exchange not finding AD

[Pantlegz]

running a few copies of windows server 2008 one of which(not a DC) is running exchange 2007 I had everything up and running the middle of last week and left it at that. Nothing changed at all, no reboots/updates, no installs what so ever. when I try to go the https://FQND/owa it tells me that exchange failed to load. Evet viewer says it was unable to locate a suitable domain controller, whatever that means. Although it's still part of the domain, that has 2 DC's running. Any suggestions on how I could fix this? I'm at a totally lost at this point, slightly confused too.

 

[imagoon]

Check DNS, your describing a classic DNS mismatch problem. Every machine must point at internal DNS servers only. No outside servers allowed any where except *maybe* the forwarders in the DNS servers themselves.

DNS is used to locate DC's

 

[Pantlegz]

actually I think that I somehow switched the DNS servers around, I had it going to external DNS before internal DNS not sure how, or why, it got changed to that. Just changed it and rebooted and it's working. I guess it threw me off because I was able to resolve the name, I figured the dns was right. thanks

Also, is there an easy way to change the website, or atleast remove the https? typing all that out ever time is a pita, especaially including https://

 

[imagoon]

I am not sure about the OWS part, but make sure there are no external DNS in the DNS records anywhere.

"I had it going to external DNS before internal DNS not sure how, or why, it got changed to that."

Makes me think you have the external servers listed some place still.

 

[RebateMonger]

Just because you can resolve both internal and external names doesn't prove that you have an internal DNS server working. Local lookups will use NetBIOS if necessary. But that's not adequate for Exchange. Exchange needs DNS or (maybe) WINS.

 

[Pantlegz]

yea it's working now, internal dns is/was working but it was the secondary zone and I guess when the exchange server booted it only looked at the first dns zone.

Originally posted by: imagoon
I am not sure about the OWS part, but make sure there are no external DNS in the DNS records anywhere.

"I had it going to external DNS before internal DNS not sure how, or why, it got changed to that."

Makes me think you have the external servers listed some place still.

It's working fine with the external dns, and I have to use the external dns otherwise I'm not able to access anything inside the schools network.I gues they're not dns records but a secondary dns server, you can list several if needed. I'm able to get out the the internet but anything hosted between me and the internet wont resolve with internal dns only I'm not able to get zone trasnfers, or transfer zones either. The IT dept doesn't want to deal with the issues that could come up with that.

Originally posted by: RebateMonger
Just because you can resolve both internal and external names doesn't prove that you have an internal DNS server working. Local lookups will use NetBIOS if necessary. But that's not adequate for Exchange. Exchange needs DNS or (maybe) WINS.

it is/was able to resolve from outside of the network so I assumed it was dns, and I don't think any of other protocols work outside of the domain/network.

 

[imagoon]

Originally posted by: Pantlegz1
yea it's working now, internal dns is/was working but it was the secondary zone and I guess when the exchange server booted it only looked at the first dns zone.

Originally posted by: imagoon
I am not sure about the OWS part, but make sure there are no external DNS in the DNS records anywhere.

"I had it going to external DNS before internal DNS not sure how, or why, it got changed to that."

Makes me think you have the external servers listed some place still.

It's working fine with the external dns, and I have to use the external dns otherwise I'm not able to access anything inside the schools network.I gues they're not dns records but a secondary dns server, you can list several if needed. I'm able to get out the the internet but anything hosted between me and the internet wont resolve with internal dns only I'm not able to get zone trasnfers, or transfer zones either. The IT dept doesn't want to deal with the issues that could come up with that.

You will continually have issues with DNS in that config. It by definition is the wrong way to do it. Secondary does not mean "other DNS" it means backup DNS to that domain only. All other DNS needs to be handled at the DNS server. You can have several entered as secondaries but they are all expected to be participating in the same Domain.

You enter all others in the DNS forwarders box on the DNS server itself. There you specify the domain and then list DNS servers that serve that domain. "All other DNS domains" you can either point at external server or leave blank to allow the DNS server to query the Root Servers for the rest of the Internet.

Site with basics and screen shots of the process:

http://www.windowsnetworking.c...ndows_Server_2003.html

Just noted your 2k8. The process should be similar but I have not had a chance to install 2k8 on a machine yet. I was waiting for R2 before I took that plunge. Which just came out.

 

[Pantlegz]

I see, so if I would just put the IP address of his dns servers there, if I wanted this to work with a domain with several subdoamins(?) could I just use *.domain.net or would I have to enter each one manually?

Oh and the way it's setup is dumb and may, or may not effect this but... the way it's setup is my domain is a sub-domain of the schools but we're in differen forests(?) basically we're seperate but my fqdn is schoolfqdn1.schoolfqdn.net where all the schools sites are schoolfqdn.net, would the conditional forwarders effect this any? because there are other site that are xxx.schooldqdn.net that are hosted by them that I would need resolved by their dns.

 

[Genx87]

I have only started to delve into Exchange 07. But in 03 you could uncheck requiring a SSL connection in the owa website.

 

[imagoon]

Originally posted by: Pantlegz1
I see, so if I would just put the IP address of his dns servers there, if I wanted this to work with a domain with several subdoamins(?) could I just use *.domain.net or would I have to enter each one manually?

Oh and the way it's setup is dumb and may, or may not effect this but... the way it's setup is my domain is a sub-domain of the schools but we're in differen forests(?) basically we're seperate but my fqdn is schoolfqdn1.schoolfqdn.net where all the schools sites are schoolfqdn.net, would the conditional forwarders effect this any? because there are other site that are xxx.schooldqdn.net that are hosted by them that I would need resolved by their dns.

In a default config DNS will stay within the level it is in IE *.some.domain.net is different than *.domain.net

Do your domains share security at all? If so your DNS servers should be pointing either via forwarders in "all other DNS" or by using domain.net and entering addresses.

Using "All other DNS" and pointing at their domain will most likely work best however. I assume that they are able to resolve to the Internet?

Realize of course that if they need to hit any of your machines they need a matching connection on the other side.

 

[Pantlegz]

yes they're able to resolve to the internet. I guess I don't understand what you mean if we share security, but I think the answer is no. I'll do this, thanks a ton

 

[imagoon]

I meant Active Directory security. It sounds like your not actually a member of the forest (in AD a forest is a security domain shared by many smaller domains. It allows people authenticate across multiple domains if needed etc.) and was just told to use a 3rd level domain name.

Keeping DNS domain and AD domain straight just takes time to learn what they mean. AD makes them seem like they are the same because often the domain name is the DNS name.

 

[Pantlegz]

in that case no, we're not part of the same forest. This did work perfectly in server 2008, slightly different but I knowing what you're looking for helps a lot. Thanks a ton

Originally posted by: Genx87
I have only started to delve into Exchange 07. But in 03 you could uncheck requiring a SSL connection in the owa website.

Thank you this also made the stupid certificate error stop popping up and annoying the hell out of me.

 

[imagoon]

Originally posted by: Pantlegz1
in that case no, we're not part of the same forest. This did work perfectly in server 2008, slightly different but I knowing what you're looking for helps a lot. Thanks a ton

Originally posted by: Genx87
I have only started to delve into Exchange 07. But in 03 you could uncheck requiring a SSL connection in the owa website.

Thank you this also made the stupid certificate error stop popping up and annoying the hell out of me.

No problem. DNS stuff for me is a lot like physical layer stuff is to Spidey, It is something that just has to be done correctly. Otherwise you will waste tons of time trying figure out why various things seem to break at random times. It is well worth learning it to save months of frustration later.