCP, and Wins services. I want to remove it from the domain as it is starting to fail.

In preparation for this I have a new MS 2008 Server that I have successfully joined to the AD and used DCpromo to make the new 2008 server a Domain controller.

The migration of the DNS and roles also worked fine as part of this process.

I now want to remove the 2003 server from the domain and make the 2008 server the primary authority for one of the domains that it manages the DNS for. At present it thinks the 2003 server is the primary authority for this domain, which is correct.

Can anyone tell me how to go about configuring the 2008 server DNS for that domain so it will act as the primary authority ?.

Thanks heaps in advance
0
Comment
Question by:johnkan
  • 13
  • 6
20 Comments
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 37802613
So are you going to use this for internet DNS or just internal? If Internet does the register have your IP to your firewall or DMZ pointing to your Windows DNS Server?

It's pretty cut and dry

http://technet.microsoft.com/en-us/library/cc770984.aspx

Once you get all the records on both DNS servers your can dcpromo the 2003 machine and start removing the services.  Do you have a 2nd machine for your DC, DNS, etc as backup?
0
 

Author Comment

by:johnkan
ID: 37803437
Hi DMTechGrooup

In this case the DNS is being used just for the internal network. Some records in it are required to make the Mail server work properly.

We have 2 new 2008 Servers that will become the new DC's and DNS servers.

One of these 2008 Servers has already been DCpromo'd and is serving as a backup. It has all of the DNS records and is also providing DHCP services.

Thanks heaps
0
 
LVL 26

Expert Comment

by:MidnightOne
ID: 37803678
Make sure the existing 2003 DNS server is removed from DHCP assignments. If there are any other static IP adddress assignments (router,s switches, printers and/or other servers) inspect their settings to confirm they point only to the new Windows 2008 DC.

Other than that, there isn't a primary assignment is you're using AD-integrated DNS. If you're still using primary/secondary, confirm the Windows 2008 server has all the DNS records, change the type of DNS server on the Windows 2008 to Primary, and disable DNS server service on Windows 2003.

If it all runs right, you can decommission DNS on Windows 2003. If there's ANY issue, you can bring the Windows 2003 DNS back online and move the Windows 2008 server back to a secondary.
0
 

Author Comment

by:johnkan
ID: 37803715
Ah ok.

Where do I set the DNS server on my mew 2008 server to primary ?. I did a bit of a hunt around but missed it.

Thanks heaps
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 37804026
In an active directory environment there is not a primary and secondary.. they are both considered equal so as long as all the records are there thats in the 2003 one then you are good.
0
 

Author Comment

by:johnkan
ID: 37809454
Hi

When I disconnect the 2003 domain controller I dont seem to get proper name resolution even though I have the DNS records set up on the new 2008 server as per the 2003 dns server I am wanting to disconnect.

Anything else I should check on the new 2008 server ?

Not sure if this is related but my login scripts are not run when I log in with just the new 2008 server running. They seem to run when the 2003 server is connected to the network though.

Thanks heaps
0
 

Author Comment

by:johnkan
ID: 37809641
Hello

As soon as I disconnect the original 2003 server then the 2008 server cant get any of the user or computer information at all. It gives me a message about not being able to contact the 2003 domain controller.

My 2008 server is being seen as a domain controller but doesnt seem to function as one if the 2003 server is not connected as well.

The 2003 server is starting to fail more regularly now, so I really need to get the 2008 server functioning as a domain controller fast.

Help!!

Thanks in advance
0
 
LVL 24

Accepted Solution

by:
DMTechGrooup earned 500 total points
ID: 37812616
Do you have forwarders set in the DNS of the 2003 machine for internet or does it do its own lookup?

http://technet.microsoft.com/en-us/library/ff807391(v=ws.10).aspx

As for the AD, you need to make sure the new server has all the FSMO roles as well.

http://www.petri.co.il/transferring_fsmo_roles.htm

As stated above, have you adjusted the DHCP to provide the new server as the primary DNS server? and any static machines need to be manually set as well.
0
 

Author Comment

by:johnkan
ID: 37814339
Hi DMTechgroup

the 2008 server is providing the DHCP server ok. When I run an IPCONFIG /ALL on the workstations, they report the correct settings stating the new 2008 server IP is the first DNS entry.

The DNS on the 2003 server is functioning correctly, when its on and connected to the network, so I'm guessing its ok as it is.

It sounds like I haven't transferred the FSMO roles. I thought this might have been done when I performed the DCPromo on the 2008 server.

I will try this and let you know how it turns out.

Thanks heaps
0
 

Author Comment

by:johnkan
ID: 37814533
Hi DMTechgroup.

Ok, I have successfully completed the transfer of the 5 FSMO roles to the new 2008 Server

From the 2008 server I can open the Users and Computers MMC and see the users and computers.

When I look at Domain Controllers I see the 2003 server is a DC but the new 2008 server is a GC, I'm guessing it needs to be a DC also as I want it to authentic log ins and runs login scripts from the new 2008 server.

Is this correct ?

Thanks heaps
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 37814580
GC is global catalog.. you 2008 server should be the main server

http://blogs.dirteam.com/blogs/sanderberkouwer/archive/2009/09/23/how-to-tell-whether-it-s-a-server-core-domain-controller.aspx

It wouldnt transfer the FSMO roles to it if it were not.

Also go to run command.. type \\<2008servername\ and hit ok.. does it have a SYSVOL directory.. if it does in the scripts folder are your login scripts there?

Try running this from a few computers to see which DC they logged onto.

http://www.ehow.com/how_5606792_determine-domain-controller-pc-using_.html
0
 

Author Comment

by:johnkan
ID: 37814658
Hello DMTechgroup

The l;ogon server is \\server2008, which just to confuse things is the 2003 server, the old one we want to get rid of.

How can I change this to the new 2008 server ?.

Not sure if this is relevant but the pre-windows 2000 domain name I am logging into does not have the '.local' bit at the end of it where as the domain everywhere else has the '.local' included.

Thanks heaps
0
 

Author Comment

by:johnkan
ID: 37814757
Hello DMTechgroup

I think I may have a clue as to why the new 2008 server is not acting as a PDC.

I checked the Server Manager Active Directory Domain services status and saw some errors.

The message is...

"This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.
 
Operations which require contacting a FSMO operation master will fail until this condition is corrected. "

This states it may impact on the PDC operations of the new 2008 server.

How can I force a full replication so the role can be validated ?.

Thansk heaps
0
 

Author Comment

by:johnkan
ID: 37814806
Hello DMTechgroup

Looks like the replication of the AD is not completing due to a DNS error.

The message I get when I try to force a replication of the AD is...

'The DSA operation is unable to proceed due because of a DNS lookup failure.'

When I look at the logs an error states...

'Name resolution for the name <domain name>.local timed out after none of the configured DNS servers responded.'

As the DNS was migrated from the 2003 server, I'm not sure what it is that it cant resolve

Thanks heaps
0
 

Author Comment

by:johnkan
ID: 37814936
Hi DMTechgroup

Seems there was a DNS entry deep in the bowels of the DNS that was causing this conflict.

Suddenly, under Sites and Services the 2003 and 2008 DC;s began to communicate and the replication completed. Which meant the 2008 Server became a fully functional PDC.

Now just need to resolve the final DNS problem causing the mail server to be uncontactable.

Thanks heaps for you good answers
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 37815024
Where is the mail server not contacted from? the outside world?  If so you firewall should be pointing the ports directly to the ip of the mail server.
0
 

Author Comment

by:johnkan
ID: 37815071
Hi DMTechgroup

Oddly enough from outside is fine, its from inside.

I can ping is FQDN and get the correct IP back but Outlook states it cant find it  using its FQDN

If I add a local record to the host file on the workstation it works fine.

Thanks heaps
0
 
LVL 24

Expert Comment

by:DMTechGrooup
ID: 37815188
do some nslookups from a workstation and verify there is an a record for the server
0
 

Author Comment

by:johnkan
ID: 37815341
hi DMTechgroup

Will Do.

I think its all good from here.

Thanks heaps for your efforts.
0
 

Author Closing Comment

by:johnkan
ID: 37815343
Excellent advice
thanks heaps
0

Featured Post

Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

Join & Write a Comment

Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found here: http://www.experts-exchang…
Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now