Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Domain Controller Diagnostic Errors on SBS 2008

Posted on 2016-10-05
3
Medium Priority
?
99 Views
Last Modified: 2016-10-18
Got a strange one here.

I received a report that one of our client's server is beginning to have dc/AD errors.

I rand a dcdiag and attached the results.  There is no RODC in the environment, but what really has me scratching my head are the 0xC0002719 and 0x40000004 event IDs.

I also did a dcdiag /test:dns and attached the results as well.

I did some checking online but couldn't really find anything that looked like it would address this issue.

The clients don't seem to be impacted by this but the number of entries has increases over the past few days.

The server is SBS 2008.

This is a long-standing client, so what I'm looking for are step-by-step instructions on troubleshooting and resolving this issue.  Thank you.

dcdiag2.txtDCDiagTestDNS.txt
0
Comment
Question by:Scott C
  • 2
3 Comments
 
LVL 43

Accepted Solution

by:
Adam Brown earned 2000 total points
ID: 41830225

      Starting test: NCSecDesc

         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=ForestDnsZones,DC=COMPANY,DC=LOCAL
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

            Replicating Directory Changes In Filtered Set
         access rights for the naming context:

         DC=DomainDnsZones,DC=COMPANY,DC=LOCAL
         ......................... NCDTSERVER failed test NCSecDesc

is probably the bigger problem. That basically means the DNS zones can't be replicated. If you open ADSIEdit and connect to DC=DomainDnsZones,DC=COMPANY,DC=LOCAL and DC=ForestDnsZones,DC=COMPANY,DC=LOCAL you should be able to fix those permissions easily enough.

As for the syslog errors, you'll get much better information on the net by searching the event IDs from the System log for those errors. That particular section of the DCDiag only shows the warning and error events in the system log. Those DCOM errors are usually a sign of DNS records not being updated correctly on client computers. They come up a lot when the DC or some other process tries to remotely access a system using DCOM and the computer's actual name doesn't match the computer name used to access. Basically, that means the DNS entry for the computer has the IP of a different computer listed. Best way to fix that is to force all the client machines to re-register their DNS information. Most likely, though, fixing your permissions issues on the DNS zones with ADSIEdit, as I mentioned, will resolve this issue after a while.
0
 
LVL 32

Author Comment

by:Scott C
ID: 41831704
Thanks for the reply.

Could you please provide me the steps to fix these permissions?  

I want to be able to go in there and get this right the first time.

Thank you.
0
 
LVL 32

Author Comment

by:Scott C
ID: 41832016
Ok.  Took your advice and looked in the Event logs.  I'm seeing tons of DCOM 10009 errors.

I followed KB957713 and changed the firewall GPO.  Will see if that does anything.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question