Solved

Create a child domain under a domain tree

Posted on 2014-02-11
10
794 Views
Last Modified: 2014-02-12
I am trying to create a child domain under a tree root in Windows 2008 R2.

If I only use the forest root ip as the primary DNS, the server I am trying to promote has problem contacting tree root domain. If I put both forest root and tree root ip in primary DNS and secondary DNS, then I get the error: "Could not access a partition of the directory service located on a remote server. Make sure at least one server is running for the partition in question."

I followed the dcpromo wizard to create the forest root and the tree root, each of them has DNS server and only forest root contains GC. I have not specifically configured DNS namespaces.

So far I have not been able to find a solution to this problem or step to step instructions.

Any help would be greatly appreciated. Thanks!
0
Comment
Question by:chrisleester
  • 5
  • 3
  • 2
10 Comments
 
LVL 29

Expert Comment

by:becraig
ID: 39850845
To create a new child domain

    Click Start, click Run, and then type dcpromo to start the Active Directory Installation Wizard.

    On the Operating System Compatibility page, read the information and then click Next.

    If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.

    On the Domain Controller Type page, click Domain controller for a new domain, and then click Next.

    On the Create New Domain page, click Child domain in an existing domain tree, and then click Next.

    On the Network Credentials page, type the user name, password, and user domain of the user account you want to use for this operation, and then click Next.

    The user account must be a member of the Enterprise Admins group.

    On the Child Domain Installation page, verify the parent domain and type the new child domain name, and then click Next.

    On the NetBIOS Domain Name page, verify the NetBIOS name, and click Next.

    On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next.

    On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location, and then click Next.

    On the DNS Registration Diagnostics page, verify the DNS configuration settings are accurate, and then click Next.

    On the Permissions page, select one of the following:

        Permissions compatible with pre-Windows 2000 server operating systems

        Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems

    On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the Administrator account for this server, and then click Next.

    Use this password when starting the computer in Directory Services Restore Mode.

    Review the Summary page, and then click Next to begin the installation.

    Restart the computer.



Reprinted from:
http://technet.microsoft.com/en-us/library/cc787706%28v=ws.10%29.aspx
0
 

Author Comment

by:chrisleester
ID: 39850874
Thanks becraig for the quick response! However, the procedure is only working for child domain under a forest root or its descendants.

The problem I am facing is when trying to create child domain under a tree root in the forest.
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 39850945
Try below

Ensure 1st that name resolution is working between forest root domain and tree root domain

If required, create zone transfer between forest root domain and tree root domain
http://technet.microsoft.com/en-us/library/cc771652.aspx
http://social.technet.microsoft.com/Forums/en-US/790f3bab-11ba-46ef-8676-f42dd8b39f5d/how-to-do-a-dns-zone-transfer-from-windows-server-2008-to-windows-server-2003?forum=winservergen

Once you done above properly and both forest root and tree root started resolving properly from each other then,
Add your new server as member server to tree root domain
From there logon to new server with account that is having domain admins and enterprise admins group membership in forest root domain and then try dcpromo wizard
it will work

Mahesh
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 29

Expert Comment

by:becraig
ID: 39850986
If I read your post correctly your issue is contacting the DNS in the tree where you are creating the child domain.

You need to ONLY use the forest root for DNS until the server is already promoted.
0
 

Author Comment

by:chrisleester
ID: 39851014
Yes, becraig, I think the problem is with name resolution. I am trying to follow Mahesh's solution and then use only the forest root for DNS.

Thanks Mahesh and becraig.
0
 

Author Comment

by:chrisleester
ID: 39852419
After I added an A record and SRV record in the forest root DNS, I am able to only use the forest root ip address and the primary DNS on the server I want to promote ad DC under the tree root. But afterwards, I still get the same error:

"Could not access a partition of the directory service located on a remote server. Make sure at least one server is running for the partition in question."
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 39852437
You must be able to contact server hosting domain naming master if you want to promote new child domain under existing tree root domain.
Naming master role exists in forest root domain.

Have you configured secondary zones 1st?
Without name resolution between forest root and tree root this is not possible.

Then you need to add server as member server to tree root domain.
Then logon to that member server with account having domain admins and enterprise administrator of forest root domain.
Then you can promote new child domain.

Also download Portqueryui tool from MS to identify any AD network port issue

Mahesh
0
 

Author Comment

by:chrisleester
ID: 39852459
Mahesh,

Thanks so much for your quick response! I added an A record and SRV record in the forest DNS server. So the server to be promoted is able to contact both forest root and tree root domains.

But I missed "add server as member server to tree root domain" in your earlier comment. So now when I tried to join the server to the tree root, I got this error:

Changin the Primary Domain DNS name of this computer to "" failed. The name will remain "treeroot.com".

The specified server cannot perform the requested operation.

I will check out Portqueryui and see if it can give me more details.

Thanks,
Chris
0
 
LVL 36

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39852501
You don't need to add SRV records
The error you faced is common error. Ensure that new server is having latest service pack
In case of windows 2008 R2 its SP1
Can you check if new computer account is created in tree root domain ADUC for new member server.
Just reboot the new server once and check its FQDN (Computer name in My computer properties) if its reflects to tree root domain.
After reboot go to run and enter %logonserver% and hit enter.
This should resolved to tree root DC NetBIOS name.
If here you find error, then 1st you must resolve that with Portqueryui tool etc

Now go to forest root domain DNS server.
Go to main dns zone properties
On Zone Transfer Tab, enable zone transfer and select allow it to following server
Then add tree root DNS server IP there
Now go to Tree root domain controller DNS server, right click forward lookup zone and create new secondary zone
In secondary zone name enter root domain FQDN (Ex: rootdomain.com) and add root DNS server as master server.
Once you finished that forest root zone will be populated there as secondary zone

You need to do same steps on tree root domain to enable zone transfer pointing to forest root DC and you need to add secondary zone on forest root DC for tree root domain FQDN (treeroot.com)

Once you done that run below commands on both DC
ipconfig /flushdns
dnscmd /clearcache
Then check if both domains can resolve to each other

Then logon to that member server in forest root domain with account having domain admins and enterprise administrator of forest root domain
Then you can promote new child domain.

Mahesh
0
 

Author Comment

by:chrisleester
ID: 39855043
Mahesh,

It works now after following your detailed steps.

Thanks so much for your help!

Chris
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question