?
Solved

DNS issues, GPO errors

Posted on 2014-07-25
2
Medium Priority
?
167 Views
Last Modified: 2015-01-06
Good day

I have the following scenario:

I had a unknown name service record in my company DNS Forward lookup zone under the _msdcs (greyed out) folder. The record was in a unknown computer name format. I have attached the DCdiag results while the the rouge entry was present. During this time computers started giving problems with logging on. PC's where taking too long to present the user with the logon screen. I have attached log files with error codes recorded on the PC's in the event logs.

After i removed the entry, PC's seemed to be fine but this was only temporary as more users started to complain. I did some more research and discovered i was not supposed to delete the rouge entry but rather point it to the correct GC on our LAN. I did this and tested again, this seems to have solved the issue. I am still however getting calls from users who are complaining about slow PC's at logon and these PCs are complaining about DNS and GPOs in their event logs.

I have substituted the actual server name in the files as follows:

Actual DC name = Servername
Actual Domain name = Domainname
DCDiagFailed.txt
DCdiagPass.txt
Eventlogerrors.txt
0
Comment
Question by:Helao Mwapangasha
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 7

Expert Comment

by:tolinrome
ID: 40220468
Running this command on your DC would give more insight - dcdiag /e /v >>c:\dcdiag.txt - you can post the commands here if you like.

I'm not sure how your network is configured with DNS and AD, but you should have in AD sites and services your location(s) and its IP subnet range and all its physical DC's in that site.

All DC's should point to themselves and\or another domain controller IP address on their network card properties ipv4 ip address.
In DNS on the properties of your domain under the forward lookup zone on each tab make sure you have the right settings. Name server should list all the DC's and allow zone transfers.

Clients should have in their network card properties for ipv4 th eip addresses listed for the domain controllers for DNS. This is most likely given out with dhcp scope settings.

The more you tell us about your environment we can help.
0
 
LVL 37

Accepted Solution

by:
Mahesh earned 1500 total points
ID: 40221051
Do you have _msdcs.domain.com AD integrated zone present on domain controllers ?

If you have above zone in place (Its replicated to all DCs in forest), then you should have _msdcs greyed folder (its actually not greyed out, it is delegation to _msdcs.domain.com zone) and on every domain controller, it should point to NS record of that domain controller only)

However if you have deleted _msdcs.domain.com zone, you can simply delete that _msdcs delegation (greyed out folder) from domain.com and restart netlogon service on any one DC
What it will do, it will delete _msdcs delegation from all DCs as part of AD replication and create _msdcs folder under domain.com and it will get replicated to all domain controllers and you will be just fine.

U need to ensure that whatever changes you make on one DC should get replicated to all DCs in domain.
Check below thread for more details
http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_28415910.html
0

Featured Post

Optimum High-Definition Video Viewing and Control

The ATEN VM0404HA 4x4 4K HDMI Matrix Switch supports 4K resolutions of UHD (3840 x 2160) and DCI (4096 x 2160) with refresh rates of 30 Hz (4:4:4) and 60 Hz (4:2:0). It is ideal for applications where the routing of 4K digital signals is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When asking a question in a forum or creating documentation, screenshots are vital tools that can convey a lot more information and save you and your reader a lot of time
Ever visit a website where you spotted a really cool looking Font, yet couldn't figure out which font family it belonged to, or how to get a copy of it for your own use? This article explains the process of doing exactly that, as well as showing how…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question