Unable to manually add a host record in Windows 2008 R2 DNS after DC Promo

Hi All,

      I have recently introduced a new Windows 2008 R2 DC in our Windows 2003 Domain Environment. I have a strange issue on adding a host A record on the new W2K8 R2 DC's DNS. Everytime I try to add a record, I would get the following error prompt:

The host record xxxx.mydomain.local cannot be created. Refused

If I look at the DNS event log on the W2K8 DC, it would show the following error event:

Event ID 4015 Source: DNS-Server-Service

The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "0000051B: AtrErr: DSID-030F1F8D, #1:
      0: 0000051B: DSID-030F1F8D, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor)". The event data contains the error.

---------------------------------------------------------------------------------------------------------------------------------------------------------


I can manually add the host record without any issue on the W2K3 DC, and it would replicated correctly to the W2K8 DC. Any idea how can I fix this issue?

Thank you.
livetsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Ben HartCommented:
I'd say run a dcdiag on both machines and compare the results.  Also a replmon (2008) and repadmin /showrepl (2003).  Verify there's no errors anywhere.

Also what's your functional level?
0
livetsAuthor Commented:
Hi Ben,

       Dcdiag on both W2K3 and W2K8 R2 dc pass without any error, repadmin /showrepl show success replication on both DC as well. My forest and domain functional level are Windows 2003.
0
Ben HartCommented:
Hmm.. did you move any FSMO roles to the 2008?  Did you run  adprep /forestprep and adprep /domainprep as well?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

livetsAuthor Commented:
I have move all FSMO to the W2K8 R2 DC, yes adprep has been ran.
0
livetsAuthor Commented:
The issue has been resolved after restarting active directory domain service.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ben HartCommented:
heh. I was going to ask you if you;d rebooted lately, but figured that'd have been a stupid question lol.
0
livetsAuthor Commented:
The solution was tested after restarting AD DS service, and it indeed fix the problem.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.