Exch 2010 loses connection to AD when old DC is shut down

I have an old Server 2003 machine that has been acting as the domain controller for the network. I installed a brand new Server 2008 R2 machine, joined it to the network, ran adprep32 on the old server to prepare it so I could elevate the 2008 server to a DC. Did all of that and it was successful. I transferred all of the FSMO roles over from the 2003 to 2008 server successfully. I changed the DNS settings on each server so that it points to the new 2008 DC first then the old one second. My Exchange 2010 server (separate 2008 R2 machine) works fine as long as the old 2003 DC is up and running. But once I shut it down, mail stops working. If I try to go to OWA, it lets me log in but then I get the message "A server that contains information about your user account and mailbox can't be found." It looks like the Exchange Server is not looking at the new DC.
stevenstrickAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KHSITCommented:
Did you update your domain controller settings inside of Exchange 2010?  If you didn't, go to Organization Configuration and then on the left colum, click Modify Configuration Domain Controller and force it to point to your 2008 DC.
0
KHSITCommented:
Sorry, I meant right column.
0
stevenstrickAuthor Commented:
Found it and made the change. But, I have a question. Shouldn't Exchange automatically look at the new DC without having me hard code it?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

KHSITCommented:
It should but I've found that most times it won't when the 2003 server is still in use. I would definately be careful when you completely remove the 2003 DC.  Make sure that after you run dcpromo to remove it that you check to make sure your Exchange is still running correctly.
0
KHSITCommented:
The easiest way to check before running dc promo is after making the above change, try shutting down the 2003 DC and then restart your exchange server.  After it comes back up you can verify that it still works  before removing the 2003 server completely.
0
stevenstrickAuthor Commented:
Thanks. I'll give that a go
0
KHSITCommented:
Just out of curiosity, did you migrate from Exchange 2003 to Exchange 2010?  I'm finding that most users with this issue went from 2003 directly to 2010 and skipped 2007.
0
stevenstrickAuthor Commented:
Yes we did. Migrated from Exchange 2003 to 2010
0
stevenstrickAuthor Commented:
So, after making that change, I shut down the old 2003 DC. Outlook clients in the office could no longer connect to Exchange and when I tried to use OWA, I could login but then I got the message, "A server that contains information about your user account and mailbox can't be found." I'm missing something here. Anyone have an idea?
0
Steven WellsSystems AdministratorCommented:
It sounds like your exchange environment is still referring to your old exchange 2003 server.  The exchange server information is an active directory object, which should be updated when mailboxes are migrated from exchange 2003.  Are there any DNS entries still pointing to your old exchange server or DC?
0
stevenstrickAuthor Commented:
That mailbox migration occurred a while ago with no issues.I have checked the DNS settings on the Exchange, old DC and new DC and they all point to the new DC first.
0
stevenstrickAuthor Commented:
In the EMC on the Exchange 2010 server in Server Configuration, Mailbox Properties, under System Settings, it is pointing to the old DC under Domain Controller servers being used by Exchange and Global Catalog server being used by Exchange.
0
Steven WellsSystems AdministratorCommented:
Confirm your new domain controller is global catalogue server?
0
stevenstrickAuthor Commented:
Confirmed.
0
Steven WellsSystems AdministratorCommented:
Have you rebooted exchange since dc removal?
0
Steven WellsSystems AdministratorCommented:
It would be useful to see if any errors are logged to event log.
0
stevenstrickAuthor Commented:
OK I checked my event manager on the Exchange 2010 box. MSExchangeDSAccess was showing both domain controllers with different result codes. My new DC had a code of 177100171 where it should be 188101171. Did some research and found that the SACL rights were not set on the new DC. On the new DC, went to Local Security Policy, expanded local policies, then user rights management. Checked Manage Auditing and Security Log and added Exchange Enterprise Servers and Exchange Servers groups. My Exchange Server now sees both DCs.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Steven WellsSystems AdministratorCommented:
Sounds like you are getting close. Everything should work now.
0
stevenstrickAuthor Commented:
have to wait to shut down the old DC to confirm.
0
Steven WellsSystems AdministratorCommented:
You will need to still de-dc promo the old one out. Exchange may also need rebooting to force the dc bindings to update.
0
stevenstrickAuthor Commented:
After doing some research online, I found the solution.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.