DNS and Active Directory - one final issue to fix

[Shark]

Originally posted by: STaSh
How did you get rid of that old DC...did you run dcpromo to demote it first?

Also, if you look at your DNS, do you have a root (.) zone anywhere?

Yeah - DCPROMO was run, took forever. no root zones.

(kinda feel like I should delete my dns server and start over

 

[Shark]

Well - I still have the same "error" as last friday, I see no DNS issues on any of the error logs, but I would like to get this one fixed before I continue on.

Any ideas out there?
Thanks!

 

[stash]

Have you done a netdiag /v on your DCs?

 

[Shark]

netdiag and dcdiag pass every test they run (defaults skip a couple) on BOTH windows 2003 Enterprise DC's.

dnslint /ad /s 192.168.100.xxx

gives me a report, with the error posted about 3 posts up, on the primary DC - I have not run it on the other DC.

 

[Shark]

Anyone with some Christmas cheer today? and an answer for ol sharky here?

Thanks. :/

 

[exx1976]

Wait a minute. You say that the two DNS Servers run on 2000, and you mention primary and secondary.. Are these standard zones or AD integrated zones??

 

[Shark]

Standard.

 

[exx1976]

Well, I just ran a dnslint /ad /s <IP> /v against my test server here at home, and this is what a successful dnslint should look like...

DNSLint Report

System Date: Wed Dec 24 04:45:33 2003

Command run:

dnslint /ad /s 10.1.5.254 /v

Root of Active Directory Forest:

mine.local

Active Directory Forest Replication GUIDs Found:

DC: HARPO
GUID: 35e5d6cb-5887-4916-acc2-6ce9eb2fdb57


Total GUIDs found: 1

--------------------------------------------------------------------------------

The following 2 DNS servers were checked for records related to AD forest replication:

DNS server: User Specified DNS Server
IP Address: 10.1.5.254
UDP port 53 responding to queries: YES
TCP port 53 responding to queries: Not tested
Answering authoritatively for domain: YES

SOA record data from server:
Authoritative name server: harpo.mine.local
Hostmaster: admin
Zone serial number: 49
Zone expires in: 1.00 day(s)
Refresh period: 900 seconds
Retry delay: 600 seconds
Default (minimum) TTL: 3600 seconds


Additional authoritative (NS) records from server:
harpo.mine.local 10.1.5.254




Alias (CNAME) and glue (A) records for forest GUIDs from server:
CNAME: 35e5d6cb-5887-4916-acc2-6ce9eb2fdb57._msdcs.mine.local
Alias: harpo.mine.local
Glue: 10.1.5.254


Total number of CNAME records found on this server: 1

Total number of CNAME records missing on this server: 0

Total number of glue (A) records this server could not find: 0



--------------------------------------------------------------------------------

DNS server: harpo.mine.local
IP Address: 10.1.5.254
UDP port 53 responding to queries: YES
TCP port 53 responding to queries: Not tested
Answering authoritatively for domain: YES

SOA record data from server:
Authoritative name server: harpo.mine.local
Hostmaster: admin
Zone serial number: 49
Zone expires in: 1.00 day(s)
Refresh period: 900 seconds
Retry delay: 600 seconds
Default (minimum) TTL: 3600 seconds


Additional authoritative (NS) records from server:
harpo.mine.local 10.1.5.254




Alias (CNAME) and glue (A) records for forest GUIDs from server:
CNAME: 35e5d6cb-5887-4916-acc2-6ce9eb2fdb57._msdcs.mine.local
Alias: harpo.mine.local
Glue: 10.1.5.254


Total number of CNAME records found on this server: 1

Total number of CNAME records missing on this server: 0

Total number of glue (A) records this server could not find: 0

If I had to guess as to what's going on, I'd say that some of the necessary SOA's and RR's didn't get created.. Like maybe the LDAP provider or the kerberos records. You should see _msdcs, domains, gc, and pdc containers. Under the domains container, there should be an entry with the GUID for the domain.. Check and see if this is missing.. I don't know if it will help, but I would also try a ipconfig /flushdns and then an ipconfig /registerdns on the DCs in question...
Hopefully this will re-create some of the missing records, though I'm not certain whether or not this will recreate domain records (I know it will recreate host records for a corrupted dynamic entry)...


Keep us posted..

HTH,
Exx

 

[Shark]

Well - I still have the same "error" as last friday, I see no DNS issues on any of the error logs, but I would like to get this one fixed before I continue on.

Any ideas out there?
Thanks!

 

[exx1976]

There wouldn't necessarily be any DNS errors, as it's not an AD integrated zone...

I assume that all the proper keys are there that I made reference to in my prior post??

 

[Shark]

Well - I still have the same "error" as last friday, I see no DNS issues on any of the error logs, but I would like to get this one fixed before I continue on.

Any ideas out there?
Thanks!