DNS Errors


We have following setup

Common Domain :- xyz.lan
Sites :- 2 (Site 1 & Site 2)
Site 1 :- Domain Controller / DNS ( + Member Server (
Site 2 :- 2 Member Servers / DNS ( &
Site 1 IP Network :-
Site 2 IP Network :-

We are facing following issues.
Event ID 4521, The DNS server encountered error 9002 attempting to load zone......
Event ID 1054 Windows cannot obtain the domain controller name for your computer network.....
Event ID 13508 The file replication Service is having trouble enabling replication from <old DC> to <new Dc>......
Event ID 27 While processing a TGS request for the target server krbtgt/xyz.lan, the account.....did not have a suitable key for generating a Kerberos ticket.....
Not able to create reverse lookup zone 172.21.3.x on any of the AD. It gives error The zone cannot be created. There was a server failure.

I have searched & tried to apply all the threads in Google however not able to succeed. Request help to resolve the issue.

syinfraSenior Deputy ManagerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
I'd start with "The DNS server encountered error 9002 attempting to load zone"
Because you've specified some DNS servers as member servers, I assume you are not using AD Integrated zones.  I assume there is one server that is the primary for the zone which includes your active directory objects.  I assume that's the server on which you have the error concerning not being able to load a zone.   Added to the reference to "<old DC>", I have this fear that it may be possible that the machine which had been the primary on the zone has been demoted/retired.  If the zone one which active directory relies has failed to load on the primary, and everything is counting on the primary (all the secondaries have expired references)... then all the error messages would be a symptoms of the same cause.

Unfortunately, I've had to assume a lot.  (And because so much needs to be assumed, I also assume that's why the question is currently neglected.  :-)  It's hard to guess what might be occurring here.)

To proceed... confirm which assumptions you can.  On which server was that first (failed to load) error?  Where there any other recent problems with that server?  Was the old DC retired 'recently'?
syinfraSenior Deputy ManagerAuthor Commented:
Thank you Rich for your response.

The error is appearing on all the Servers (PDC & Member Servers). There was an old DC, however it is removed long time back.
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
If you open DNS Manager, and look at the properties if the individual forward lookup zones... are they Active Directory Integrated, Primary, or Secondary zones?
syinfraSenior Deputy ManagerAuthor Commented:
They are Active Directory Integrated
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
I think I need more information then.  There appears to be only a single domain controller, and several member servers which are DNS servers, and you've indicated that the error loading the zone is occurring on all the (DNS) Servers.  Active Directory Integrated zones are only available on domain controllers.  

I suppose it might be possible that the zone is active directory integrated on the DC, and a secondary on the member servers?  (Confirm please?)  [If that is the case, we need just figure out why the zone is not loading on the domain controller, and in that case, we'll be pursuing a possible issue with Active Directory.]
[If that is not the case, we still need to determine how the existing system is configured to determine where the fault is.]

> There was an old DC, however it is removed long time back.
The message "Event ID 13508 The file replication Service is having trouble enabling replication from <old DC> to <new Dc>" would indicate that there are references to the old DC remaining.  It isn't impossible that it is tied into the issue you are encountering... but there is not enough information yet to be certain.

I'm assuming, at this point, that the domain is non-functional?  Or does DNS eventually load, and you are just attempting to clean up the error messages?

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.