Missing GC SRV record for DNS server

On my DC server "BranchDC1" (Server 2008 R2 Core), I am getting the following error:
\>dcdiag /test:dns /e

        TEST: Records registration (RReg)
           Network Adapter [00000000] Microsoft Virtual Machine Bus Network Adapter:
              Warning:
              Missing SRV record at DNS server 10.2.100.121:
              _ldap._tcp.gc._msdcs.mydomain.com

        Error: Record registrations cannot be found for all the network adapters

My other branch office DCs do not throw this error. The IP address shown above is for BranchDC's replication partner in the data center, "HQDC1."

BranchDC1 was just re-added to the domain and re-promoted, after being demoted and removed for a few weeks while the branch office was being relocated.

I've been checking a lot of things. And the only thing I can find wrong is that HQDC1 is missing the _ldap SRV record for BranchDC1 under Forward Lookup Zones/mydomain.com/_msdcs/gc/_sites/BranchSiteName/_tcp. It is present in this location on BranchDC1.  

How can I get it to auto-generate this record?

I tried nltest /dsregdns.
I have tried registerdns, stop/start netlogon. I swapped order of DNS servers on BranchDC1's NIC (pointing to itself and HQDC1), and performed those steps again.
I checked netlogon.dns on BranchDC1 and it looks right (compared it to others). No other SRV records appear to be missing from anywhere else that I've found thus far.
Replication looks good.
The BranchDC1 server is checked as a GC in AD Sites and Services.

Doing dcdiag /fix passes all tests, except NCSecDesc, which all of our DCs fail, but I think this can be ignored.

Thanks in advance for your help.
LVL 1
ctp_mackdaddiesAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arnoldCommented:
run dcdiag look at the event log to see whether it has issues, check sites and services to make sure the system is set as a GC under AD sites and services, ntds properties.

Usually, when moving, there is no need to remove the system from the AD, but simply move and then it will reestablish a connection.  ....
0
ctp_mackdaddiesAuthor Commented:
I removed it because it was going to be offline for at least 3 weeks, maybe longer.
Under NTDS Settings Properties for the BranchDC1 server in AD Sites and Services, Global Catalog is checked.

In the event log, there isn't much. There is an event ID 5781, but that's from yesterday when I was first bringing the system back. And there were a couple recent event ID 1014, for mydomain.com.

Thanks
0
arnoldCommented:
Often, you can extend the tombstone if that is the concern.

Are there  errors related to sysvol? is sysvol shared on this branch?
check replication status. does the local branch

It might have replication issues preventing the GC from coming online.
check netdiag, repladm..
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

ctp_mackdaddiesAuthor Commented:
Yes sysvol is on this branch. No errors related that I can find. There are Information notices that it is successfully initialized and ready to share sysvol.
dcdiag /test:replications /e shows no errors.
repadmin /showrepl hqdc1.mydomain.com shows no errors.
repadmin /replsum shows no fails.

netdiag doesn't exist on server 2008 r2.

What if I were to uncheck this as a GC, then re-check it?

Thanks
0
arnoldCommented:
is the local DNS a replication of the branch,


The GC needs only be reflected in the local site and not through out.
i.e. you do not expect to have requests from HQ to flow to the branch.

Your setup is fine.
0
ctp_mackdaddiesAuthor Commented:
is the local DNS a replication of the branch
Sorry, I'm not sure I understand what you're asking.
Your setup is fine.
I am getting that error message, though, and none of the other branch DCs have this issue. Every branch DC shows up in Forward Lookup Zones/mydomain.com/_msdcs/gc/_sites/(BranchSiteName)/_tcp. on all DCs, except for the one I just re-promoted.

Thank you
0
ctp_mackdaddiesAuthor Commented:
I removed BranchDC1 as a GC in Sites and Services. I deleted the _ldap SRV for BranchDC1 from under BranchDC1/Forward Lookup Zones/mydomain.com/_msdcs/gc/_tcp (this record is missing from this location on other DCs). Verified its site folder disappeared from /_msdcs/gc/_sites. Then I re-enabled it as a GC. Things wen back to the way they were... The SRV record reappeared, but still only on BranchDC1. The site folder got recreated on all DCs, although under /_msdcs/gc/_sites/BranchDC1/_tcp it shows a ldap SRV record for BranchDC1 and HQDC2 (another DC at the data center). No other site shows a record for anything but itself in that location.

Ran the AD Replication Status too. No errors with replication. Branch DC1 is recognized as a GC.

Still getting the same error when I run \>dcdiag /test:dns

I've about run out of ideas for things to try.
0
arnoldCommented:
What is the output from nslookup 10.2.100.121?

The error might deal with the reverse.

You are using the /e option, it is not clear that the error is reflective of this branch or one if the other locations.
0
ctp_mackdaddiesAuthor Commented:
What is the output from nslookup 10.2.100.121?
nslookup looks normal. Same results from any DC.
C:\>nslookup 10.2.100.121
Server:  UnKnown
Address:  ::1
Name:    HQDC1.mydomain.com
Address:  10.2.100.121

Open in new window

You are using the /e option, it is not clear that the error is reflective of this branch or one if the other locations.
It's definitely referring to BranchDC1, and the error appears regardless of where I do the test from.
 DC: BRANCHDC1.mydomain.com
 Domain: mydomain.com
    TEST: Records registration (RReg)
       Network Adapter [00000000] Microsoft Virtual Machine Bus Network Adapter:
          Warning:
          Missing SRV record at DNS server 10.2.100.121:
          _ldap._tcp.gc._msdcs.mydomain.com
    Error: Record registrations cannot be found for all the network adapters

Open in new window

0
arnoldCommented:
It points to hqdc's DNS that is missing the record.
TEST: Records registration (RReg)
       Network Adapter [00000000] Microsoft Virtual Machine Bus Network Adapter:
          Warning:
          Missing SRV record at DNS server 10.2.100.121:
          _ldap._tcp.gc._msdcs.mydomain.com
    Error: Record registrations cannot be found for all the network adapters
0
ctp_mackdaddiesAuthor Commented:
Yes, that is what I wrote in my original post. I'm trying to figure out why it won't create that record there.
I can see it missing from the other DCs as well, but it is only throwing the error for HQDC1, which replicates with BranchDC1 and all other DCs.

Thank you
0
arnoldCommented:
You are on the wrong system.  You have a multi-site design, querying from the branch including every test.  your branch would not be service HQ

do you run dcdiag /test:dns /e on every branch, do all branches have similar setups.
Your Site setup is a Hub and spoke i.e. each branch reps back to all DCs in HQ?

Have to reread your question to make sure I am not mixing multiple things into one.

Is the branch DC reflected in the correct site? Compare the other Branch DCs location to this one.
0
ctp_mackdaddiesAuthor Commented:
When I run \>dcdiag /test:dns /e I get the same results regardless of what DC I run it from. BranchDC1 is the only one that fails the RReg test.
I have run it from two different DCs at my data center, including HQDC1, and I have run it from 3 different branch DCs, including BranchDC1.

All branch DCs replicate back to HQDC1.

BranchDC1 is showing under the correct site in Sites and Services. It is the only server for that site.

Thank you
0
arnoldCommented:
Not sure which error it means, the resolution of the branchdc1 on the hqdc1 system.
0
ctp_mackdaddiesAuthor Commented:
I just remembered, initially BranchDC1 was added to the wrong site when re-promoted, but I quickly moved it. Might have something to do with it...
0
arnoldCommented:
Enough time haspassed for the info to converge.
Your error points to branchDC1 not being reflected on the domain GC list.

Is it reported on the branch side SRC revord lookup _tcp._ldap.msdcs.domain.local SRV record as preferred?

.as long as local site system send eit requests to the branchDC and quickly login, the convergence should occur, there might be something else preventing the ........
If however, this leads the local systems to query out of site Dcs for logins delaying .......
Then further investigation on events replication DNS to see wht is ......... The cause for the discrepancy.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
ctp_mackdaddiesAuthor Commented:
Is it reported on the branch side SRC revord lookup _tcp._ldap.msdcs.domain.local SRV record as preferred?
On BranchDC1, there is a SRV record in Forward Lookup Zones/mydomain.com/_msdcs/gc/_sites/BranchDC1/_tcp.  It's just not there on other DCs.


Thanks
0
arnoldCommented:
This is a BranchDC1 site.
Do other branches show up
Zones/mydomain.com/_msdcs/gc/_sites/branchdc2/_tcp
?

Is this Branch site delegated configured/differnetly than the others?
0
ctp_mackdaddiesAuthor Commented:
I found the SRV record for BranchDC1 was missing from Forward Lookup Zones/mydomain.com/_msdcs/gc/_tcp/ on BranchDC1 this morning. It reappeared after I forced replication.

No other branch DC is missing any record from anywhere that I can see.

If there is a configuration difference, I'm not aware of it.

Edit: Above I said the record was missing from Forward Lookup Zones/mydomain.com/_msdcs/gc/_sites/(Branch)/_tcp/, but it's missing from Forward Lookup Zones/mydomain.com/_msdcs/gc/_tcp/ on all DCs but BranchDC1. Sorry about the confusion.
0
ctp_mackdaddiesAuthor Commented:
Is demoting and then re-promoting this DC a good idea?
0
arnoldCommented:
No, if you have an option to add a new server in the DC role and see if it works, then retire the branchdc1 including cleaning out metadata.
0
ctp_mackdaddiesAuthor Commented:
Found a connectivity problem between BranchDC1 and a couple other branches. It does not have a partnership with the DCs in those branches, but fixing that connectivity issue resolved the replication problem with BranchDC1 and HQDC1.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.