Domain Controller Diagnostic Errors on SBS 2008

Scott C
Scott C used Ask the Experts™
on
Got a strange one here.

I received a report that one of our client's server is beginning to have dc/AD errors.

I rand a dcdiag and attached the results.  There is no RODC in the environment, but what really has me scratching my head are the 0xC0002719 and 0x40000004 event IDs.

I also did a dcdiag /test:dns and attached the results as well.

I did some checking online but couldn't really find anything that looked like it would address this issue.

The clients don't seem to be impacted by this but the number of entries has increases over the past few days.

The server is SBS 2008.

This is a long-standing client, so what I'm looking for are step-by-step instructions on troubleshooting and resolving this issue.  Thank you.

dcdiag2.txtDCDiagTestDNS.txt
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Systems Admin
Top Expert 2010
Commented:

      Starting test: NCSecDesc

         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=ForestDnsZones,DC=COMPANY,DC=LOCAL
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=DomainDnsZones,DC=COMPANY,DC=LOCAL
         ......................... NCDTSERVER failed test NCSecDesc

is probably the bigger problem. That basically means the DNS zones can't be replicated. If you open ADSIEdit and connect to DC=DomainDnsZones,DC=COMPANY,DC=LOCAL and DC=ForestDnsZones,DC=COMPANY,DC=LOCAL you should be able to fix those permissions easily enough.

As for the syslog errors, you'll get much better information on the net by searching the event IDs from the System log for those errors. That particular section of the DCDiag only shows the warning and error events in the system log. Those DCOM errors are usually a sign of DNS records not being updated correctly on client computers. They come up a lot when the DC or some other process tries to remotely access a system using DCOM and the computer's actual name doesn't match the computer name used to access. Basically, that means the DNS entry for the computer has the IP of a different computer listed. Best way to fix that is to force all the client machines to re-register their DNS information. Most likely, though, fixing your permissions issues on the DNS zones with ADSIEdit, as I mentioned, will resolve this issue after a while.
Scott CSenior Engineer

Author

Commented:
Thanks for the reply.

Could you please provide me the steps to fix these permissions?  

I want to be able to go in there and get this right the first time.

Thank you.
Scott CSenior Engineer

Author

Commented:
Ok.  Took your advice and looked in the Event logs.  I'm seeing tons of DCOM 10009 errors.

I followed KB957713 and changed the firewall GPO.  Will see if that does anything.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial