Exchange 2013 Dependency on PDC

Hello Experts!

I had some interesting situation with exchange environment last night when my PDC (DC1) went down making Exchange 2013 inoperable.

I went digging for logs, specifically Event ID 2080 described here:

https://support.microsoft.com/en-us/kb/316300
and here
https://exchangemaster.wordpress.com/2012/11/16/quick-method-to-diagnose-exchange-active-directory-access-service-startup-issues/

On my exchange servers I see following when both DC are up:

       Process Microsoft.Exchange.Directory.TopologyService.exe (PID=3064). Exchange Active Directory Provider has discovered the following servers with the following characteristics:      
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)      
In-site:
dc1.company.local              CDG 1 7 7 1 0 1 1 7 1
DC2.company.local             CDG 1 7 7 1 0 1 1 7 1      
Out-of-site:


And this when PDC was down:

       Process Microsoft.Exchange.Directory.TopologyService.exe (PID=3064). Exchange Active Directory Provider has discovered the following servers with the following characteristics:      
 (Server name | Roles | Enabled | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)      
In-site:
dc1.company.local              CDG 1 0 0 0 0 0 0 0 0
DC2.company.local             CDG 1 7 7 1 0 1 1 7 1      
Out-of-site:
     
Now this is what I see on exchange servers:

This is mail1, which holds primary database

[PS] C:\Windows\system32>get-adserversettings | fl
 
 
RunspaceId                                         : 61ebb6d6-feb1-41bb-8a5f-9808df54fce4
DefaultGlobalCatalog                               : dc1.company.local
PreferredDomainControllerForDomain                 : {}
DefaultConfigurationDomainController               : dc1. company.local
DefaultPreferredDomainControllers                  : {dc1. company.local }
UserPreferredGlobalCatalog                         :
UserPreferredConfigurationDomainController         :
UserPreferredDomainControllers                     : {}
DefaultConfigurationDomainControllersForAllForests : {< company.local, dc1. company.local >}
DefaultGlobalCatalogsForAllForests                 : {< company.local, dc1. company.local >}
RecipientViewRoot                                  : company.local
ViewEntireForest                                   : False
WriteOriginatingChangeTimestamp                    : False
WriteShadowProperties                              : False
Identity                                           :
IsValid                                            : True
ObjectState                                        : New
 
This is mail2, which holds replica database

PS] C:\Windows\system32>get-adserversettings | fl
 
 
RunspaceId                                         : 31d28d7c-b411-4dfa-89f0-aac0fec65aaf
DefaultGlobalCatalog                               : DC2. company.local
PreferredDomainControllerForDomain                 : {}
DefaultConfigurationDomainController               : dc1. company.local
DefaultPreferredDomainControllers                  : {DC2. company.local }
UserPreferredGlobalCatalog                         :
UserPreferredConfigurationDomainController         :
UserPreferredDomainControllers                     : {}
DefaultConfigurationDomainControllersForAllForests : {< company.local, dc1. company.local >}
DefaultGlobalCatalogsForAllForests                 : {< company.local, DC2. company.local >}
RecipientViewRoot                                  : company.local
ViewEntireForest                                   : False
WriteOriginatingChangeTimestamp                    : False
WriteShadowProperties                              : False
Identity                                           :
IsValid                                            : True
ObjectState                                        : New
 

Clearly there is a difference. In my opinion some of the parameters should contain both domain controllers. I believe this is the primary reason for exchange to malfunction when PDC went down.

I also ran get-domaincontroller on both exchange servers and all report both domain controllers.


Anyone would comment on possible fix? Or perhaps it’s design flaw?  

Any comment will be highly appreciated.

Thank you.
LVL 1
pomah1Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Simon Butler (Sembee)ConsultantCommented:
Exchange is only dependant on a server with the global catalog role.
However what it is very poor on doing is moving to another GC when the one it is using goes away.
Basically it sits there for anything up to 30 minutes before it starts to look for another DC. (MS claim it should be 10-15 minutes, but 30 is most common). Therefore if the DC that Exchange is using goes away, restart the Exchange AD topology service which will force Exchange to look for another GC/DC and it should be fine. Do nothing and Exchange is basically dead in the water.

This isn't new - it has been the same since AD came along.

Simon.
pomah1Author Commented:
The weird thing is that PDC was down close to 7 hours during the night and Exchange was dead all that time.
Will SzymkowskiSenior Solution ArchitectCommented:
This should not happen by design. What would be the point of having multiple DC/GC's in your environment if Exchange will only use 1 of them.

I do see that when you run the cmdlet it does show the Preferred DC/GC. I have also verified this in my lab and those are the defaults. However, when I power my DC1 off DC2 is automatically used. I have done this same test using earlier versions of Exchange 2007/2010 and all of the Exchange servers failover to the DC/GC that is online.

The event that you have posted illustrates that it has 2 DC/GC's in its site so it should use them. I am not at all convinced that something else is not right in your environment.

This type of issue has never happened to me. The only thing I can think of is that your Exchange Servers are pointing to your DC1 for DNS and not pointing to DC2 as the secondary. This would make sense because Exchange would not be able to locate a DNS server which would stop it from working.

This process should be completely seamless.

Will.
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

pomah1Author Commented:
I actually just looked at the exchange DNS tabs before I read your comment and indeed DC2 was not there. It contained decommissioned DNS server winch was removed few weeks ago.
I will try to simulate the issue to see if GC is picked up correctly.

Thank you
Zacharia KurianAdministrator- Data Center & NetworkCommented:
You need to point all the GC servers IP to the DNS entry of your exchange. Otherwise your exchange  will not function, when the PDC goes down. This is not the case with exchange only, rather this is the case with all your servers/PCs connected to your domain network.  Other wise, when the PDC holder goes down, all the system will not able to authenticate to the AD.

Zac.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Will SzymkowskiSenior Solution ArchitectCommented:
That is exactly what I thought.

This would be the exact reason why Exchange would stop working.

You should have no issues when the dns is set on the secondary.

Will.
Will SzymkowskiSenior Solution ArchitectCommented:
Not sure why my answer wasn't just accepted as the answer, as  I had stated all of the above.

Will.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.