Solved

DNS issues, GPO errors

Posted on 2014-07-25
2
159 Views
Last Modified: 2015-01-06
Good day

I have the following scenario:

I had a unknown name service record in my company DNS Forward lookup zone under the _msdcs (greyed out) folder. The record was in a unknown computer name format. I have attached the DCdiag results while the the rouge entry was present. During this time computers started giving problems with logging on. PC's where taking too long to present the user with the logon screen. I have attached log files with error codes recorded on the PC's in the event logs.

After i removed the entry, PC's seemed to be fine but this was only temporary as more users started to complain. I did some more research and discovered i was not supposed to delete the rouge entry but rather point it to the correct GC on our LAN. I did this and tested again, this seems to have solved the issue. I am still however getting calls from users who are complaining about slow PC's at logon and these PCs are complaining about DNS and GPOs in their event logs.

I have substituted the actual server name in the files as follows:

Actual DC name = Servername
Actual Domain name = Domainname
DCDiagFailed.txt
DCdiagPass.txt
Eventlogerrors.txt
0
Comment
Question by:Helao Mwapangasha
2 Comments
 
LVL 7

Expert Comment

by:tolinrome
Comment Utility
Running this command on your DC would give more insight - dcdiag /e /v >>c:\dcdiag.txt - you can post the commands here if you like.

I'm not sure how your network is configured with DNS and AD, but you should have in AD sites and services your location(s) and its IP subnet range and all its physical DC's in that site.

All DC's should point to themselves and\or another domain controller IP address on their network card properties ipv4 ip address.
In DNS on the properties of your domain under the forward lookup zone on each tab make sure you have the right settings. Name server should list all the DC's and allow zone transfers.

Clients should have in their network card properties for ipv4 th eip addresses listed for the domain controllers for DNS. This is most likely given out with dhcp scope settings.

The more you tell us about your environment we can help.
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 500 total points
Comment Utility
Do you have _msdcs.domain.com AD integrated zone present on domain controllers ?

If you have above zone in place (Its replicated to all DCs in forest), then you should have _msdcs greyed folder (its actually not greyed out, it is delegation to _msdcs.domain.com zone) and on every domain controller, it should point to NS record of that domain controller only)

However if you have deleted _msdcs.domain.com zone, you can simply delete that _msdcs delegation (greyed out folder) from domain.com and restart netlogon service on any one DC
What it will do, it will delete _msdcs delegation from all DCs as part of AD replication and create _msdcs folder under domain.com and it will get replicated to all domain controllers and you will be just fine.

U need to ensure that whatever changes you make on one DC should get replicated to all DCs in domain.
Check below thread for more details
http://www.experts-exchange.com/Software/Server_Software/Active_Directory/Q_28415910.html
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
If you need to start windows update installation remotely or as a scheduled task you will find this very helpful.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now