Logins fail if one DC unavailable

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Two domains - Two DCs in one domain, one DC in a child domain

If DC1 is unavailable, even though DC2 and DC3 are available, no one can
login.

REPADMIN /showreps looks fine.

The only clue I can find is this: I was writing a perl script to authenicate
a user. The bind fails no matter what I do.

I get a similiar message if I run repadmin /bind DSA:
DsBindWithCred to dsa failed with status 1722 (0x6ba):
The RPC server is unavailable.

I know this has got to be simple, but I'm stumped.

BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to W2K3.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

"DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
> Two domains - Two DCs in one domain, one DC in a child domain
>
> If DC1 is unavailable, even though DC2 and DC3 are available, no one can
> login.
> REPADMIN /showreps looks fine.

Ok, that eliminates replication but the most common
reason is that one of the DCs is not registered properly
in DNS OR your DNS is only correct on the other (missing)
DC.

Most replication and authentication problems are based on
DNS problems.

> The only clue I can find is this: I was writing a perl script to
authenicate
> a user. The bind fails no matter what I do.
> I get a similiar message if I run repadmin /bind DSA:
> DsBindWithCred to dsa failed with status 1722 (0x6ba):
> The RPC server is unavailable.

This might be important and represent some serious problem
with the (other) DC, but let's do the obvious first.

> I know this has got to be simple, but I'm stumped.
> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to
W2K3.

Pretty much irrelevant as long are you clients are Win2000+
and you aren't discussing BDCs.

Roles can affect clients but seldom in authentication (e.g.,
browsing) unless the client is Win9x or NT, and thus
(could be) dependent on the PDC emulator.

First, run DCDiag on the problematic DC -- and save the
output to a text file (/?) -- search the file for FAIL, ERROR,
WARN and either fix those errors or report them (here).

Check you DNS architecture:

DNS
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2

Restart NetLogon on any DC if you change any of the above that
affects a DC.

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.


--
Herb Martin

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
really handles authentication, I believe.

Ken


"Herb Martin" <news@LearnQuick.com> wrote in message
news:OXHKM0E3EHA.1144@TK2MSFTNGP09.phx.gbl...
> "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
> newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
>> Two domains - Two DCs in one domain, one DC in a child domain
>>
>> If DC1 is unavailable, even though DC2 and DC3 are available, no one can
>> login.
>> REPADMIN /showreps looks fine.
>
> Ok, that eliminates replication but the most common
> reason is that one of the DCs is not registered properly
> in DNS OR your DNS is only correct on the other (missing)
> DC.
>
> Most replication and authentication problems are based on
> DNS problems.
>
>> The only clue I can find is this: I was writing a perl script to
> authenicate
>> a user. The bind fails no matter what I do.
>> I get a similiar message if I run repadmin /bind DSA:
>> DsBindWithCred to dsa failed with status 1722 (0x6ba):
>> The RPC server is unavailable.
>
> This might be important and represent some serious problem
> with the (other) DC, but let's do the obvious first.
>
>> I know this has got to be simple, but I'm stumped.
>> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to
> W2K3.
>
> Pretty much irrelevant as long are you clients are Win2000+
> and you aren't discussing BDCs.
>
> Roles can affect clients but seldom in authentication (e.g.,
> browsing) unless the client is Win9x or NT, and thus
> (could be) dependent on the PDC emulator.
>
> First, run DCDiag on the problematic DC -- and save the
> output to a text file (/?) -- search the file for FAIL, ERROR,
> WARN and either fix those errors or report them (here).
>
> Check you DNS architecture:
>
> DNS
> 1) Dynamic for the zone supporting AD
> 2) All internal DNS clients NIC\IP properties must specify SOLELY
> that internal, dynamic DNS server (set.)
> 3) DCs and even DNS servers are DNS clients too -- see #2
>
> Restart NetLogon on any DC if you change any of the above that
> affects a DC.
>
> Ensure that DNS zones/domains are fully replicated to all DNS
> servers for that (internal) zone/domain.
>
>
> --
> Herb Martin
>
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I think you hit it: No, DC2 and DC3 are not GCs. It makes since they would
have to be, but I was told to not make multiple DCs to be GCs in a single
domain forest (which part of mine is). But then if DC1 goes away so does my
GC therefore no login.

Can someone confirm it's OK to have multiple GCs in one domain?

Dave

"Ken B" wrote:

> One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
> really handles authentication, I believe.
>
> Ken

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

"DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
news:BE484F91-C936-47CF-A059-951D045514DE@microsoft.com...
> I think you hit it: No, DC2 and DC3 are not GCs. It makes since they would
> have to be, but I was told to not make multiple DCs to be GCs in a single
> domain forest (which part of mine is).

I cannot imagine why.

In fact, may people recommend the OPPOSITE:

Make all DCs GCs in a single domain forest.

You incur no (significant) replication burden even
for giant domains since each DC already holds all
the records anyway.

The case for non-GCs is when you have multiple
LARGE (giant really) Domains and each GC much
copy large amounts of data from all other domains.


> But then if DC1 goes away so does my
> GC therefore no login.
>
> Can someone confirm it's OK to have multiple GCs in one domain?

It's not only ok, it's expected and no real problem to have
them ALL be GCs in a single domain forest.

The Infrastructure Master is not supposed to be a GC in a
multi-domain forest would be the only practical limitation
for small to medium forests.

--
Herb Martin


>
> Dave
>
> "Ken B" wrote:
>
> > One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
> > really handles authentication, I believe.
> >
> > Ken

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)


So you have 3 DCs ... 2 in a domain and 1 in another. I really don't see a
solution to your problem ... because you can't put GC on the Infrastructure
Master (actually you can ... but don't do it); and you'll have an
Infrastructure Master in each domain (2) ... so if someone have an ideea
..... (of couse not the answer: add more machines).
You see ... that is why is better to keep a single domain

Regards,
--
Andrei Ungureanu
www.eventid.net
Free Windows event logs reports
http://www.altairtech.ca/evlog/

"Herb Martin" <news@LearnQuick.com> wrote in message
news:e7YxQAK3EHA.2572@TK2MSFTNGP11.phx.gbl...
> "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
> news:BE484F91-C936-47CF-A059-951D045514DE@microsoft.com...
>> I think you hit it: No, DC2 and DC3 are not GCs. It makes since they
>> would
>> have to be, but I was told to not make multiple DCs to be GCs in a single
>> domain forest (which part of mine is).
>
> I cannot imagine why.
>
> In fact, may people recommend the OPPOSITE:
>
> Make all DCs GCs in a single domain forest.
>
> You incur no (significant) replication burden even
> for giant domains since each DC already holds all
> the records anyway.
>
> The case for non-GCs is when you have multiple
> LARGE (giant really) Domains and each GC much
> copy large amounts of data from all other domains.
>
>
>> But then if DC1 goes away so does my
>> GC therefore no login.
>>
>> Can someone confirm it's OK to have multiple GCs in one domain?
>
> It's not only ok, it's expected and no real problem to have
> them ALL be GCs in a single domain forest.
>
> The Infrastructure Master is not supposed to be a GC in a
> multi-domain forest would be the only practical limitation
> for small to medium forests.
>
> --
> Herb Martin
>
>
>>
>> Dave
>>
>> "Ken B" wrote:
>>
>> > One other thing to check... are DC's 2 & 3 Global Catalogs? That's
>> > what
>> > really handles authentication, I believe.
>> >
>> > Ken
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

One small question, where are DC1, DC2, and DC3. I mean that which DC in
which domain?

--
Yours truly,
Mohammed A. Raslan
Systems Engineer / Consultant
MCSE+I NT4, MCSA: Security , MCSE: Security, MCDBA, CCNA
Mobile: +20 (12) 36 26 112 / +965 978 1969
E-Mail: m_raslan@link.net.removethis


"Andrei Ungureanu" <andreix.nospam@msn.com> wrote in message
news:OLHGsQP3EHA.3388@TK2MSFTNGP15.phx.gbl...
>
> So you have 3 DCs ... 2 in a domain and 1 in another. I really don't see a
> solution to your problem ... because you can't put GC on the
Infrastructure
> Master (actually you can ... but don't do it); and you'll have an
> Infrastructure Master in each domain (2) ... so if someone have an ideea
> .... (of couse not the answer: add more machines).
> You see ... that is why is better to keep a single domain
>
> Regards,
> --
> Andrei Ungureanu
> www.eventid.net
> Free Windows event logs reports
> http://www.altairtech.ca/evlog/
>
> "Herb Martin" <news@LearnQuick.com> wrote in message
> news:e7YxQAK3EHA.2572@TK2MSFTNGP11.phx.gbl...
> > "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
> > news:BE484F91-C936-47CF-A059-951D045514DE@microsoft.com...
> >> I think you hit it: No, DC2 and DC3 are not GCs. It makes since they
> >> would
> >> have to be, but I was told to not make multiple DCs to be GCs in a
single
> >> domain forest (which part of mine is).
> >
> > I cannot imagine why.
> >
> > In fact, may people recommend the OPPOSITE:
> >
> > Make all DCs GCs in a single domain forest.
> >
> > You incur no (significant) replication burden even
> > for giant domains since each DC already holds all
> > the records anyway.
> >
> > The case for non-GCs is when you have multiple
> > LARGE (giant really) Domains and each GC much
> > copy large amounts of data from all other domains.
> >
> >
> >> But then if DC1 goes away so does my
> >> GC therefore no login.
> >>
> >> Can someone confirm it's OK to have multiple GCs in one domain?
> >
> > It's not only ok, it's expected and no real problem to have
> > them ALL be GCs in a single domain forest.
> >
> > The Infrastructure Master is not supposed to be a GC in a
> > multi-domain forest would be the only practical limitation
> > for small to medium forests.
> >
> > --
> > Herb Martin
> >
> >
> >>
> >> Dave
> >>
> >> "Ken B" wrote:
> >>
> >> > One other thing to check... are DC's 2 & 3 Global Catalogs? That's
> >> > what
> >> > really handles authentication, I believe.
> >> >
> >> > Ken
> >
> >
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

This was the answer. Once I made DC2 (in the same domain as DC1) and DC3 (in
a child domain) all GC servers, all three can now handle logins.

Considering what I have, should I be concerned that DC1 and DC3 are a GC and
the Infrastruture master? I really have no choice, do I?

Thanks.

Dave

"Ken B" wrote:

> One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
> really handles authentication, I believe.
>
> Ken
>
>
> "Herb Martin" <news@LearnQuick.com> wrote in message
> news:OXHKM0E3EHA.1144@TK2MSFTNGP09.phx.gbl...
> > "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
> > newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
> >> Two domains - Two DCs in one domain, one DC in a child domain
> >>
> >> If DC1 is unavailable, even though DC2 and DC3 are available, no one can
> >> login.
> >> REPADMIN /showreps looks fine.
> >
> > Ok, that eliminates replication but the most common
> > reason is that one of the DCs is not registered properly
> > in DNS OR your DNS is only correct on the other (missing)
> > DC.
> >
> > Most replication and authentication problems are based on
> > DNS problems.
> >
> >> The only clue I can find is this: I was writing a perl script to
> > authenicate
> >> a user. The bind fails no matter what I do.
> >> I get a similiar message if I run repadmin /bind DSA:
> >> DsBindWithCred to dsa failed with status 1722 (0x6ba):
> >> The RPC server is unavailable.
> >
> > This might be important and represent some serious problem
> > with the (other) DC, but let's do the obvious first.
> >
> >> I know this has got to be simple, but I'm stumped.
> >> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to
> > W2K3.
> >
> > Pretty much irrelevant as long are you clients are Win2000+
> > and you aren't discussing BDCs.
> >
> > Roles can affect clients but seldom in authentication (e.g.,
> > browsing) unless the client is Win9x or NT, and thus
> > (could be) dependent on the PDC emulator.
> >
> > First, run DCDiag on the problematic DC -- and save the
> > output to a text file (/?) -- search the file for FAIL, ERROR,
> > WARN and either fix those errors or report them (here).
> >
> > Check you DNS architecture:
> >
> > DNS
> > 1) Dynamic for the zone supporting AD
> > 2) All internal DNS clients NIC\IP properties must specify SOLELY
> > that internal, dynamic DNS server (set.)
> > 3) DCs and even DNS servers are DNS clients too -- see #2
> >
> > Restart NetLogon on any DC if you change any of the above that
> > affects a DC.
> >
> > Ensure that DNS zones/domains are fully replicated to all DNS
> > servers for that (internal) zone/domain.
> >
> >
> > --
> > Herb Martin
> >
> >
> >
>
>
>

 

[enkidu]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

If all DCs are also GCs, this is NOT a problem.

http://support.microsoft.com/kb/223346

I'm a little surprised that no one has pointed this out.

Cheers,

Cliff

On Wed, 8 Dec 2004 21:15:05 -0800, DaveinPNG
<DaveinPNG@discussions.microsoft.com> wrote:

>This was the answer. Once I made DC2 (in the same domain as DC1) and DC3 (in
>a child domain) all GC servers, all three can now handle logins.
>
>Considering what I have, should I be concerned that DC1 and DC3 are a GC and
>the Infrastruture master? I really have no choice, do I?
>
>Thanks.
>
>Dave
>
>"Ken B" wrote:
>
>> One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
>> really handles authentication, I believe.
>>
>> Ken
>>
>>
>> "Herb Martin" <news@LearnQuick.com> wrote in message
>> news:OXHKM0E3EHA.1144@TK2MSFTNGP09.phx.gbl...
>> > "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
>> > newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
>> >> Two domains - Two DCs in one domain, one DC in a child domain
>> >>
>> >> If DC1 is unavailable, even though DC2 and DC3 are available, no one can
>> >> login.
>> >> REPADMIN /showreps looks fine.
>> >
>> > Ok, that eliminates replication but the most common
>> > reason is that one of the DCs is not registered properly
>> > in DNS OR your DNS is only correct on the other (missing)
>> > DC.
>> >
>> > Most replication and authentication problems are based on
>> > DNS problems.
>> >
>> >> The only clue I can find is this: I was writing a perl script to
>> > authenicate
>> >> a user. The bind fails no matter what I do.
>> >> I get a similiar message if I run repadmin /bind DSA:
>> >> DsBindWithCred to dsa failed with status 1722 (0x6ba):
>> >> The RPC server is unavailable.
>> >
>> > This might be important and represent some serious problem
>> > with the (other) DC, but let's do the obvious first.
>> >
>> >> I know this has got to be simple, but I'm stumped.
>> >> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to
>> > W2K3.
>> >
>> > Pretty much irrelevant as long are you clients are Win2000+
>> > and you aren't discussing BDCs.
>> >
>> > Roles can affect clients but seldom in authentication (e.g.,
>> > browsing) unless the client is Win9x or NT, and thus
>> > (could be) dependent on the PDC emulator.
>> >
>> > First, run DCDiag on the problematic DC -- and save the
>> > output to a text file (/?) -- search the file for FAIL, ERROR,
>> > WARN and either fix those errors or report them (here).
>> >
>> > Check you DNS architecture:
>> >
>> > DNS
>> > 1) Dynamic for the zone supporting AD
>> > 2) All internal DNS clients NIC\IP properties must specify SOLELY
>> > that internal, dynamic DNS server (set.)
>> > 3) DCs and even DNS servers are DNS clients too -- see #2
>> >
>> > Restart NetLogon on any DC if you change any of the above that
>> > affects a DC.
>> >
>> > Ensure that DNS zones/domains are fully replicated to all DNS
>> > servers for that (internal) zone/domain.
>> >
>> >
>> > --
>> > Herb Martin
>> >
>> >
>> >
>>
>>
>>

--

These twin-CPU hyperthreading computers are really
great! We can wait ten to a hundred times faster
these days.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

true ...



--
Andrei Ungureanu
www.eventid.net
Free Windows event logs reports
http://www.altairtech.ca/evlog/

"Enkidu" <enkidu@xyzcliffpxyz.com> wrote in message
news:1a2gr0drklavdfre8koo87pd3371b7jt7t@4ax.com...
>
> If all DCs are also GCs, this is NOT a problem.
>
> http://support.microsoft.com/kb/223346
>
> I'm a little surprised that no one has pointed this out.
>
> Cheers,
>
> Cliff
>
> On Wed, 8 Dec 2004 21:15:05 -0800, DaveinPNG
> <DaveinPNG@discussions.microsoft.com> wrote:
>
>>This was the answer. Once I made DC2 (in the same domain as DC1) and DC3
>>(in
>>a child domain) all GC servers, all three can now handle logins.
>>
>>Considering what I have, should I be concerned that DC1 and DC3 are a GC
>>and
>>the Infrastruture master? I really have no choice, do I?
>>
>>Thanks.
>>
>>Dave
>>
>>"Ken B" wrote:
>>
>>> One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
>>> really handles authentication, I believe.
>>>
>>> Ken
>>>
>>>
>>> "Herb Martin" <news@LearnQuick.com> wrote in message
>>> news:OXHKM0E3EHA.1144@TK2MSFTNGP09.phx.gbl...
>>> > "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
>>> > newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
>>> >> Two domains - Two DCs in one domain, one DC in a child domain
>>> >>
>>> >> If DC1 is unavailable, even though DC2 and DC3 are available, no one
>>> >> can
>>> >> login.
>>> >> REPADMIN /showreps looks fine.
>>> >
>>> > Ok, that eliminates replication but the most common
>>> > reason is that one of the DCs is not registered properly
>>> > in DNS OR your DNS is only correct on the other (missing)
>>> > DC.
>>> >
>>> > Most replication and authentication problems are based on
>>> > DNS problems.
>>> >
>>> >> The only clue I can find is this: I was writing a perl script to
>>> > authenicate
>>> >> a user. The bind fails no matter what I do.
>>> >> I get a similiar message if I run repadmin /bind DSA:
>>> >> DsBindWithCred to dsa failed with status 1722 (0x6ba):
>>> >> The RPC server is unavailable.
>>> >
>>> > This might be important and represent some serious problem
>>> > with the (other) DC, but let's do the obvious first.
>>> >
>>> >> I know this has got to be simple, but I'm stumped.
>>> >> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K
>>> >> to
>>> > W2K3.
>>> >
>>> > Pretty much irrelevant as long are you clients are Win2000+
>>> > and you aren't discussing BDCs.
>>> >
>>> > Roles can affect clients but seldom in authentication (e.g.,
>>> > browsing) unless the client is Win9x or NT, and thus
>>> > (could be) dependent on the PDC emulator.
>>> >
>>> > First, run DCDiag on the problematic DC -- and save the
>>> > output to a text file (/?) -- search the file for FAIL, ERROR,
>>> > WARN and either fix those errors or report them (here).
>>> >
>>> > Check you DNS architecture:
>>> >
>>> > DNS
>>> > 1) Dynamic for the zone supporting AD
>>> > 2) All internal DNS clients NIC\IP properties must specify SOLELY
>>> > that internal, dynamic DNS server (set.)
>>> > 3) DCs and even DNS servers are DNS clients too -- see #2
>>> >
>>> > Restart NetLogon on any DC if you change any of the above that
>>> > affects a DC.
>>> >
>>> > Ensure that DNS zones/domains are fully replicated to all DNS
>>> > servers for that (internal) zone/domain.
>>> >
>>> >
>>> > --
>>> > Herb Martin
>>> >
>>> >
>>> >
>>>
>>>
>>>
>
> --
>
> These twin-CPU hyperthreading computers are really
> great! We can wait ten to a hundred times faster
> these days.

 

[enkidu]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Maybe I should qualify that. I haven't seen this in this thread, but I
may have missed one that pointed this out.

Cheers,

Cliff

On Thu, 09 Dec 2004 21:17:07 +1300, Enkidu <enkidu@xyzcliffpxyz.com>
wrote:

>
>If all DCs are also GCs, this is NOT a problem.
>
>http://support.microsoft.com/kb/223346
>
>I'm a little surprised that no one has pointed this out.
>
>Cheers,
>
>Cliff
>
>On Wed, 8 Dec 2004 21:15:05 -0800, DaveinPNG
><DaveinPNG@discussions.microsoft.com> wrote:
>
>>This was the answer. Once I made DC2 (in the same domain as DC1) and DC3 (in
>>a child domain) all GC servers, all three can now handle logins.
>>
>>Considering what I have, should I be concerned that DC1 and DC3 are a GC and
>>the Infrastruture master? I really have no choice, do I?
>>
>>Thanks.
>>
>>Dave
>>
>>"Ken B" wrote:
>>
>>> One other thing to check... are DC's 2 & 3 Global Catalogs? That's what
>>> really handles authentication, I believe.
>>>
>>> Ken
>>>
>>>
>>> "Herb Martin" <news@LearnQuick.com> wrote in message
>>> news:OXHKM0E3EHA.1144@TK2MSFTNGP09.phx.gbl...
>>> > "DaveinPNG" <DaveinPNG@discussions.microsoft.com> wrote in message
>>> > newsF8FB2C2-BA9A-4663-9F71-4278EF888DA1@microsoft.com...
>>> >> Two domains - Two DCs in one domain, one DC in a child domain
>>> >>
>>> >> If DC1 is unavailable, even though DC2 and DC3 are available, no one can
>>> >> login.
>>> >> REPADMIN /showreps looks fine.
>>> >
>>> > Ok, that eliminates replication but the most common
>>> > reason is that one of the DCs is not registered properly
>>> > in DNS OR your DNS is only correct on the other (missing)
>>> > DC.
>>> >
>>> > Most replication and authentication problems are based on
>>> > DNS problems.
>>> >
>>> >> The only clue I can find is this: I was writing a perl script to
>>> > authenicate
>>> >> a user. The bind fails no matter what I do.
>>> >> I get a similiar message if I run repadmin /bind DSA:
>>> >> DsBindWithCred to dsa failed with status 1722 (0x6ba):
>>> >> The RPC server is unavailable.
>>> >
>>> > This might be important and represent some serious problem
>>> > with the (other) DC, but let's do the obvious first.
>>> >
>>> >> I know this has got to be simple, but I'm stumped.
>>> >> BTW: DC1 has all of the roles and was upgraded from NT4 (PDC) to W2K to
>>> > W2K3.
>>> >
>>> > Pretty much irrelevant as long are you clients are Win2000+
>>> > and you aren't discussing BDCs.
>>> >
>>> > Roles can affect clients but seldom in authentication (e.g.,
>>> > browsing) unless the client is Win9x or NT, and thus
>>> > (could be) dependent on the PDC emulator.
>>> >
>>> > First, run DCDiag on the problematic DC -- and save the
>>> > output to a text file (/?) -- search the file for FAIL, ERROR,
>>> > WARN and either fix those errors or report them (here).
>>> >
>>> > Check you DNS architecture:
>>> >
>>> > DNS
>>> > 1) Dynamic for the zone supporting AD
>>> > 2) All internal DNS clients NIC\IP properties must specify SOLELY
>>> > that internal, dynamic DNS server (set.)
>>> > 3) DCs and even DNS servers are DNS clients too -- see #2
>>> >
>>> > Restart NetLogon on any DC if you change any of the above that
>>> > affects a DC.
>>> >
>>> > Ensure that DNS zones/domains are fully replicated to all DNS
>>> > servers for that (internal) zone/domain.
>>> >
>>> >
>>> > --
>>> > Herb Martin
>>> >
>>> >
>>> >
>>>
>>>
>>>

--

These twin-CPU hyperthreading computers are really
great! We can wait ten to a hundred times faster
these days.