DCDIAG Fails: Server 2008 R2

My DCDIAG /test:dns fails: -

Performing initial setup:
   Trying to find home server...
   Home Server = MYDC
   * Identified AD Forest.
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\MYDC
      Starting test: Connectivity
        The host 85ed02bd-40b8-40b4-87e3-b317ae81f672._msdcs.MyDomain.com could
         not be resolved to an IP address. Check the DNS server, DHCP, server
         name, etc.

         Got error while checking LDAP and RPC connectivity. Please check your
         firewall settings.
         ......................... MYDC failed test Connectivity

This is one of 2 DC's

Can anyone help?
HKFueyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Abdul Khadja AlaoudineCommented:
Verify SRV records for DCs are registered correctly in DNS

Open elevated or administrator command prompt:

Type nslookup
Type set q=all
Type _ldap._tcp.dc._msdcs.domainname

In above example replace domainname with your domain name. Make sure the results have both the DCs' hostname and IP address
0
HKFueyAuthor Commented:
Hi Abdul, I get:
Server: unknown
Address: <server ip>
0
Abdul Khadja AlaoudineCommented:
1. Make sure those two DCs have 127.0.0.1 as primary DNS server.

2. Run from DCs below command (always in elevated or administrator command prompt)

ipconfig /registerdns

3. Then restart netlogon service on DCs

4. Go to DNS -- Forward Lookup Zone -- domain -- ensure DCs SRV records are there
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

HKFueyAuthor Commented:
OK, in DNS Forward Zone I can see: -

Name                              Type                            Data
Same as parent             SOA                             [177etc] , MyDC.Domain
Same as parent             NS                               MyDC1
Same as parent             NS                               MyDC2
MyDCName1                 Host(A)                       IP4 address
MyDCName2                 Host(A)                       IP4 address

I am running out of addresses in DHCP, and it is not configured for IP6. Could that be a problem?
0
DrDave242Commented:
Do another nslookup query, but this time, type the following:

nslookup
set q=all
85ed02bd-40b8-40b4-87e3-b317ae81f672._msdcs.<domainname>


What results do you get?
0
HKFueyAuthor Commented:
Hi DrDave,
I get: -
Server:  localhost
Address:  127.0.0.1

DNS request timed out.
    timeout was 2 seconds.
*** Request to localhost timed-out
0
DrDave242Commented:
Did you run that on the DC itself? If so, I'm not sure why it's timing out. Is its DNS Server service running?
0
footechCommented:
Check to see if replication is happening between DCs.  Run
repadmin \showrepl
or you could also use the Active Directory Replication Status Tool.
http://www.microsoft.com/en-us/download/details.aspx?id=30005

I would try reconfiguring the NIC so that it uses your other DC/DNS as preferred and itself as alternate (assuming they're in the same site).
How are the DCDIAG tests on the other DC?
0
HKFueyAuthor Commented:
repadmin /showrepl shows a lot of info but no errors "Last attempt @ 2014-10-17 09:59:25 was successful."

I tried adding DNS to another (2012) DC and get this error:

Event Type:      Error
Event Source:      DNS
Event Category:      None
Event ID:      500
Date:            17/10/2014
Time:            09:27:45
User:            N/A
Computer:      MyDC.Domain
Description:
The DNS server has detected that the zone _msdcs.Domain.com has invalid or corrupted registry data.  To correct the problem, you can delete the applicable zone subkey, located under DNS server parameters in the registry. You can then recreate the zone using the DNS console.  For more information, see "Tuning advanced server parameters" and "Add and Remove Zones" in the online Help.
0
DrDave242Commented:
This article recommends deleting the affected zone (_msdcs.domainname in your case), deleting its corresponding registry key, and recreating the zone from scratch. This might seem like a big deal, but since the _msdcs zone likely contains only dynamically registered records, it's really not. Just make sure to run the following commands on each of your domain controllers after recreating the zone:

ipconfig /flushdns
ipconfig /registerdns
net stop netlogon
net start netlogon


Alternatively, if you're worried about losing the records in the zone, you can export the zone to a file using the dnscmd /zoneexport zonename filename command, delete the zone from the registry, and recreate it from the file. Note that only a standard (non-AD-integrated) zone can be created from a file, but you can convert it to an AD-integrated zone after creation.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
HKFueyAuthor Commented:
Thanks all for trying to help. DCDIAG still has errors but DNS is working fine with no errors.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.