Solved

Domain Controller Diagnostic Errors on SBS 2008

Posted on 2016-10-05
3
45 Views
Last Modified: 2016-10-18
Got a strange one here.

I received a report that one of our client's server is beginning to have dc/AD errors.

I rand a dcdiag and attached the results.  There is no RODC in the environment, but what really has me scratching my head are the 0xC0002719 and 0x40000004 event IDs.

I also did a dcdiag /test:dns and attached the results as well.

I did some checking online but couldn't really find anything that looked like it would address this issue.

The clients don't seem to be impacted by this but the number of entries has increases over the past few days.

The server is SBS 2008.

This is a long-standing client, so what I'm looking for are step-by-step instructions on troubleshooting and resolving this issue.  Thank you.

dcdiag2.txtDCDiagTestDNS.txt
0
Comment
Question by:ScottCha
  • 2
3 Comments
 
LVL 39

Accepted Solution

by:
Adam Brown earned 500 total points
ID: 41830225

      Starting test: NCSecDesc

         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=ForestDnsZones,DC=COMPANY,DC=LOCAL
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=DomainDnsZones,DC=COMPANY,DC=LOCAL
         ......................... NCDTSERVER failed test NCSecDesc

is probably the bigger problem. That basically means the DNS zones can't be replicated. If you open ADSIEdit and connect to DC=DomainDnsZones,DC=COMPANY,DC=LOCAL and DC=ForestDnsZones,DC=COMPANY,DC=LOCAL you should be able to fix those permissions easily enough.

As for the syslog errors, you'll get much better information on the net by searching the event IDs from the System log for those errors. That particular section of the DCDiag only shows the warning and error events in the system log. Those DCOM errors are usually a sign of DNS records not being updated correctly on client computers. They come up a lot when the DC or some other process tries to remotely access a system using DCOM and the computer's actual name doesn't match the computer name used to access. Basically, that means the DNS entry for the computer has the IP of a different computer listed. Best way to fix that is to force all the client machines to re-register their DNS information. Most likely, though, fixing your permissions issues on the DNS zones with ADSIEdit, as I mentioned, will resolve this issue after a while.
0
 
LVL 29

Author Comment

by:ScottCha
ID: 41831704
Thanks for the reply.

Could you please provide me the steps to fix these permissions?  

I want to be able to go in there and get this right the first time.

Thank you.
0
 
LVL 29

Author Comment

by:ScottCha
ID: 41832016
Ok.  Took your advice and looked in the Event logs.  I'm seeing tons of DCOM 10009 errors.

I followed KB957713 and changed the firewall GPO.  Will see if that does anything.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question