?
Solved

2nd domain controller dns records

Posted on 2014-04-01
10
Medium Priority
?
338 Views
Last Modified: 2014-04-03
We have 2 Windows 2008 server dc's in 2 AD sites. When I ping the 2nd dc (from my pc)it resolves the address of dc1. I noticed this yesterday and in the dns mmc on dc1 I manually entered the correct ip address of dc2 in the forward lookup zone: _msdcs.domain.local, also have a host A record for dc2 in domain.local with the wrong IP (auto updated itself) this morning. Why is this occurring? Dcdiag has errors,  (failed test Kccevent) and DS event log is full of 1311 and 1566 id's.
0
Comment
Question by:tcinfo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
10 Comments
 
LVL 15

Accepted Solution

by:
achaldave earned 2000 total points
ID: 39969249
Remove any static entry of domain controllers from the zone, try restarting netlogon services on both DCs, run ipconfig /registerdns from both DCs, if it doesn't fix try running dcdiag /fix and netdiag /fix.
0
 

Author Comment

by:tcinfo
ID: 39969856
In the forward lookup zone:

Are you saying remove the A records for the 2 servers in domain.local?   OR
In _msdcs.domain.local there are static NS entries; there are also static entries in userconnect.com and userconnect.com/bd/portal

Thank you.
0
 
LVL 15

Expert Comment

by:achaldave
ID: 39969955
I meant A record you manually created under _msdcs.domain.local also remove A record in domain.local if it is static.

If the records are not automatically created by any of the above method, post any DNS related errors logged by dcdiag/netdiag.

Check this link also

http://technet.microsoft.com/en-us/library/bb727055.aspx
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 

Author Comment

by:tcinfo
ID: 39970600
I did not create an A record in _msdcs.domain.local but modified the ip address of the 2nd dc in the NS record in that zone. I left that as is.

I deleted the host A record in domain.local for the 2nd dc, (it was showing the wrong IP) and then restarted netlogon on both dc's and ran ipconfig /registerdns on both.

Seen a new host record (A) was created for dc2 with the correct ip and after ipconfig /flushdns on my pc - pinging the the 2nd dc resolves the correct ip. So that is better thanks.

Dcdiag still has errors, related to KCC and Group Policy (cause for concern)? - attaching relevant snippet.
0
 
LVL 17

Expert Comment

by:Premkumar Yogeswaran
ID: 39971631
We do not find any file attached. You have did right process now.

For the DCDIAG error, i belive it should be fixed in certain replication interval.

If not paste the error you receive?

Thanks,
Prem
0
 

Author Comment

by:tcinfo
ID: 39972124
Dcdiag reports failed system log test and kcc errors, dns seems fine,
Directory-Server-Diagnosis.docx
0
 
LVL 15

Expert Comment

by:achaldave
ID: 39972287
Can you post detailed error messages from event viewer? The error can be caused by replication issue between domain controllers either due to Antivirus or firewall or corruption on domain controller.

Does both domain controller have same errors? If firewall or AV is not the issue and this is showing only one domain controller, try transferring FSMO roles to healthy domain controller, demote DC having issues, remove from domain, cleanup NTDS, rejoin to domain and promote it again.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/b9cf67b3-d9a0-4d7c-9456-ba23e3dcaf35/kerberos-and-frs-errors-after-upgrading-win2k3-dc-to-windows-2008?forum=winserverDS
0
 

Author Comment

by:tcinfo
ID: 39972784
Event viewer better today, yesterday though:

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          4/1/2014 4:10:57 PM
Event ID:      1311
Task Category: Knowledge Consistency Checker
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      SOMDC01.domain.LOCAL
Description:
The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
 
Directory partition:
CN=Configuration,DC=domain,DC=LOCAL
 
There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers.
 
User Action
Perform one of the following actions:
- Publish sufficient site connectivity information so that the KCC can determine a route by which this directory partition can reach this site. This is the preferred option.
- Add a Connection object to a directory service that contains the directory partition in this site from a directory service that contains the same directory partition in another site.
 
If neither of the tasks correct this condition, see previous events logged by the KCC that identify the inaccessible directory servers.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS KCC" />
    <EventID Qualifiers="49152">1311</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-01T20:10:57.795Z" />
    <EventRecordID>19797</EventRecordID>
    <Correlation />
    <Execution ProcessID="616" ThreadID="1860" />
    <Channel>Directory Service</Channel>
    <Computer>SOMDC01.domainLOCAL</Computer>
    <Security UserID="S-1-5-7" />
  </System>
  <EventData>
    <Data>CN=Configuration,DC=domain,DC=LOCAL</Data>
  </EventData>
</Event>


 
It's only on one DC.
0
 
LVL 15

Assisted Solution

by:achaldave
achaldave earned 2000 total points
ID: 39973379
Does it show any error after fixing DNS issue.
check this link for troubleshooting.
http://technet.microsoft.com/en-us/library/cc740252(v=ws.10).aspx
0
 

Author Closing Comment

by:tcinfo
ID: 39976121
The last technet link seems helpful (but applies to Win2008 server?) - I still have a Kcc error, but may open a separate question for it.
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article was originally published on Monitis Blog, you can check it here . Today it’s fairly well known that high-performing websites and applications bring in more visitors, higher SEO, and ultimately more sales. By the same token, downtime…
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …
Suggested Courses
Course of the Month8 days, 8 hours left to enroll

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question