Are there any ActiveDirectory experts on here?

[TheAngryDog]

I have some very odd issues that are causing me problems, and it is now beyond my knowledge. If anyone here is knowledgeable about AD and is happy to offer me some advice I would be very grateful.

Thank you.

[moonigan]

What problems are you having.

[TheAngryDog]

Some of them I have managed to sort / was chasing ghosts.

The issues I seem to have now are:

1) "Primary DC" isn't giving out DHCP leases (it used to).
2) When I reboot the "Primary DC" the internet goes down with it (it didn't use to).

When users log on to the domain they get logged onto DC-A or DC-B, but the address only gets issued from DC-B.

That seems to be my main issues right now.

[UpTheIron]

We probably need to start with an overview of your setup, but...

The concept of PDC/BDC doesn't apply to AD, just NT4 and earlier domains (FSMO roles yes, but that's different).

First Problem: A Domain Controller isn't responsible for dishing out IP Addresses, a DHCP server is (albeit one that might be authorised in AD if it's Windows DHCP). Is this server also supposed to be a DHCP server? What changed recently (you said "it used to"). Is a scope configured & activated, and is the server authorised?

Second Problem: It sounds like that server is being used as a proxy or router of some sort. Again, what changed have been made, and what should the setup be?

Final problem: By "logged onto" I guess you mean "authenticated by" DCA/DCB - how are you working this out? Same for the address... I presume you mean IP address and that DCB is also a DHCP server.

I assume this kit is all supporting a business of some sort. Who is responsible for looking after it? It sounds like a whole host of issues going on...

[moonigan]

TheAngryDog said:

Some of them I have managed to sort / was chasing ghosts.

The issues I seem to have now are:

1) "Primary DC" isn't giving out DHCP leases (it used to).
2) When I reboot the "Primary DC" the internet goes down with it (it didn't use to).

When users log on to the domain they get logged onto DC-A or DC-B, but the address only gets issued from DC-B.

That seems to be my main issues right now.

Issue 2 sounds like a DNS type issue assuming the internet connection is firewalled/proxied by something other than the PDC. To confirm this you could reboot PDC and then open a command prompt and type nslookup. At the prompt type www.google.co.uk. If it resolves to an ip address try pinging www.google.co.uk and then trying pinging the address it resolves. If pinging the IP works then its a DNS issue.


If you have multiple DCs open a command prompt on one of them and run DCDIAG /e /v /f: dcdiag.log once its finished open the log file and look for any errors.

[rsbmw]

Concur, reauthorise DC-A as a DHCP server, ensure scope configured and you haven't run out of leases. Sounds like it's also your only DNS server configured for clients (in the DHCP scope), thus DNS vanishes as you reboot.

[TheAngryDog]

Sorry, I was a little rushed when I wrote my OP.

UpTheIron said:

We probably need to start with an overview of your setup, but...

The concept of PDC/BDC doesn't apply to AD, just NT4 and earlier domains (FSMO roles yes, but that's different).

I know - I meant primary as in the FSMO role holding DC and the first DC that was on the network.

UpTheIron said:

First Problem: A Domain Controller isn't responsible for dishing out IP Addresses, a DHCP server is (albeit one that might be authorised in AD if it's Windows DHCP). Is this server also supposed to be a DHCP server? What changed recently (you said "it used to"). Is a scope configured & activated, and is the server authorised?

I know, but ours are dual purpose - DC's and DHCP.. The server is authorised. WRT what changed, I recently changed our AV solution, but I do not know if this issue started happening before or after. I changed the AV in December, both servers have the AV, same rules in the FW and same AV policy.

UpTheIron said:

Second Problem: It sounds like that server is being used as a proxy or router of some sort. Again, what changed have been made, and what should the setup be?

It should just be serving DNS. We have a SonicWall NSA3600 which is the gateway. Before these issues started happening I used to be able to reboot either of the DC's and the internet would not drop. I can only reboot DC-B now without the internet dropping. Oddly, when I reboot DC-A I can maintain a continuous ping to 8.8.8.8 but not browse the web.

UpTheIron said:

Final problem: By "logged onto" I guess you mean "authenticated by" DCA/DCB - how are you working this out? Same for the address... I presume you mean IP address and that DCB is also a DHCP server.

I assume this kit is all supporting a business of some sort. Who is responsible for looking after it? It sounds like a whole host of issues going on...

Yes, that is what I meant. I am working it out from the client using the simple echo %logonserver% command.
The IP addresses for connected devices are only being issued from DC-B).

I am responsible for it. I inherited the network, and have made some changes to it over the time, such as a new DC / DHCP and it had been working fine. I rarely make changes to the system which is why I am confused at it no longer working as it once was.

Replication between the DC's is working.

moonigan said:

Issue 2 sounds like a DNS type issue assuming the internet connection is firewalled/proxied by something other than the PDC. To confirm this you could reboot PDC and then open a command prompt and type nslookup. At the prompt type www.google.co.uk. If it resolves to an ip address try pinging www.google.co.uk and then trying pinging the address it resolves. If pinging the IP works then its a DNS issue.


If you have multiple DCs open a command prompt on one of them and run DCDIAG /e /v /f: dcdiag.log once its finished open the log file and look for any errors.

When I run the nslookup:

From DC-A:

C:\TEMP>nslookup
Default Server: dc-a.domain.local
Address: 192.168.40.23

> ping bbc.co.uk
Server: bbc.co.uk
Addresses: 2a04:4e42:200::81
2a04:4e42:400::81
2a04:4e42:600::81
2a04:4e42::81
151.101.192.81
151.101.0.81
151.101.64.81
151.101.128.81

• * bbc.co.uk can't find ping: No response from server

> ping 151.101.128.81
Server: [151.101.128.81]
Address: 151.101.128.81

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

• * Request to 151.101.128.81 timed-out

> exit

C:\TEMP>ping bbc.co.uk

Pinging bbc.co.uk [151.101.0.81] with 32 bytes of data:
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57
Reply from 151.101.0.81: bytes=32 time=12ms TTL=57
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57
Reply from 151.101.0.81: bytes=32 time=12ms TTL=57

Ping statistics for 151.101.0.81:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 12ms, Average = 11ms

C:\TEMP>nslookup
Default Server: dc-a.domain.local
Address: 192.168.40.23

> ping 151.101.0.81
Server: [151.101.0.81]
Address: 151.101.0.81

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

• * Request to 151.101.0.81 timed-out

>

From DB-B:

C:\Windows\system32>nslookup
Default Server: dc-b.domain.local
Address: 192.168.40.29

> ping bbc.co.uk
Server: bbc.co.uk
Addresses: 2a04:4e42:600::81
2a04:4e42:400::81
2a04:4e42::81
2a04:4e42:200::81
151.101.128.81
151.101.0.81
151.101.64.81
151.101.192.81

• * bbc.co.uk can't find ping: No response from server

> ping 151.101.192.81
Server: [151.101.192.81]
Address: 151.101.192.81

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

• * Request to 151.101.192.81 timed-out

> exit

C:\Windows\system32>ping bbc.co.uk

Pinging bbc.co.uk [151.101.0.81] with 32 bytes of data:
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57
Reply from 151.101.0.81: bytes=32 time=11ms TTL=57

Ping statistics for 151.101.0.81:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 11ms, Average = 11ms

C:\Windows\system32>nslookup
Default Server: dc-b.domain.local
Address: 192.168.40.29

> ping 151.101.0.81
Server: [151.101.0.81]
Address: 151.101.0.81

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.

• * Request to 151.101.0.81 timed-out

>

I ran the DCDIAG. There are some DFSREvent failures, but these seem to be at times when I was rebooting the servers. Otherwise all passed.

Several of these:
Test omitted by user request: DNS

rsbmw said:

Concur, reauthorise DC-A as a DHCP server, ensure scope configured and you haven't run out of leases. Sounds like it's also your only DNS server configured for clients (in the DHCP scope), thus DNS vanishes as you reboot.

I reauthorised DC-A yesterday, didn't a difference. Scope is configured. 40.130 - 40.165 on DC-A, 40.179 - 40.228 on DB-B.

Both servers are configured as DNS. It does look like that there is a slight variance in the DNS servers config in DHCP;

DC-A has the order as 40.23, 40.29.
DB-B has the order as 40.29, 40.23.

I thought these replicated?

I ran a dcdiag /test:dns:


Directory Server Diagnosis


Performing initial setup:

Trying to find home server...

Home Server = DC-A

* Identified AD Forest.
Done gathering initial info.


Doing initial required tests


Testing server: Default-First-Site-Name\DC-A

Starting test: Connectivity

......................... DC-A passed test Connectivity



Doing primary tests


Testing server: Default-First-Site-Name\DC-A


Starting test: DNS



DNS Tests are running and not hung. Please wait a few minutes...

......................... DC-A passed test DNS


Running partition tests on : DomainDnsZones


Running partition tests on : ForestDnsZones


Running partition tests on : Schema


Running partition tests on : Configuration


Running partition tests on : domain


Running enterprise tests on : domain.local

Starting test: DNS

Test results for domain controllers:


DC: DC-A.domain.local

Domain: domain.local




TEST: Delegations (Del)
Error: DNS server: servernolongerondomain.domain.local. IP:<Unavailable>

[Missing glue A record]


Summary of DNS test results:


Auth Basc Forw Del Dyn RReg Ext
_____________________________________________________________
Domain: domain.local

DC-A PASS PASS PASS FAIL PASS PASS n/a

......................... domain.local failed test DNS

[TheAngryDog]

Spotted an oddity. In DNS on DC-A it lists two servers for DC-A:

DC-A
DC-A.domain.local

On DC-B it only shows the one:

DC-B.domain.local

[Harpoon]

If you run IPCONFIG /All on a client getting a DHCP lease, does it have both DCs assigned for DNS?

[TheAngryDog]

Harpoon said:

If you run IPCONFIG /All on a client getting a DHCP lease, does it have both DCs assigned for DNS?

Yes it does.

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : domain.local
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (4) I219-LM
Physical Address. . . . . . . . . : D4-81-D7-66-C4-62
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.40.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 11 January 2019 08:58:24
Lease Expires . . . . . . . . . . : 12 January 2019 08:58:23
Default Gateway . . . . . . . . . : 192.168.40.1
DHCP Server . . . . . . . . . . . : 192.168.40.29
DNS Servers . . . . . . . . . . . : 192.168.40.29
192.168.40.23
NetBIOS over Tcpip. . . . . . . . : Enabled

U:\>echo %logonserver%
\\DC-B

Another client machine:

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . : domain.local
Description . . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM
Physical Address. . . . . . . . . : 28-F1-0E-28-38-D8
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.40.185(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : 11 January 2019 08:57:07
Lease Expires . . . . . . . . . . : 12 January 2019 08:57:07
Default Gateway . . . . . . . . . : 192.168.40.1
DHCP Server . . . . . . . . . . . : 192.168.40.29
DNS Servers . . . . . . . . . . . : 192.168.40.29
192.168.40.23
NetBIOS over Tcpip. . . . . . . . : Enabled

U:\>echo %logonserver%
\\DC-A

[TheAngryDog]

When I reboot DC-A, there is an error in the System Log referring to DHCP:

The DHCP service failed to see a directory server for authorization.

Followed by:

The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain tmd.local, has determined that it is authorized to start. It is servicing clients now.

And then another:

The DHCP service failed to see a directory server for authorization.

DC-A is also the authorative time server and that doesn't seem to be working correctly:

The time service has stopped advertising as a good time source.

Followed by:

The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->51.141.32.51:123).

[Harpoon]

So DHCP is giving out both DCs for DNS which is good.

What is the new AV software installed? Does it include firewall functionality?

From a client, run

NSLookup
Server 192.168.40.23
www.bbc.co.uk

Do you get an answer as in an IP or a time out??

Repeat but this time use the IP for DC B. Similar result?

[rsbmw]

TheAngryDog said:

When I reboot DC-A, there is an error in the System Log referring to DHCP:

The DHCP service failed to see a directory server for authorization.

Followed by:

The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain tmd.local, has determined that it is authorized to start. It is servicing clients now.

And then another:

The DHCP service failed to see a directory server for authorization.

DC-A is also the authorative time server and that doesn't seem to be working correctly:

The time service has stopped advertising as a good time source.

Followed by:

The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->51.141.32.51:123).

These aren't great symptoms. I would be tempted to sieze the fsmo roles to the other one, remove this one (dcpromo), possibly rebuild and then re-add. You would need to ensure you remove it as a DNS server from DHCP scope on the other for the duration.

[TheAngryDog]

Harpoon said:

So DHCP is giving out both DCs for DNS which is good.

What is the new AV software installed? Does it include firewall functionality?

ESET Advanced Security. It does not include a firewall for Windows servers. The Windows firewall is enabled. All ports that I believe are required are open.

Harpoon said:

From a client, run

NSLookup
Server 192.168.40.23
www.bbc.co.uk

Do you get an answer as in an IP or a time out??

Repeat but this time use the IP for DC B. Similar result?

U:\>nslookup
Default Server: dc-b.domain.local
Address: 192.168.40.29

> server 192.168.40.23
Default Server: dc-a.domain.local
Address: 192.168.40.23

> www.bbc.co.uk
Server: dc-a.domain.local
Address: 192.168.40.23

Non-authoritative answer:
Name: www.bbc.net.uk
Addresses: 212.58.244.27
212.58.249.215
Aliases: www.bbc.co.uk

> server 192.168.40.29
Default Server: dc-b.domain.local
Address: 192.168.40.29

> www.bbc.co.uk
Server: dc-b.domain.local
Address: 192.168.40.29

Non-authoritative answer:
Name: www.bbc.net.uk
Addresses: 212.58.249.210
212.58.244.68
Aliases: www.bbc.co.uk

[TheAngryDog]

rsbmw said:

TheAngryDog said:

When I reboot DC-A, there is an error in the System Log referring to DHCP:

The DHCP service failed to see a directory server for authorization.

Followed by:

The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain tmd.local, has determined that it is authorized to start. It is servicing clients now.

And then another:

The DHCP service failed to see a directory server for authorization.

DC-A is also the authorative time server and that doesn't seem to be working correctly:

The time service has stopped advertising as a good time source.

Followed by:

The time service is now synchronizing the system time with the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->51.141.32.51:123).

These aren't great symptoms. I would be tempted to sieze the fsmo roles to the other one, remove this one (dcpromo), possibly rebuild and then re-add. You would need to ensure you remove it as a DNS server from DHCP scope on the other for the duration.

My only concerns are that when I reboot / power off DC-A we lose all of our internet, otherwise I would be able to do that.

[rsbmw]

It might be that DC-B isn't serving DNS.

Set your client to only use DC-B for DNS and see what happens, if it works see what happens when you reboot DC-A. What does DC-B use as it's DNS server?

[TheAngryDog]

rsbmw said:

It might be that DC-B isn't serving DNS.

Set your client to only use DC-B for DNS and see what happens, if it works see what happens when you reboot DC-A. What does DC-B use as it's DNS server?

DC-A

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
Physical Address. . . . . . . . . : 00-15-5D-5A-16-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.40.23(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.40.1
DNS Servers . . . . . . . . . . . : 192.168.40.23
192.168.40.29
NetBIOS over Tcpip. . . . . . . . : Enabled

DC-B

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : QLogic BCM5709C Gigabit Ethernet (NDIS VBD Client) #36
Physical Address. . . . . . . . . : 00-22-19-69-20-7F
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.40.29(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.40.1
DNS Servers . . . . . . . . . . . : 192.168.40.29
192.168.40.23
NetBIOS over Tcpip. . . . . . . . : Enabled

[TheAngryDog]

Ethernet adapter Ethernet:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (4) I219-LM
Physical Address. . . . . . . . . : D4-81-D7-66-C4-62
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.40.187(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.40.1
DNS Servers . . . . . . . . . . . : 192.168.40.29
NetBIOS over Tcpip. . . . . . . . : Enabled

I can browse the web using DB-B as my DNS server.

[buggalugs]

Do both DC’s have a sysvol share? As this indicates a reasonable degree of health of the AD. Check the event logs for file replication service and directory services. Check that the DNS settings on both DC’s are correct. Check what the forwarders are set to in DNS on both DC’s.

[TheAngryDog]

buggalugs said:

Do both DC’s have a sysvol share? As this indicates a reasonable degree of health of the AD. Check the event logs for file replication service and directory services. Check that the DNS settings on both DC’s are correct. Check what the forwarders are set to in DNS on both DC’s.

Yes they both have a SYSVOL share.
There are errors in the logs, but these correspond with reboots of the servers.
The forwarders are both going to the same IP addresses.