Solved

After Renaming Domain (RENDOM) there is a DNS issue.

Posted on 2014-09-18
16
992 Views
Last Modified: 2014-09-22
Background:   Set up a new server, new forest, new domain.    It is the only server in the network/domain/forest.
I used the company's registered name:   mycompany.com as the name of the domain.    Bad move :(      The company's web site is hosted on a remote hosting site (OK - I just redirect to the remote site).   However, internal to the code of the website are all the links which reference mycompany.com/directory/file.      So, no problem for  remote users - but for the internal LAN users, everytime they would go to their own web site, it would not work properly.   DNS on my new server would point to the inhouse server (which does NOT have any of these files).

Attempted Solution:  Used RENDOM and ran through the process to rename the domain from mycompany.com to mycompany.local.        Process worked and problem appeared to be solved.  

Problem:  However, when I ran DCDIAG it claims that this server fails the Connectivity test.   Specifically, it says that the host:  <GUID>._msdcs.mycompany.local could not be resolved to an IP address.   When I look in the DNS tables, I see the mycompany.local in the Forward Lookup Zone.  (Note: I deleted the mycompany.com which was previously there).    However, in the mycompany.local zone, I see lots of references to mycompany.COM -- as if there are still buried references to the old domain name.

Question:  How can I fix and/or cleanup DNS so that DCDIAG is happy?       Are these references to mycompany.com in the mycompany.local lookup zone OK?        TIA!!!
0
Comment
Question by:ponedog
  • 10
  • 5
16 Comments
 
LVL 7

Expert Comment

by:tankergoblin
ID: 40330515
yeah you cannot just simply change the name like that. as the previous name is point to your ip.

the simplest way i can think of is remove dns role and recreate it.
0
 

Author Comment

by:ponedog
ID: 40330534
So, If I remove DNS and reboot - do I need to delete any files?

Then I just add back that role ?    Will it recreate everything including the Active Directory interface ?
0
 

Author Comment

by:ponedog
ID: 40330596
Hmmm...   I removed DNS on the server.    I have NOT re-installed DNS yet.    I run DCDIAG and get the exact same problem -- Server failed test Connectivity.    The host <guid>._msdcs.mycompany.local could not be resolved to an IP address.

Then I re-installed DNS.     Everything continues to work properly.   However DCDIAG continues to give the same message -- Server failed test Connectivity.  The host <guid>._msdcs.mycompany.local could not be resolved to an IP address.

Any other ideas ?
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40330605
You should clean all metadata for the previous name from your AD and do some steps to also rename your DNS server.
You can check a nice how to here.

For metadata Cleanup check this link

Hope it helps.
0
 

Author Comment

by:ponedog
ID: 40330617
Another tidbit of information:   At a command prompt, if I ping <local server name>, it resolves to the correct IP but shows that FQDN as <local server name>.mycompany.COM        

In the DNS registry, I see the SOA (start of Authority) records all referring to the <local server name>.mycompany.COM        

So, it appears that buried somewhere in active directory is still a reference to mycompany.COM as the root authority.

Where would one change that ?   ADSIedit ?
0
 

Author Comment

by:ponedog
ID: 40330631
Thanks David for those links.   The first link is the one that I used to rename my domain.  

One of the problems I am worried about is that I am only changing the extension of my domain -- going from .COM to .LOCAL               Don't know if that caused my problem or not.

The second link I scanned quickly - I am uncertain if it applies to my situation.  I will review it more closely later...

Thanks again.
0
 

Author Comment

by:ponedog
ID: 40330742
When I go to "Active Directory and Computers", under mycompany.local --> Domain Controllers --> server

The properties of this server shows it has a DNS name of:  server.mycompany.COM    

This appears to be the root of the problem - the name of the only server and only domain controller is still referring to the .COM extension.

It will not let me change it - also, under NTDS Settings it does have a DNS alias of: <guid>._msdcs.mycompany.local

Not sure how to proceed - or even if the DCDIAG error is significant . . .
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40330759
You can create a New Zone in your DNS server and named her for mycompany.local

I´m saying this because you can change all the records for pointed to the new name mycompany.local, but some of created properties can´t be changed straight forward.

That´s why I pointed to you the first link, you should follow that link.

But if you can remove the DNS Role and afterwards  install it again, this will be the best option. Because you will not mess with LDAP and it´s a fresh start for that role and the _msdcs.mycompany.local will be created from the start .

The down point will be you will loose all the  name resolution for the FQDN, and all clients will need to re-register there address´s and probably most of your services that require names resolution will fail.

You can change from mycompany.com to mycompany.local that is not the issue.

This is a new Domain?
Do you already have clients registered in this Domain?
The user´s can logon successfully?

Hope it helps
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:ponedog
ID: 40331940
David,

I have removed the DNS role, rebooted, re-installed the DNS role and this is where I am...    Everything seems to work except for the DCDIAG error.      And, I do not know if that is significant or not...

Note that the DCDIAG error occurs EVEN when the DNS role has been removed from the domain controller.

I'm still puzzled....
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40332321
Hi Ponedog,

In the AD Directory Services, the old server(name.mycompany.com) is present?

In the command line use this command:
ntdsutil [Enter]
metadata cleanup[Enter]
remove selected server name.company.com

Let me know if helped
0
 

Author Comment

by:ponedog
ID: 40332399
David,

As suggested in ntdsutil, "remove selected server name.company.com"  resulted in an error:

"Binding to localhost . . .
Connected to localhost using credentials of locally logged on user.
LDAP error 0x22(34 (Invalid DN Syntax).
Ldap extended error message is 0000208F: NameErr: DSID-03100225, problem 2006 (BAD_NAME), data 8350, best match of:
CN=Ntds Settings,server.company.com'
Win32 error returned is 0x208f(The object name has bad syntax.)
Unable to determine the domain hosted by the Active Directory Domain Controler (5).  Please use the connection menu to specify it."
0
 

Author Comment

by:ponedog
ID: 40332444
BTW, just for grins I tried to put in an A record (host record) with the <guid>_msdcs.mycompany.local

It wouldn't let me - since there is already this entry in the subkey (under mycompany.local) called _msdcs (which is grayed out for what it is worth).

The _msdcs subkey has only 1 entry - a NS (Name Server) record - which gives the FQDN of the Name Server as:
server.mycompany.COM

Again - it seems to be saying that the "real" FQDN of the domain server has the .COM extension -- which is indeed the original name when I created the forest/domain/server.

OK - I have taken the "dummy" step of editing C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS
I have added the line:
192.168.20.20     <guid>._msdcs.mycompany.local

It does in fact "cure" the error I was getting when I ran DCDIAG.        The more extensive running of: DCDIAG /test:DNS gives errors when it runs the enterprise tests.  

This leads me to the following insight:      The Forest Name and Domain Name were BOTH originally mycompany.COM       Changing the DOMAIN name with rendom did NOT change the FOREST name.     The Domain Controller is still:   server.<forestname>    where forestname ends in .COM.

So my concern now is:  when I add a second domain controller to the domain, will it be able to replicate between the controllers without any problems....  

Any thoughts ?
0
 
LVL 12

Accepted Solution

by:
David Paris Vicente earned 500 total points
ID: 40332846
Right, the NetBIOS Name it´s the same that's why I wrote name.mycompany.com and must be  only the NetBIOS name. That´s why you received the bad syntax, so let´s forget for a bit the ntdsutil.

On your dns server change all the records to the domain.local


Did you check the Active Directory Sites and Services to see if are any reference to the same NetBIOS name but with the old domain name?

How many DC's do you have?

Can you install another DC?
0
 

Author Comment

by:ponedog
ID: 40333458
David,

In the Active Directory Sites & Services:     Sites --> Default-First-Site-Name --> Servers --> myServer -->  DNS settings (type: msDNS-ServerSettings) --> Properties --> Attribute Editor Tab     there is an attribute: msDNS-KeymasterZones  where the value only includes references to the .COM (not the .local).    

I have no idea if I can safely change these attributes to .local - ie, what are the consequences !!

BTW, I do not have another DC to install.
0
 

Author Comment

by:ponedog
ID: 40335816
My resolution:    I went to add a PC into the domain and realized that it could not "find" the Domain Controller (even though the DNS was pointing to the IP address of the Domain Controller).

At this point, it was:   solve the problem by brute force.

I uninstalled the Domain Services - telling the system that it was the last Domain Controller in the forest.   Then I re-booted (logging in locally).   It appeared to my untrained eye that there were still Domain Services running - so, I uninstalled again (pretty sure this is an intentional 2 step process) and finally rebooted the Server as not part of any domain, no DNS, and just a local Windows Server.
Then I re-installed the Domain Services being careful to call it mycompany.local.     Note: when it are adding the 1st Domain in a Forest, it DOES tell you that this first domain name will also be the name of the forest - I had not noticed that before :(    !!!    

So, then I rebuilt everything back...    Adding Organization Units, Users, Security Groups, Group Policies, Network Shares and Rights, etc.

It is up and working.      My conclusion is this:   rendom can work fine for renaming domains within a forest, but, should be avoided in my "simple" situation with just 1 domain in 1 new forest.    Also, I think that my concern with seeing mycompany.com in DNS may have been misplaced - it was probably just a reference to the forest name.    I probably messed up DNS trying to fix things and that may be why I could not add users into the domain after the RENDOM process was attempted.

Points to David for his excellent assistance!!!   Thanks    :)
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40336206
Hi ponedog,

Sorry for the late response, but I was out this Weekend.

But I´m glad to ear that you could solved the issue.

Thank you for the comment.

Regards
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

In my previous 24 VMware Articles (http://www.experts-exchange.com/ARTH_1864316.html?arthOrderBy=3&arthSort=1#arth), most featured Intermediate VMware Topics. My next series of articles concentrated on topics for the VMware Novice;   If you would…
I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
In this Micro Tutorial viewers will learn how to use Windows Server Backup to create full image of their system. Tutorial shows how to install Windows Server Backup Feature on Windows 2012R2 and how to configure scheduled Bare Metal Recovery backup.…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now