Solved

Active Directory management console disconnected on Windows 2003

Posted on 2014-09-27
7
611 Views
Last Modified: 2014-10-02
Admittedly, I am way over my head here, but I hope someone will recognize this issue and be able to guide me.

I am running Active Directory on a Windows 2003 server.  I was adding a user to Active Directory and the AD stopped responding.  When I reopened AD in the Management Console I received a message that Naming information cannot be located because: the specified domain either does not exist or cannot be contacted.  (see file 1 attached)Active Directory error  I tried to reconnect AD to my domain (on the same server) and got a message that it could not connect to  the pre-Windows 2000 domain.

I then went to Active Directory Domains and Trusts in the Management Console and received an error message The configuration information describing the enterprise is not available.  The specified domain either does not exist or could not be contacted (see file 2 attached) Active Directory Domains and Trusts error.

Users are still able to log on to the domain so I am very reluctant to take any further steps without guidance.
0
Comment
Question by:mrken46
7 Comments
 

Author Comment

by:mrken46
ID: 40348222
I just checked the Event Viewer on the server and found these two errors that occurred at the time that I encountered the problem.  

Event Type:      Error
Event Source:      SAM
Event Category:      None
Event ID:      16651
Date:            9/26/2014
Time:            11:43:19 AM
User:            N/A
Computer:      QCSPDC
Description:
The request for a new account-identifier pool failed. The operation   will be retried until the request succeeds. The error is
 " The requested FSMO operation failed. The current FSMO holder could not be contacted.
 "

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type:      Error
Event Source:      SAM
Event Category:      None
Event ID:      16645
Date:            9/26/2014
Time:            11:44:38 AM
User:            N/A
Computer:      QCSPDC
Description:
The maximum account identifier allocated to this domain controller has been assigned. The domain controller has failed to obtain a new identifier pool. A possible reason for this is that the domain controller has been unable to contact the master domain controller. Account creation on this controller will fail until a new pool has been allocated. There may be network or connectivity problems in the domain, or the master domain controller may be offline or missing from the domain. Verify that the master domain controller is running and connected to the domain.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: a8 02 00 c0               ¨..À
0
 
LVL 17

Assisted Solution

by:Maen Abu-Tabanjeh
Maen Abu-Tabanjeh earned 125 total points
ID: 40348245
its possible to be DNS problem , check if you can ping domain domain.local , also check configuration in domain by using

nslookup and post results here ;)
0
 
LVL 19

Assisted Solution

by:Peter Hutchison
Peter Hutchison earned 250 total points
ID: 40348512
This is probably down the RID FSMO role, make sure it is assigned to working DC controller.
The RID role gives out blocks of SID values when creating new objects in AD, if its not available and the last block is used up then no more objects can be created.
If you cannot use the AD consoles, using the NTDSUtil command line tool to view and move the role to a DC.

https://support2.microsoft.com/kb/255504?wa=wsignin1.0
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 19

Assisted Solution

by:compdigit44
compdigit44 earned 125 total points
ID: 40348770
Can you run the following command and post results

DC diagnosis /v /e > c:\dcdiag.text
0
 

Author Comment

by:mrken46
ID: 40349179
jordannet

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator.QCSPS2>cd\

C:\>ipconfig

Windows IP Configuration


Ethernet adapter Intel Pro 1000 MT Gigabit Ethernet Adapter - Onboard:

   Connection-specific DNS Suffix  . : qcs.org
   IP Address. . . . . . . . . . . . : 10.0.0.6
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.0.0.1

C:\>ping qcs.org

Pinging qcs.org [10.0.0.6] with 32 bytes of data:

Reply from 10.0.0.6: bytes=32 time<1ms TTL=128
Reply from 10.0.0.6: bytes=32 time<1ms TTL=128
Reply from 10.0.0.6: bytes=32 time<1ms TTL=128
Reply from 10.0.0.6: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.6:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\>nslookup
Default Server:  qcspdc.qcs.org
Address:  10.0.0.6

>

compdigit44

I have attached the requested dcdiag.text file.  I see that it says "The server holding the PDC role is down." at the end of the file.  The PDC role is on this local server.  Could it be that a service has crashed on this box and all I need to do is reboot it?
dcdiag.txt
0
 
LVL 19

Accepted Solution

by:
Peter Hutchison earned 250 total points
ID: 40349410
I looks like you have two DCs: QCSPDC and QCSFS4 which has not replicated for over 60 days. Hence the Tombstone errors. All the FSMO roles look to be on QCSPDC, so it could do with a reboot.
IS QCSFS4 server up and running or is it an old server? It could have been setup as an additional DC server for resilience.
0
 

Author Comment

by:mrken46
ID: 40349728
QCSFS4 does not exist and has not for years. I reboot the server every two weeks however I have not done so since this problem started last week. I am hesitant to do so since it is still working - users are still able to log on the network, etc., I just can't manage it. I did not want to risk making things worse with a reboot. Do you think a reboot would fix issues I am having?
0

Featured Post

Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

939 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now