Problems with Active Directory in a new 2003 server.

[starriol]

Hi guys.

We used to have a quite old Active Directory server with windows 2000.

So we bought a new PC, installed 2003, did the upgrading of the domain in the 2000 server, then we promoted the 2003 server to AD controller and made it a global catalog.

But for some reason (obviously we missed a step) this new server cannot take full control of the domain; I can't, for instance, edit the Domain Controller Security Policy. It just throws the following error: "Failed to open the group policy object. You may no have appropiate rights. Details: the specified domain either does not exist or could not be contacted".

I didn't remove the other server from any of the options in active directory management in administrative tools just in case I need some more features of AD to finish the migration to 2003.

We actually DON'T need at all the 2000 server, so I need the 2003 server to handle everything AD related by itself.



Another problem we have here is that the server looses conectivity.
It's weird, it just cannot connect to any IP.
It's using a fixed IP since it's a DNS server.
The router (a cheap linksys) is the default gateway & dhcp server, so every PC has an ip configured with the router as default gateway and the router gives both my ISP's DNS and the Windows 2003 server (Actually, this ip comes first in the list).

So basically the second problem is that the server cannot connect anywhere, either Internet or LAN, by IP or host name.
It happened once a day till now and we solve it resetting the server or by de-activating and re activating the network card in network connections.

At first I thought "maybe a duplicated IP". But the router is the only DHCP server, it provides IPs above 192.168.0.112 and the 2003 server's IP is 192.168.0.102 so it couldn't be that.
Besides, I should get an error msg saying that and nothing.

I can't even see anything related to the second error in event viewer.

Thanks a lot for the help

 

[DaiShan]

First things first, you should not hand out your ISP's DNS over DHCP. What that is telling your clients is: If you can't reach the DNS server on the AD, then try to resolve all domain objects using the ISP's DNS server. Since your ISP has no knowledge about objects in your active directory, this will cause a lot of AD headaches. You should configure your forward lookup on the DNS server to perform all non-authoritative lookups against your ISP's DNS servers.

 

[starriol]

Yeah, in a couple of days we are going to install a second server to act as an ISA server and DHCP too and I'll do it the right way then... but now I just saw that the server was using the router's ip as primary DNS... and the router was using the Windows 2003 server... very bad idea, they could get into a loop of sorts.
So I reconfigured the 2003 with 127.0.0.1 as primary dns and router as secondary.

Could this been causing the second problem?

 

[RebateMonger]

Originally posted by: starriol
So I reconfigured the 2003 with 127.0.0.1 as primary dns and router as secondary.

Could this been causing the second problem?

I suggest doing as DaiShan suggests:

1) Set all of your client PCs to use your Server's DNS Server. Period. No mention of any other DNS Servers. Not your ISP and not your Router.

This setting should be the IP address of the NIC where your DNS is listening. If you have a dual-NIC server, it would be the Internal NIC.

2) Set all of your Servers to use your Domain's DNS Server. Period.

3) In your Server's DNS MMC panel, set a Forwarder to your ISP's DNS Server.

This is the recommended way to do it and it works perfectly. Other's have reported manfunctioning DNS when they go into a loop like you've got.

 

[starriol]

OK, I solved the DHCP problem and the main problem (and VERY urgent to get solved) keeps happening. That is, the server needs to be restarted at least once a day because it looses the NIC (network adapter) connection to the world. I can't even ping another PC on the LAN.

This is catastrophic because this is a file server and we've been having problems with our clients because of not being able to access the files fast.

Any ideas? I'm thinking either the NIC or the switch could be the problem. But the NIC is as new as the PC (2 months) and it's integrated with the motherboard and I've never seen one of those fail.
And about the switch, I tried changing the port and UTP cable and nothing...


Anyone?

 

[Schloonce]

When you say "did the upgrading of the domain in the 2000 server", what exactly does that mean? Do you have a 2003 box, and an upgraded 2003 box?

Have you tried to transfer your FSMO roles back to 2000 server, move the GC then demote the 2003 box to a member server?

 

[starriol]

PS: I didn't see anything weird in the Event viewer that could relate to the most important problem (losing the LAN connection). There's a lot of errors regarding not finding a primary domain controller which is the secondary problem I need solved, but it's not at all as urgent as the first one... unless the two are the same one? I doubt that, it seems like a hardware level error the first one and the second a soft level error.

 

[starriol]

<div class="FTQUOTE"><begin quote>Originally posted by: Schloonce
When you say "did the upgrading of the domain in the 2000 server", what exactly does that mean? Do you have a 2003 box, and an upgraded 2003 box?

Have you tried to transfer your FSMO roles back to 2000 server, move the GC then demote the 2003 box to a member server?</end quote></div>

What I did was run Forestprep and Domainprep on our old Windows 2000 server, then connected the new 2003 server, made it a domain controller of our 2000 domain, then shutdown the 2000 server and the last thing I did I don't remember exactly where, but I made the 2003 server the Global Catalog manager...

I probably missed quite some steps to make it the only server in our network; I want all the functions working on that PC.

I'll research about the FSMO roles... it probably had something to do with that.

Do you think this problem has anything to do with the connectivity issues or it's something different? The first one is my priority now.

 

[Genx87]

Restart the 2000 server and transfer the FSMO roles to the 2003 server. This has to be done otherwise you will get errors on certain actions within AD. Right now the 2003 server is probably trying to query the master on one of the roles and it fails.

Once you have transfered the roles you will want to demote the 2000 server if you arent using it anymore.

This link gives a pretty good overview of the procedure to decommission a domain controller. Including how to transfer the FSMO roles.

http://technet2.microsoft.com/...71fd1033.mspx?mfr=true

 

[Schloonce]

Can users access everything on the 2000 server? Does your AD still work? If you power down your 2k3 box, does the network still function? Can users log on and off, access network shares, etc.

If so, you can always demote the 2k3 DC, then unjoin it from the domain and try it again. Before doing that, make sure the 2000 box holds your FSMO roles and is your GC.

What kind of errors are you getting in your event logs (on both servers)?

 

[starriol]

BTB, I'm not getting the LAN connection disconnected icon, that's the weird thing. Do you think it has anything to do with the NIC set to auto negotiate the speed/duplex settings?
And our switch is unmanageable so I can't see there the dropped packets. Where can I check that in windows? I'll try setting the option directly on the network interface in Windows first in 100 full duplex and then 100 half if it won't work OK on full and see if it works.

Wow, I just saw that the network card has the option "allow the computer to turn off this device to save power"!!! Most of the problems of the NIC not working happened at the morning, after a night of practically not using the server. I'm unchecking this right now... perhaps that's the problem? What I don't understand is why that is the default option!!!!
PS: I'll check the FSMO roles and the whole AD problem in a while, thanks a lot for the info, Schloonce & Genx87.