Solved

Create a child domain under a domain tree

Posted on 2014-02-11
10
772 Views
Last Modified: 2014-02-12
I am trying to create a child domain under a tree root in Windows 2008 R2.

If I only use the forest root ip as the primary DNS, the server I am trying to promote has problem contacting tree root domain. If I put both forest root and tree root ip in primary DNS and secondary DNS, then I get the error: "Could not access a partition of the directory service located on a remote server. Make sure at least one server is running for the partition in question."

I followed the dcpromo wizard to create the forest root and the tree root, each of them has DNS server and only forest root contains GC. I have not specifically configured DNS namespaces.

So far I have not been able to find a solution to this problem or step to step instructions.

Any help would be greatly appreciated. Thanks!
0
Comment
Question by:chrisleester
  • 5
  • 3
  • 2
10 Comments
 
LVL 28

Expert Comment

by:becraig
ID: 39850845
To create a new child domain

    Click Start, click Run, and then type dcpromo to start the Active Directory Installation Wizard.

    On the Operating System Compatibility page, read the information and then click Next.

    If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

    On the Domain Controller Type page, click Domain controller for a new domain, and then click Next.

    On the Create New Domain page, click Child domain in an existing domain tree, and then click Next.

    On the Network Credentials page, type the user name, password, and user domain of the user account you want to use for this operation, and then click Next.

    The user account must be a member of the Enterprise Admins group.

    On the Child Domain Installation page, verify the parent domain and type the new child domain name, and then click Next.

    On the NetBIOS Domain Name page, verify the NetBIOS name, and click Next.

    On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next.

    On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location, and then click Next.

    On the DNS Registration Diagnostics page, verify the DNS configuration settings are accurate, and then click Next.

    On the Permissions page, select one of the following:

        Permissions compatible with pre-Windows 2000 server operating systems

        Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems

    On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the Administrator account for this server, and then click Next.

    Use this password when starting the computer in Directory Services Restore Mode.

    Review the Summary page, and then click Next to begin the installation.

    Restart the computer.



Reprinted from:
http://technet.microsoft.com/en-us/library/cc787706%28v=ws.10%29.aspx
0
 

Author Comment

by:chrisleester
ID: 39850874
Thanks becraig for the quick response! However, the procedure is only working for child domain under a forest root or its descendants.

The problem I am facing is when trying to create child domain under a tree root in the forest.
0
 
LVL 35

Expert Comment

by:Mahesh
ID: 39850945
Try below

Ensure 1st that name resolution is working between forest root domain and tree root domain

If required, create zone transfer between forest root domain and tree root domain
http://technet.microsoft.com/en-us/library/cc771652.aspx
http://social.technet.microsoft.com/Forums/en-US/790f3bab-11ba-46ef-8676-f42dd8b39f5d/how-to-do-a-dns-zone-transfer-from-windows-server-2008-to-windows-server-2003?forum=winservergen

Once you done above properly and both forest root and tree root started resolving properly from each other then,
Add your new server as member server to tree root domain
From there logon to new server with account that is having domain admins and enterprise admins group membership in forest root domain and then try dcpromo wizard
it will work

Mahesh
0
 
LVL 28

Expert Comment

by:becraig
ID: 39850986
If I read your post correctly your issue is contacting the DNS in the tree where you are creating the child domain.

You need to ONLY use the forest root for DNS until the server is already promoted.
0
 

Author Comment

by:chrisleester
ID: 39851014
Yes, becraig, I think the problem is with name resolution. I am trying to follow Mahesh's solution and then use only the forest root for DNS.

Thanks Mahesh and becraig.
0
Do email signature updates give you a headache?

Do you feel like all of your time is spent managing email signatures? Too busy to visit every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 

Author Comment

by:chrisleester
ID: 39852419
After I added an A record and SRV record in the forest root DNS, I am able to only use the forest root ip address and the primary DNS on the server I want to promote ad DC under the tree root. But afterwards, I still get the same error:

"Could not access a partition of the directory service located on a remote server. Make sure at least one server is running for the partition in question."
0
 
LVL 35

Expert Comment

by:Mahesh
ID: 39852437
You must be able to contact server hosting domain naming master if you want to promote new child domain under existing tree root domain.
Naming master role exists in forest root domain.

Have you configured secondary zones 1st?
Without name resolution between forest root and tree root this is not possible.

Then you need to add server as member server to tree root domain.
Then logon to that member server with account having domain admins and enterprise administrator of forest root domain.
Then you can promote new child domain.

Also download Portqueryui tool from MS to identify any AD network port issue

Mahesh
0
 

Author Comment

by:chrisleester
ID: 39852459
Mahesh,

Thanks so much for your quick response! I added an A record and SRV record in the forest DNS server. So the server to be promoted is able to contact both forest root and tree root domains.

But I missed "add server as member server to tree root domain" in your earlier comment. So now when I tried to join the server to the tree root, I got this error:

Changin the Primary Domain DNS name of this computer to "" failed. The name will remain "treeroot.com".

The specified server cannot perform the requested operation.

I will check out Portqueryui and see if it can give me more details.

Thanks,
Chris
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39852501
You don't need to add SRV records
The error you faced is common error. Ensure that new server is having latest service pack
In case of windows 2008 R2 its SP1
Can you check if new computer account is created in tree root domain ADUC for new member server.
Just reboot the new server once and check its FQDN (Computer name in My computer properties) if its reflects to tree root domain.
After reboot go to run and enter %logonserver% and hit enter.
This should resolved to tree root DC NetBIOS name.
If here you find error, then 1st you must resolve that with Portqueryui tool etc

Now go to forest root domain DNS server.
Go to main dns zone properties
On Zone Transfer Tab, enable zone transfer and select allow it to following server
Then add tree root DNS server IP there
Now go to Tree root domain controller DNS server, right click forward lookup zone and create new secondary zone
In secondary zone name enter root domain FQDN (Ex: rootdomain.com) and add root DNS server as master server.
Once you finished that forest root zone will be populated there as secondary zone

You need to do same steps on tree root domain to enable zone transfer pointing to forest root DC and you need to add secondary zone on forest root DC for tree root domain FQDN (treeroot.com)

Once you done that run below commands on both DC
ipconfig /flushdns
dnscmd /clearcache
Then check if both domains can resolve to each other

Then logon to that member server in forest root domain with account having domain admins and enterprise administrator of forest root domain
Then you can promote new child domain.

Mahesh
0
 

Author Comment

by:chrisleester
ID: 39855043
Mahesh,

It works now after following your detailed steps.

Thanks so much for your help!

Chris
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now