New 2008R2 Server To 2003 Domain

ICTCity · April 28, 2011

Finally got a moment to try this and when I open group policy management there is nothing listed. So I went to "Add forrest" and entered my domain name in the dialog. When I clicked OK it gave me the error "The specified domain either does not exist or could not be contacted."

I did some googling on that error but could not seem to find anything that looked useful to me.

Can you add an alias (cname) in DNS which redirects from big-rig2 to big-rig? Not a A record, just the alias. Then flush and try again.

SailingNut · April 29, 2011

Can you add an alias (cname) in DNS which redirects from big-rig2 to big-rig? Not a A record, just the alias. Then flush and try again.

Tried the GUI and command line and both failed with the "refused" error.

ICTCity · April 29, 2011

Ok, I still have something to try...

Open: C:\Windows\System32\Drivers\etc\HOSTS

add this entry:

fd47:dced:df9d:5a5f::1 (which should be your IPv6 address) big-rig

Once you're finished, try to open DOMAIN AND TRUSTS and AD SITES AND SERVICES.

If you still have trouble, run dcdiag /fix

Let me know.

SailingNut · May 2, 2011

Ok, I still have something to try...

Open: C:\Windows\System32\Drivers\etc\HOSTS

add this entry:

fd47:dced:df9d:5a5f::1 (which should be your IPv6 address) big-rig

Once you're finished, try to open DOMAIN AND TRUSTS and AD SITES AND SERVICES.

If you still have trouble, run dcdiag /fix

Let me know.

I tried that and still had an error opeing the domains & trusts. I then tried to run a just plain dcdiag and it failed with an ldap error. Once I removed the entry from the hosts file I was able to run dcdiag again.

Should I try the dcdiag /fix without the IPv6 address in the hosts file? (Guessing the answer is yes on that one.)

One other bit of info is that I tried a disgnostic step to determine the health of the GC that I found on the Microsoft TechNet. I used the following command line:

nltest /dsgetdc:wtbhome /force /gc

It responded with status 1355 0x54b ERROR_NO_SUCH_DOMAIN

That seems bad to me.

ICTCity · May 2, 2011

Yes, dcdiag /fix.

I hope it's just a mistake in the name... try this:

nltest /dsgetdc:wtbhome.net /force /gc

SailingNut · May 2, 2011

Yes, dcdiag /fix.

I hope it's just a mistake in the name... try this:

nltest /dsgetdc:wtbhome.net /force /gc

using the .net suffix did not work. Same error from nltest

The dcdiag /fix failed because it's looking for big-rig2. Here's the output:

Directory Server Diagnosis


Performing initial setup:

Trying to find home server...

Home Server = big-rig

* Identified AD Forest. 
Done gathering initial info.


Doing initial required tests


Testing server: wtbhome\BIG-RIG2

Starting test: Connectivity

The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could

not be resolved to an IP address. Check the DNS server, DHCP, server

name, etc.

Neither the the server name (big-rig2.wtbhome.net) nor the Guid DNS

name (63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net) could

be resolved by DNS. Check that the server is up and is registered

correctly with the DNS server. 
Got error while checking LDAP and RPC connectivity. Please check your

firewall settings.

......................... BIG-RIG2 failed test Connectivity



Doing primary tests


Testing server: wtbhome\BIG-RIG2

Skipping all tests, because server BIG-RIG2 is not responding to

directory service requests.



Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... ForestDnsZones passed test

CrossRefValidation


Running partition tests on : DomainDnsZones

Starting test: CheckSDRefDom

......................... DomainDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... DomainDnsZones passed test

CrossRefValidation


Running partition tests on : Schema

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Schema passed test CrossRefValidation


Running partition tests on : Configuration

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Configuration passed test CrossRefValidation


Running partition tests on : wtbhome

Starting test: CheckSDRefDom

......................... wtbhome passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... wtbhome passed test CrossRefValidation


Running enterprise tests on : wtbhome.net

Starting test: LocatorCheck

Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1722

A Global Catalog Server could not be located - All GC's are down.

Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1722

A Primary Domain Controller could not be located.

The server holding the PDC role is down.

Warning: DcGetDcName(TIME_SERVER) call failed, error 1722

A Time Server could not be located.

The server holding the PDC role is down.

Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error

1722

A Good Time Server could not be located.

Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1722

A KDC could not be located - All the KDCs are down.

......................... wtbhome.net failed test LocatorCheck

Starting test: Intersite

......................... wtbhome.net passed test Intersite

ICTCity · May 2, 2011

It's frustrating, the last thing you can try is to use dcpromo /removal on your DNS. Once completed rename the server (as long it will be a standalone server), then retry the dcpromo to setup the domain again.

Be sure to be ready to setup a new DC in case this scenario will not work properly. I really apologize with you but this is my last idea :(

SailingNut · May 3, 2011

OK, I did a full search of the boot HD on the server for the string big-rig2 and here are the files where the string was found. I'm thinking of trying a "cleansing" of those references. What do you think? Sound crazy?

C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\dnsmgmt (no extension but content is XML)

C:\Users\Administrator\AppData\Roaming\Microsoft\MMC\ServerManager (no extension but content is XML)

C:\Windows\System32\config\netlogon.dns

C:\Windows\System32\config\netlogon.dnb

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-ms (binary file)

I did find a ton of hits, but they were mostly log files. These were the only ones tlat looked like they might do something.

Any of these sound promising to you?

Also, I checked and the registry is "clean" of references to big-rig2 so, it's tog to be in the files above where it's "holding on to" that name.

ICTCity · May 3, 2011

I know those files, but I actually don't know if they can edited "on the fly". My suggestion is:

Start in safe mode, modify files, restart.

Anyway, make sure you're ready to reinstall a new dc... you know, just in case.

SailingNut · May 3, 2011

Tried a bunch of things without any good luck, but think I may have some progress that we can work with.

I edited the two netlogon files and no luck. I found out that those are written out when the netlogon service starts. (Or in my case attempts to start.)

So, I went down the path of getting the AD DNS entries corrected and I tried editing the AD database with ADSIEdit. I did change one thing from big-rig2 to big-rig, but no help. I then restored to a backup I made just before doing that.

Next I put an entry in the hosts file to point big-rig2 to the same IP as big-rig. I then ran dcdiag and the output gave me some hope that we might be able to make progress from here. Here's the output:

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

Home Server = big-rig

* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: wtbhome\BIG-RIG2

Starting test: Connectivity

The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could

not be resolved to an IP address. Check the DNS server, DHCP, server

name, etc.

Got error while checking LDAP and RPC connectivity. Please check your

firewall settings.

......................... BIG-RIG2 failed test Connectivity

Doing primary tests

Testing server: wtbhome\BIG-RIG2

Skipping all tests, because server BIG-RIG2 is not responding to

directory service requests.

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... ForestDnsZones passed test

CrossRefValidation

Running partition tests on : DomainDnsZones

Starting test: CheckSDRefDom

......................... DomainDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... DomainDnsZones passed test

CrossRefValidation

Running partition tests on : Schema

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Schema passed test CrossRefValidation

Running partition tests on : Configuration

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Configuration passed test CrossRefValidation

Running partition tests on : wtbhome

Starting test: CheckSDRefDom

......................... wtbhome passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... wtbhome passed test CrossRefValidation

Running enterprise tests on : wtbhome.net

Starting test: LocatorCheck

Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1717

A Global Catalog Server could not be located - All GC's are down.

Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1717

A Primary Domain Controller could not be located.

The server holding the PDC role is down.

Warning: DcGetDcName(TIME_SERVER) call failed, error 1717

A Time Server could not be located.

The server holding the PDC role is down.

Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error

1717

A Good Time Server could not be located.

Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1717

A KDC could not be located - All the KDCs are down.

......................... wtbhome.net failed test LocatorCheck

Starting test: Intersite

......................... wtbhome.net passed test Intersite

ICTCity · May 3, 2011

Mhhhh almost the same problem as before... the problem is that netlogon has still the "big-rig2" in its config...

Adding the big-rig2 pointer to host file doesn't help... actually during replication and connectivity test things are made in a different way.

The point is: netlogon has a config file somewhere, and as you said, once it has been modified, the service re-write it and you still have the same problem.

I think the problem is the server's name, we have to find a way to change it...

Have you already tried this?

 netdom renamecomputer %computername% /NewName: /userd: /password:*

Let me know...

SailingNut · May 3, 2011

The part that seemed to give me hopw was the line:

The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server

I see that entry in ADSIEdit, but the problem is that the entry for the dnsRecord is an octet string and I don't know the meaning of the entire entry. I have been able to determine that the last 4 octets are the IPv4 address (at least in another record)

Thinking that if we clear this up that maybe some of the other tools might start working and we'll be able to clean things up.

Am I just clinging to false hope there?

if I try the netdom method to rename the computer, I'm assuming that I should name it back to big-rig2 correct? So the syntax wuold be:

netdom renamecomputer big-rig /NewName:big-rig2 /userid:{admin account} /password:{admin password}

Correct?

ICTCity · May 3, 2011

The part that seemed to give me hopw was the line:

The host 63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net could not be resolved to an IP address. Check the DNS server, DHCP, server

I see that entry in ADSIEdit, but the problem is that the entry for the dnsRecord is an octet string and I don't know the meaning of the entire entry. I have been able to determine that the last 4 octets are the IPv4 address (at least in another record)

Thinking that if we clear this up that maybe some of the other tools might start working and we'll be able to clean things up.

Am I just clinging to false hope there?

if I try the netdom method to rename the computer, I'm assuming that I should name it back to big-rig2 correct? So the syntax wuold be:
netdom renamecomputer big-rig /NewName:big-rig2 /userid:{admin account} /password:{admin password}
Correct?

Let's give it a try...

Click here: http://www.translatorscafe.com/cafe/units-converter/numbers/calculator/octal-to-decimal/

You can easly convert from octal to decimal.

In this case you also add in HOST file this line:

63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net IP_big-rig or localhost... no idea... but I think it's the same...

Wait before the rename... try this first.

SailingNut · May 3, 2011

Let's give it a try...

Click here: http://www.translatorscafe.com/cafe/units-converter/numbers/calculator/octal-to-decimal/

You can easly convert from octal to decimal.

In this case you also add in HOST file this line:

63fa3998-2396-4450-b046-a8ceb3bf85dc._msdcs.wtbhome.net IP_big-rig or localhost... no idea... but I think it's the same...

Wait before the rename... try this first.

It's not the octal to decimal that is giving me a problem. It's the meaning of the entire octet string. There are lots of bytes in there but I've only figured out what the last 4 are in a regular DNS entry. I may need to change things other than just the IP address. (Currently it has a nonsensical IP address)

ICTCity · May 3, 2011

So you could just add the string in host file..

can you PM the string pls?

SailingNut · May 4, 2011

I followed the steps in http://support.microsoft.com/kb/816587/en-us and my DC is configured as it should be. All of the SRV entries listed in the KB point to big-rig.wtbhome.net

ICTCity · May 4, 2011

So it's time to rename... If you can't do this "normally" try in safe mode.

Good luck

SailingNut · May 16, 2011

So I FINALLY had time to do the demote - rename - promote process you suggested. It appears to have worked. I recreated my domain user accounts and things look good.

I do see some errors in dcdiag still, but not sure if they may be expected given my setup.

Here's the output:

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

Home Server = big-rig

* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\BIG-RIG

Starting test: Connectivity

......................... BIG-RIG passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\BIG-RIG

Starting test: Advertising

......................... BIG-RIG passed test Advertising

Starting test: FrsEvent

......................... BIG-RIG passed test FrsEvent

Starting test: DFSREvent

There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
......................... BIG-RIG failed test DFSREvent

Starting test: SysVolCheck

......................... BIG-RIG passed test SysVolCheck

Starting test: KccEvent

......................... BIG-RIG passed test KccEvent

Starting test: KnowsOfRoleHolders

......................... BIG-RIG passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... BIG-RIG passed test MachineAccount

Starting test: NCSecDesc

......................... BIG-RIG passed test NCSecDesc

Starting test: NetLogons

......................... BIG-RIG passed test NetLogons

Starting test: ObjectsReplicated

......................... BIG-RIG passed test ObjectsReplicated

Starting test: Replications

......................... BIG-RIG passed test Replications

Starting test: RidManager

......................... BIG-RIG passed test RidManager

Starting test: Services

......................... BIG-RIG passed test Services

Starting test: SystemLog

An error event occurred. EventID: 0x0000040B

Time Generated: 05/15/2011 20:30:39

Event String:

The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data.

An error event occurred. EventID: 0x0000040C

Time Generated: 05/15/2011 20:30:39

Event String:

The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data.

An error event occurred. EventID: 0xC0001B61

Time Generated: 05/15/2011 20:30:43

Event String:

A timeout was reached (30000 milliseconds) while waiting for the File Replication Service service to connect.

A warning event occurred. EventID: 0x00002724

Time Generated: 05/15/2011 20:30:46

Event String:

This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.

A warning event occurred. EventID: 0x800009CA

Time Generated: 05/15/2011 20:30:47

Event String:

The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.

A warning event occurred. EventID: 0x800009CA

Time Generated: 05/15/2011 20:30:50

Event String:

The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.

An error event occurred. EventID: 0x0000002E

Time Generated: 05/15/2011 20:44:05

Event String:

The time service encountered an error and was forced to shut down. The error was: 0x80070700: An attempt was made to logon, but the network logon service was not started.

An error event occurred. EventID: 0xC0001B6F

Time Generated: 05/15/2011 20:44:05

Event String:

The Windows Time service terminated with the following error:

An error event occurred. EventID: 0x0000002E

Time Generated: 05/15/2011 20:44:28

Event String:

The time service encountered an error and was forced to shut down. The error was: 0x80070005: Access is denied.

An error event occurred. EventID: 0xC0001B6F

Time Generated: 05/15/2011 20:44:28

Event String:

The Windows Time service terminated with the following error:

A warning event occurred. EventID: 0x8000001D

Time Generated: 05/15/2011 20:46:52

Event String:

The Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.

A warning event occurred. EventID: 0x800009CA

Time Generated: 05/15/2011 20:47:00

Event String:

The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.

A warning event occurred. EventID: 0x800009CA

Time Generated: 05/15/2011 20:47:03

Event String:

The value named BIG-RIG in the server's registry key OptionalNames was not valid, and was ignored. If you want to change the value, change it to one that is the correct type and is within the acceptable range, or delete the value to use the default. This value might have been set up by an older program that did not use the correct boundaries.

An error event occurred. EventID: 0x0000040B

Time Generated: 05/15/2011 20:47:15

Event String:

The DHCP service was unable to create or lookup the DHCP Users local group on this computer. The error code is in the data.

An error event occurred. EventID: 0x0000040C

Time Generated: 05/15/2011 20:47:15

Event String:

The DHCP server was unable to create or lookup the DHCP Administrators local group on this computer. The error code is in the data.

A warning event occurred. EventID: 0x000003F6

Time Generated: 05/15/2011 20:47:28

Event String:

Name resolution for the name _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.WTBHOME.NET timed out after none of the configured DNS servers responded.

A warning event occurred. EventID: 0x00002724

Time Generated: 05/15/2011 20:47:34

Event String:

This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.

An error event occurred. EventID: 0xC00038D6

Time Generated: 05/15/2011 20:47:38

Event String:

The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.

A warning event occurred. EventID: 0x0000000C

Time Generated: 05/15/2011 20:47:37

Event String:

Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.

An error event occurred. EventID: 0x00000423

Time Generated: 05/15/2011 20:47:43

Event String:

The DHCP service failed to see a directory server for authorization.

An error event occurred. EventID: 0x00000423

Time Generated: 05/15/2011 20:47:43

Event String:

The DHCP service failed to see a directory server for authorization.

A warning event occurred. EventID: 0x0000A001

Time Generated: 05/15/2011 20:47:43

Event String:

The Security System could not establish a secured connection with the server ldap/wtbhome.net/wtbhome.net@WTBHOME.NET. No authentication protocol was available.

An error event occurred. EventID: 0xC00038D6

Time Generated: 05/15/2011 20:47:53

Event String:

The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.

A warning event occurred. EventID: 0x000727AA

Time Generated: 05/15/2011 20:50:04

Event String:

The WinRM service failed to create the following SPNs: WSMAN/big-rig.wtbhome.net; WSMAN/big-rig.

An error event occurred. EventID: 0x0000165B

Time Generated: 05/15/2011 21:13:30

Event String:

The session setup from computer 'CHGSINLATTITUDE' failed because the security database does not contain a trust account 'CHGSINLATTITUDE$' referenced by the specified computer.

An error event occurred. EventID: 0x000016AD

Time Generated: 05/15/2011 21:15:52

Event String:

The session setup from the computer CHGSINLATTITUDE failed to authenticate. The following error occurred:

An error event occurred. EventID: 0x0000165B

Time Generated: 05/15/2011 21:15:52

Event String:

The session setup from computer 'MISSMAGIC' failed because the security database does not contain a trust account 'MISSMAGIC$' referenced by the specified computer.

......................... BIG-RIG failed test SystemLog

Starting test: VerifyReferences

......................... BIG-RIG passed test VerifyReferences

Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom