Windows domain not functioning right after update of VMWare infrastructure

I have the following issue; I updated a machine running three servers (PDC, BDC and RDS) from VMWare 5.5 tot 6.5. Update went okay; updated VMWare tools. Network uses VMXnet 3, so VMware tools updated the driver. After booting I needed to configure the network cards again (the Ip adres was gone, as was DNS settings, gateway etc.). Rebooted and everything seems fine. But clients since then have had issues where connecting to a share (shared through Group Policy) works, but after some time the system returns an error that the share is inaccecable because of failed authentication. I also use roaming profile settings; so the whole client gives error (desktop, setting etc. all become inavailable). When login in the shares are always correctly made. One exception being; i map the home directory through AD settings (user > profile) directly. This mapping doesn't work, without any clear error.

I checked a lot of things; a lot of error seemed to relate to group policy; so I reset the complete set; made several authorative restores; disconnected client from the domain, deleted local policy and added to domain again. Nothing helps structurally. So I'm hoping somebody can help point to the one thing I'm missing in this case.
Martijn SnelICT AdvisorAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Michael PfisterCommented:
I'd first check if my Active Directory is behaving.
Open an administrative prompt on one DC and run

dcdiag /e /v /f:dcdiag.log
dcdiag /e /v /test:DNS  /f:dcdiag_dns.log

Open in new window

and attach both log files here
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Restore your servers before you made any changes....I'm guessing now that AD replication is not working...

no immediate requirement to update VMware Tools.

You didn't update Virtual Machine Hardware did you ?

it would appear all your issues have arose, since network interfaces have been reset...
0
MaheshArchitectCommented:
on each servers restart netlogon service and dns server service and then check if it workings
are clients able to logon locally in domain?
0
Powerful Yet Easy-to-Use Network Monitoring

Identify excessive bandwidth utilization or unexpected application traffic with SolarWinds Bandwidth Analyzer Pack.

Martijn SnelICT AdvisorAuthor Commented:
In trying to figure out the issue I have restarted the servers so much that restarting the services aren't the issue. Users can logon locally and it usually starts out working fine; some group policy settings aren't applied but shares and roaming does work. After being logged in for some time (can be anywhere between 2 minutes and several hours) the client starts showing messages that the path to \\fileserver\share can't be accessed. The fileserver is also the backup domain controller.

When updateing VMWare I did upgrade the virtual machine to the latest version. As part of my search for a sollution I removed all network adaptors and installed them from scratch.

Attached the log files ..
dcdiag.log
dcdiag_dns.log
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, I suspected that was the issue - again not necessary, unless you needed the new features provided by virtual machine hardware.
0
Martijn SnelICT AdvisorAuthor Commented:
I do have backups of the virtual machines; but the issues has been running for some days; so I would like to solve the issue going forward and not relying on backups. What is the best way to get this working as it should again? Most of the things I've done based on fixing the file replication, AD and such don't provide a stable sollution.
0
Michael PfisterCommented:
I see a couple of warnings regarding SYSVOL in the event log. I don't know Dutch but I assume from your previous comment that you were able to fix the FRS replication, so no more problems here?

What I don't like

Role Schema Owner = CN=NTDS Settings,CN=DSLEX2,CN=Servers,CN=Rotterdam,CN=Sites,CN=Configuration,DC=dsl,DC=local
         Role Domain Owner = CN=NTDS Settings\0ADEL:c7d7666c-bb78-4c46-84f2-b0be02fa56e0,CN=DSLEX2,CN=Servers,CN=Rotterdam,CN=Sites,CN=Configuration,DC=dsl,DC=local
         Warning:

         CN=NTDS Settings\0ADEL:c7d7666c-bb78-4c46-84f2-b0be02fa56e0,CN=DSLEX2,CN=Servers,CN=Rotterdam,CN=Sites,CN=Configuration,DC=dsl,DC=local

         is the Domain Owner, but is deleted.

Open in new window

0
Martijn SnelICT AdvisorAuthor Commented:
Yes.. those errors are related to me doing an authorative restore..

From the error message it seems there is a domain owner that is missing. But the PDC has been PDC for a good few years now. The basis structure of the network hasn't changed in about 4 years.
0
Michael PfisterCommented:
Do a backup, then try to transfer or seize this role https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control to the other DC
After that rerun dcdiag /e /v...

You can move the role back after the problems have been resolved
0
Michael PfisterCommented:
   Running partition tests on : ForestDnsZones

      Starting test: CheckSDRefDom

            For the partition (DC=ForestDnsZones,DC=dsl,DC=local) we

            encountered the following error retrieving the cross-ref's

            (CN=deaecf6f-110c-42cb-b590-09746c9b4a68,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... ForestDnsZones failed test CheckSDRefDom

      Starting test: CrossRefValidation

            For the partition (DC=ForestDnsZones,DC=dsl,DC=local) we

            encountered the following error retrieving the cross-ref's

            (CN=deaecf6f-110c-42cb-b590-09746c9b4a68,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... ForestDnsZones failed test

         CrossRefValidation

   
   Running partition tests on : DomainDnsZones

      Starting test: CheckSDRefDom

            For the partition (DC=DomainDnsZones,DC=dsl,DC=local) we

            encountered the following error retrieving the cross-ref's

            (CN=e133f20a-bbbf-4ac9-8e1e-bcad4d4a1520,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... DomainDnsZones failed test CheckSDRefDom

      Starting test: CrossRefValidation

            For the partition (DC=DomainDnsZones,DC=dsl,DC=local) we

            encountered the following error retrieving the cross-ref's

            (CN=e133f20a-bbbf-4ac9-8e1e-bcad4d4a1520,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... DomainDnsZones failed test

         CrossRefValidation

   
   Running partition tests on : Schema

      Starting test: CheckSDRefDom

         ......................... Schema passed test CheckSDRefDom

      Starting test: CrossRefValidation

            For the partition (CN=Schema,CN=Configuration,DC=dsl,DC=local) we

            encountered the following error retrieving the cross-ref's

            (CN=Enterprise Schema,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... Schema failed test CrossRefValidation

   
   Running partition tests on : Configuration

      Starting test: CheckSDRefDom

         ......................... Configuration passed test CheckSDRefDom

      Starting test: CrossRefValidation

            For the partition (CN=Configuration,DC=dsl,DC=local) we encountered

            the following error retrieving the cross-ref's

            (CN=Enterprise Configuration,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

             information: 
               LDAP Error 0x60 (96). 
         ......................... Configuration failed test CrossRefValidation

   
   Running partition tests on : dsl

      Starting test: CheckSDRefDom

         ......................... dsl passed test CheckSDRefDom

      Starting test: CrossRefValidation

            For the partition (DC=dsl,DC=local) we encountered the following

            error retrieving the cross-ref's

            (CN=DSL,CN=Partitions,CN=Configuration,DC=dsl,DC=local)

            information: 
               LDAP Error 0x60 (96). 
         ......................... dsl failed test CrossRefValidation

   

Open in new window


LDAP Error 0x60 (96): LDAP_CLIENT_LOOP: Indicates the LDAP client detected a loop, for example, when following referrals.
No idea what happened to your partitions...
0
Michael PfisterCommented:
You should consider to follow Andrew Hancock's advice and restore the AD to a previous and working state. I understand your problems especially on the file server, but I'm not sure if this is fixable.

Found how to recreate the default partitions so you could remove and recreate them ... but you mileage may vary... never had to do this. This will clear all your DNS information!
http://www.dell.com/support/article/de/de/debsdt1/sln290477/windows-server-how-to-recreate-the-default-dns-application-directory-partitions-in-active-directory?lang=en
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
A quick method, to to get working.... demote and uninstall AD off ALL but ONE server!

Work for 24-48 hours on a single server, and then start to add new AD servers, e.g. add AD role again, wait for replication.
1
Michael PfisterCommented:
Assuming DSLEX2 is only DC, DSLFS4 is DC and file server, I'd demote DSLFS4 and put it in a workgroup.
Then restore DSLEX2 to a state before the crash, do a metadata cleanup so DSLEX2 forgets about DSLFS4.
Rejoin DSLFS4  as a member server and make 100% sure DSLEX2 is in working order.
Add a fresh VM as a DC or if you can't, promote DSLFS4.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Martijn SnelICT AdvisorAuthor Commented:
Thanks for the feedback! I really appreciate it. So far I did manage to solve the FSMO issue, but that did not solve the errors clients have been getting. I'll now try the suggestion of making the DSLEX2 server the only DC and see what that helps. The server also runs Exchange (hence the EX) but that should not be an issue as far as I can tell. I'll post an update when that is done..
0
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
The server also runs Exchange (hence the EX) but that should not be an issue as far as I can tell.

not recommended for other readers!
0
Martijn SnelICT AdvisorAuthor Commented:
Thank you all for the feedback.. I've managed to get things working again. I started with the tip for sizing down to one DC. There I resolved al AD issues that still remained. This did not solve the initial issue. I did get me to notice that one share, used by a few users, located on a NAS drive did keep it's link. So i simply installed a new Windows 2012 server, attached the virtual disk with all the datashares from the server with the errors. I named the server the same as the old one, same IP adres. Rebooted everything and now no more issues. If this situatie is stable, with a new clean PDC in place I'll rejoin the newly installed fileserver as BDC. Thanks again for all the help!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.