MS Exchange won't talk to AD now that AD switched from 2003 to 2008 DC

Put a new 2008R2 in place and made it a domain controller. Did the 5 FSMO roles and rebooted both controllers. I get errors in DCDiag. DCDiag states it cannot contact a GC but I have checked the AD Sites on NTDS it states the new 2008 is a GC and 2003 box is unchecked. Both have DNS running. Exchange did updates and rebooted. After the rebooted it will not talk to AD per the logs. I also ran the repadmin /syncall /APeD from 2008 because it is not on the 2003 box. I have changed the network card settings on 2003 so it points to 2008 for DNS and did the ipconfig /registerdns.
In DCDiag results on 2008 box:
Doing primary tests

   Testing server: Default-First-Site-Name\SERVER1
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\server.smhec.org, when
         we were trying to reach SERVER1.
         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
         ......................... SERVER1 failed test Advertising
      Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... SERVER1 passed test FrsEvent
      Starting test: DFSREvent
         ......................... SERVER1 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... SERVER1 passed test SysVolCheck
      Starting test: KccEvent
         ......................... SERVER1 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... SERVER1 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... SERVER1 passed test MachineAccount
      Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=ForestDnsZones,DC=smhec,DC=org
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
            Replicating Directory Changes In Filtered Set
         access rights for the naming context:
         DC=DomainDnsZones,DC=smhec,DC=org
         ......................... SERVER1 failed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\SERVER1\netlogon)
         [SERVER1] An net use or LsaPolicy operation failed with error 67,
         The network name cannot be found..
         ......................... SERVER1 failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... SERVER1 passed test ObjectsReplicated
      Starting test: Replications
         ......................... SERVER1 passed test Replications
      Starting test: RidManager
         ......................... SERVER1 passed test RidManager
      Starting test: Services
         ......................... SERVER1 passed test Services
      Starting test: SystemLog
         ......................... SERVER1 passed test SystemLog
      Starting test: VerifyReferences
         ......................... SERVER1 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
  Running enterprise tests on : smhec.org
     Starting test: LocatorCheck
        Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355
        A Global Catalog Server could not be located - All GC's are down.
        ......................... smhec.org failed test LocatorCheck
     Starting test: Intersite
        ......................... smhec.org passed test Intersite

Any help on this one please?
raleysm1Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

raleysm1Author Commented:
I just noticed 2008 box is missing the sysvol and netlogon shares
0
Emmanuel AdebayoGlobal Windows Infrastructure Engineer - ConsultantCommented:
Hi,

You might need to reset the burflags

Check the following link

http://blog.powerbiz.net.au/general/missing-sysvol-and-netlogon-during-migration/

Regards
0
raleysm1Author Commented:
on the exchange box I run: C:\>dcdiag /s:server1 /test:dns /v /e /f:dcdiag.log
the results:
Testing server: Default-First-Site-Name\SERVER1
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         The host daf9ecd3-7d0c-4e5f-922d-0a85ca397666._msdcs.smhec.org could not be resolved to an
         IP address.  Check the DNS server, DHCP, server name, etc
         ......................... SERVER1 failed test Connectivity

but if I try to ping that address in dos it pings and resolves to the correct server 192.168.1.6 = server1

later in the same log file:
DC: Server1.smhec.org
            Domain: smhec.org

                 
               TEST: Authentication (Auth)
                  Authentication test: Successfully completed
                 
               TEST: Basic (Basc)
                  Error: No LDAP connectivity
                  Error: No WMI connectivity
                  [Error details: 0x800706ba (Type: HRESULT - Facility: Win32, Description: The RPC server is unavailable.) - Connection to WMI server failed]

TEST: Authentication (Auth)
                  Authentication test: Successfully completed
                 
               TEST: Basic (Basc)
                   Microsoftr Windows Serverr 2008 Enterprise  (Service Pack level: 2.0) is supported
                  NETLOGON service is running
                  kdc service is running
                  DNSCACHE service is running
                  DNS service is running
                  DC is a DNS server
                  Network adapters information:
                  Adapter [00000006] Broadcom NetXtreme Gigabit Ethernet:
                     MAC address is 74:86:7A:D1:CE:26
                     IP address is static
                     IP address: 192.168.1.6, fe80::9143:90a3:355c:f1ad
                     DNS servers:
                        127.0.0.1 (<name unavailable>) [Valid]
                  Error: The A record for this DC was not found
                  [Error details: 1460 (Type: Win32 - Description: This operation returned because the timeout period expired.) - smhec.org]
                  The SOA record for the Active Directory zone was not found
                  The Active Directory zone on this DC/DNS server was found (primary)
                  Root zone on this DC/DNS server was not found

The A record does exist on 192.168.1.6 as an IP and Name (2 entries).
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

raleysm1Author Commented:
I have tried the D2 and D4 flags with no changes/success
0
Emmanuel AdebayoGlobal Windows Infrastructure Engineer - ConsultantCommented:
There is something wrong with the DNS settings, going by the logs.

What is result of the nslookup?. this will confirm if the reverse lookup is working.

Regards
0
raleysm1Author Commented:
I think the D4/D2 finally worked. I saw an update in events that old files were moved and new file sync was started
0
Emmanuel AdebayoGlobal Windows Infrastructure Engineer - ConsultantCommented:
Brilliant. Let's know the progress.

Regards
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
raleysm1Author Commented:
Well it took 3 attempts but it appears that now email is sync'ing since it found AD and the checkup passes now.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.