Remote DCs in AD

G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

We have a W2K3 AD domain with one DC. We want to establish another office
with a W2K3 server that will be a DC in the same AD domain. Question is: how
best to accomplish this? Do we build the remote server at Corporate HQ as a
DC, then physically move it to the remote office? Or do we attempt to DCPROMO
across a WAN link? If we attempt to DCPROMO across a WAN link, how will we
tell it to go to the correct DC within Corporate HQ during the promo process?
Once we set it up at the remote office, how to insure that replication takes
place across the WAN link? Just need a little help here understanding remote
setups.

Thanks,
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

You should set up your subnetting info for that site prior to the promo at the
site, then it will use the site costing mechanism to find the "closest" DC to
pull from. Alternatively you can specify a specific DC to use for the dcpromo
process, see the unattended DC Promo documentation.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Caro wrote:
> We have a W2K3 AD domain with one DC. We want to establish another office
> with a W2K3 server that will be a DC in the same AD domain. Question is: how
> best to accomplish this? Do we build the remote server at Corporate HQ as a
> DC, then physically move it to the remote office? Or do we attempt to DCPROMO
> across a WAN link? If we attempt to DCPROMO across a WAN link, how will we
> tell it to go to the correct DC within Corporate HQ during the promo process?
> Once we set it up at the remote office, how to insure that replication takes
> place across the WAN link? Just need a little help here understanding remote
> setups.
>
> Thanks,
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Joe,

Subnetting has been set up correctly and a VPN tunnel created. Still am not
sure about the DCPromo process across a WAN link. Tried to DCPromo from the
remote site and it could not find the DC to communicate with. Also tried
searching for the documentation you suggested and it was either inapplicable
to my situation or I did not locate the correct one. Please clarify so that I
may resolve this matter.

Thanks,

Caro

"Joe Richards [MVP]" wrote:

> You should set up your subnetting info for that site prior to the promo at the
> site, then it will use the site costing mechanism to find the "closest" DC to
> pull from. Alternatively you can specify a specific DC to use for the dcpromo
> process, see the unattended DC Promo documentation.
>
> joe
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> www.joeware.net
>
>
> Caro wrote:
> > We have a W2K3 AD domain with one DC. We want to establish another office
> > with a W2K3 server that will be a DC in the same AD domain. Question is: how
> > best to accomplish this? Do we build the remote server at Corporate HQ as a
> > DC, then physically move it to the remote office? Or do we attempt to DCPROMO
> > across a WAN link? If we attempt to DCPROMO across a WAN link, how will we
> > tell it to go to the correct DC within Corporate HQ during the promo process?
> > Once we set it up at the remote office, how to insure that replication takes
> > place across the WAN link? Just need a little help here understanding remote
> > setups.
> >
> > Thanks,
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

"Caro" <Caro@discussions.microsoft.com> wrote in message
news:E92EA135-A8BF-4307-A73D-EDBA2587D97E@microsoft.com...
> We have a W2K3 AD domain with one DC. We want to establish another office
> with a W2K3 server that will be a DC in the same AD domain.
> Question is: how best to accomplish this?

[Joe's is correct, so read that also.]

Also make sure you set the DNS correctly (see below).

> Do we build the remote server at Corporate HQ as a
> DC, then physically move it to the remote office?

That is a viable option but unnecessarily tedious unless
you now have the hardware at HQ and plan to drive to
the branch office, or ship it, anyway.

> Or do we attempt to DCPROMO across a WAN link?

That is viable if you WAN will support it.

> If we attempt to DCPROMO across a WAN link, how will we
> tell it to go to the correct DC within Corporate HQ during the promo
process?

Sites and Services, Joe mentioned that.

Also, the third (and fourth) method is to do a System
State backup and then restore to the "new to-be DC"
(for Win2000) or the procedure that was added to Win2003
to "promote from media" where the DCPromo actually
understands using such backups.

> Once we set it up at the remote office, how to insure that replication
takes
> place across the WAN link? Just need a little help here understanding
remote
> setups.

Besides the status (and error) messages you see during
DC promo you use same methods you do for any other DC....

Check the Event Logs (AD, DNS, and System especially).
Use these tools (from Support Tools):

DCDiag.exe
RepAdmin.exe
ReplMon.exe

Every AD administrator needs to be familiar with these tools;
not necessarily know every switch or feature but at least realize
they are available and know to hit help when trying to solve an
AD problem.

Actually, for DCDiag it is probably better NOT to hit help <grin>
but run it as the defaults most all of the time.
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Thanks, Herb, for your help. Just a few comments and please understand that I
am not trying to be contentious, just that your posts are somewhat confusing
to me. Please bear with me.

"Herb Martin" wrote:

> "Caro" <Caro@discussions.microsoft.com> wrote in message
> news:E92EA135-A8BF-4307-A73D-EDBA2587D97E@microsoft.com...
> > We have a W2K3 AD domain with one DC. We want to establish another office
> > with a W2K3 server that will be a DC in the same AD domain.
> > Question is: how best to accomplish this?
>
> [Joe's is correct, so read that also.]

Okay, just don't understand what he is driving at. The comment made
regarding Unattended DCPROMO did not help as I could not find the
documentation. A little more clarification would be very helpful.

>
> Also make sure you set the DNS correctly (see below).
>
> > Do we build the remote server at Corporate HQ as a
> > DC, then physically move it to the remote office?
>
> That is a viable option but unnecessarily tedious unless
> you now have the hardware at HQ and plan to drive to
> the branch office, or ship it, anyway.
>
> > Or do we attempt to DCPROMO across a WAN link?
>
> That is viable if you WAN will support it.
>
No choice now as the server is at the remote office now. What is the
requirement for DCPROMO across the WAN link?

> > If we attempt to DCPROMO across a WAN link, how will we
> > tell it to go to the correct DC within Corporate HQ during the promo
> process?
>
> Sites and Services, Joe mentioned that.

Actually, I do not see where he mentioned that at all. Furthermore, how do
you access Sites and Services without the remote server being a DC? This is a
member server only at this point and I cannot get it to DCPROMO across the
WAN link. This does not make sense or am I missing something?

>
> Also, the third (and fourth) method is to do a System
> State backup and then restore to the "new to-be DC"
> (for Win2000) or the procedure that was added to Win2003
> to "promote from media" where the DCPromo actually
> understands using such backups.
>
> > Once we set it up at the remote office, how to insure that replication
> takes
> > place across the WAN link? Just need a little help here understanding
> remote
> > setups.
>
> Besides the status (and error) messages you see during
> DC promo you use same methods you do for any other DC....
>
> Check the Event Logs (AD, DNS, and System especially).
> Use these tools (from Support Tools):
>
> DCDiag.exe
> RepAdmin.exe
> ReplMon.exe
>

Okay, understood.

> Every AD administrator needs to be familiar with these tools;
> not necessarily know every switch or feature but at least realize
> they are available and know to hit help when trying to solve an
> AD problem.
>
> Actually, for DCDiag it is probably better NOT to hit help <grin>
> but run it as the defaults most all of the time.
>
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

"Caro" <Caro@discussions.microsoft.com> wrote in message
news:7DDDAA79-808C-47B3-95D8-DB11DDD4D0C4@microsoft.com...
> Joe,
>
> Subnetting has been set up correctly and a VPN tunnel created. Still am
not
> sure about the DCPromo process across a WAN link. Tried to DCPromo from
the
> remote site and it could not find the DC to communicate with. Also tried
> searching for the documentation you suggested and it was either
inapplicable
> to my situation or I did not locate the correct one. Please clarify so
that I
> may resolve this matter.

Not finding the DC is almost always a DNS
issue.


DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /server:DC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

In news:7DDDAA79-808C-47B3-95D8-DB11DDD4D0C4@microsoft.com,
Caro <Caro@discussions.microsoft.com> commented
Then Kevin replied below:
> Joe,
>
> Subnetting has been set up correctly and a VPN tunnel
> created. Still am not
> sure about the DCPromo process across a WAN link. Tried
> to DCPromo from the
> remote site and it could not find the DC to communicate
> with. Also tried
> searching for the documentation you suggested and it was
> either inapplicable
> to my situation or I did not locate the correct one.
> Please clarify so that I
> may resolve this matter.

In TCP/IP properties of the machine you are trying to promote, is it using
the current DC for DNS only?
Don't use its own address for DNS just yet, wait for the zone to replicate
before doing that. You might also join it to the domain as a member first.
Run netdiag /fix on the current DC to verify its records are fully
registered in DNS.



--
Best regards,
Kevin D4 Dad Goodknecht Sr. [MVP]
Hope This Helps
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
===================================
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

"Caro" <Caro@discussions.microsoft.com> wrote in message
news:A6D0DBDD-B0E7-416D-85EF-AC67056857CB@microsoft.com...
> Thanks, Herb, for your help. Just a few comments and please understand
that I
> am not trying to be contentious, just that your posts are somewhat
confusing
> to me. Please bear with me.

[Doesn't bother me, unless someone disagree's without
providing any evidence AND without a desire to learn.]

Technical issues have technical answers, and personalities
are unimportant in such (to me.)

> > [Joe's is correct, so read that also.]
>
> Okay, just don't understand what he is driving at. The comment made
> regarding Unattended DCPROMO did not help as I could not find the
> documentation. A little more clarification would be very helpful.

Ok, I didn't really understand that either <grin>, but presumed it
would HELP you find the correct documention, i.e., by giving
you that search word to plug into Google:

[ unattended dcpromo site:microsoft.com ]

The above gets hits all over the subject and we are happy to
help you with anything specific or guide you to the key points....

> > Also make sure you set the DNS correctly (see below).
> >
> > > Do we build the remote server at Corporate HQ as a
> > > DC, then physically move it to the remote office?
> >
> > That is a viable option but unnecessarily tedious unless
> > you now have the hardware at HQ and plan to drive to
> > the branch office, or ship it, anyway.
> >
> > > Or do we attempt to DCPROMO across a WAN link?
> >
> > That is viable if you WAN will support it.
> >
> No choice now as the server is at the remote office now.

Then building it at HQ is not a real choice -- and it isn't necessary.

> What is the requirement for DCPROMO across the WAN link?

Same as local:
a routable network connection (IP)
error free enough to support RPCs
no restrictive firewall filters that interfere with the process
BUT MAINLY: DNS working correctly

> > > If we attempt to DCPROMO across a WAN link, how will we
> > > tell it to go to the correct DC within Corporate HQ during the promo
> > process?
> >
> > Sites and Services, Joe mentioned that.
>
> Actually, I do not see where he mentioned that at all. Furthermore, how do
> you access Sites and Services without the remote server being a DC?

Sorry, he presumed that when he said "set up your
subnetting info for that site" that you would understand
that Sites and Services does that, and when I mentioned
Sites and Services I wasn't looking at his message any
longer and didn't notice that the two ideas were not tied
together.

AD Sites and Services sets the configution for all your
EXISTING DCs (for an entire forest actually) so that
when a new DC is being promoted it will find a working
DC (DNS again) and be told where/how to get the other
stuff.

So, in Sites and Services you create:

Sites
Subnets
Site Links

And on Site Links you configure:
Schedule
Frequency
Cost

> This is a
> member server only at this point and I cannot get it to DCPROMO across the
> WAN link. This does not make sense or am I missing something?

Sure it makes "sense" because it is what you is happening.

And yes, you are missing something: Most likely DNS issues.

But possibly simple routing, or firewall restriction issues.

Can you ping by name and number?

Do all the DCs you have now pass a DCDiag?

Does the "new" DC-to-be use the SAME DNS server set
and no other that the existing DCs use?
(and other DNS stuff.)

> > Also, the third (and fourth) method is to do a System
> > State backup and then restore to the "new to-be DC"
> > (for Win2000) or the procedure that was added to Win2003
> > to "promote from media" where the DCPromo actually
> > understands using such backups.
> >
> > > Once we set it up at the remote office, how to insure that replication
> > takes
> > > place across the WAN link? Just need a little help here understanding
> > remote
> > > setups.
> >
> > Besides the status (and error) messages you see during
> > DC promo you use same methods you do for any other DC....
> >
> > Check the Event Logs (AD, DNS, and System especially).
> > Use these tools (from Support Tools):
> >
> > DCDiag.exe
> > RepAdmin.exe
> > ReplMon.exe
> >
>
> Okay, understood.

Notice that these tools are for checking a DC or replication
AFTER you get it DCpromo'd -- or for checking the existing
DCs before adding a new one.
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Herb,

Thanks for the help. Your answers were very good and I should have no
problem from herein out. I appreciate your patience and understanding and,
most of all, willingness to help.

Thanks,

Caro

"Herb Martin" wrote:

> "Caro" <Caro@discussions.microsoft.com> wrote in message
> news:A6D0DBDD-B0E7-416D-85EF-AC67056857CB@microsoft.com...
> > Thanks, Herb, for your help. Just a few comments and please understand
> that I
> > am not trying to be contentious, just that your posts are somewhat
> confusing
> > to me. Please bear with me.
>
> [Doesn't bother me, unless someone disagree's without
> providing any evidence AND without a desire to learn.]
>
> Technical issues have technical answers, and personalities
> are unimportant in such (to me.)
>
> > > [Joe's is correct, so read that also.]
> >
> > Okay, just don't understand what he is driving at. The comment made
> > regarding Unattended DCPROMO did not help as I could not find the
> > documentation. A little more clarification would be very helpful.
>
> Ok, I didn't really understand that either <grin>, but presumed it
> would HELP you find the correct documention, i.e., by giving
> you that search word to plug into Google:
>
> [ unattended dcpromo site:microsoft.com ]
>
> The above gets hits all over the subject and we are happy to
> help you with anything specific or guide you to the key points....
>
> > > Also make sure you set the DNS correctly (see below).
> > >
> > > > Do we build the remote server at Corporate HQ as a
> > > > DC, then physically move it to the remote office?
> > >
> > > That is a viable option but unnecessarily tedious unless
> > > you now have the hardware at HQ and plan to drive to
> > > the branch office, or ship it, anyway.
> > >
> > > > Or do we attempt to DCPROMO across a WAN link?
> > >
> > > That is viable if you WAN will support it.
> > >
> > No choice now as the server is at the remote office now.
>
> Then building it at HQ is not a real choice -- and it isn't necessary.
>
> > What is the requirement for DCPROMO across the WAN link?
>
> Same as local:
> a routable network connection (IP)
> error free enough to support RPCs
> no restrictive firewall filters that interfere with the process
> BUT MAINLY: DNS working correctly
>
> > > > If we attempt to DCPROMO across a WAN link, how will we
> > > > tell it to go to the correct DC within Corporate HQ during the promo
> > > process?
> > >
> > > Sites and Services, Joe mentioned that.
> >
> > Actually, I do not see where he mentioned that at all. Furthermore, how do
> > you access Sites and Services without the remote server being a DC?
>
> Sorry, he presumed that when he said "set up your
> subnetting info for that site" that you would understand
> that Sites and Services does that, and when I mentioned
> Sites and Services I wasn't looking at his message any
> longer and didn't notice that the two ideas were not tied
> together.
>
> AD Sites and Services sets the configution for all your
> EXISTING DCs (for an entire forest actually) so that
> when a new DC is being promoted it will find a working
> DC (DNS again) and be told where/how to get the other
> stuff.
>
> So, in Sites and Services you create:
>
> Sites
> Subnets
> Site Links
>
> And on Site Links you configure:
> Schedule
> Frequency
> Cost
>
> > This is a
> > member server only at this point and I cannot get it to DCPROMO across the
> > WAN link. This does not make sense or am I missing something?
>
> Sure it makes "sense" because it is what you is happening.
>
> And yes, you are missing something: Most likely DNS issues.
>
> But possibly simple routing, or firewall restriction issues.
>
> Can you ping by name and number?
>
> Do all the DCs you have now pass a DCDiag?
>
> Does the "new" DC-to-be use the SAME DNS server set
> and no other that the existing DCs use?
> (and other DNS stuff.)
>
> > > Also, the third (and fourth) method is to do a System
> > > State backup and then restore to the "new to-be DC"
> > > (for Win2000) or the procedure that was added to Win2003
> > > to "promote from media" where the DCPromo actually
> > > understands using such backups.
> > >
> > > > Once we set it up at the remote office, how to insure that replication
> > > takes
> > > > place across the WAN link? Just need a little help here understanding
> > > remote
> > > > setups.
> > >
> > > Besides the status (and error) messages you see during
> > > DC promo you use same methods you do for any other DC....
> > >
> > > Check the Event Logs (AD, DNS, and System especially).
> > > Use these tools (from Support Tools):
> > >
> > > DCDiag.exe
> > > RepAdmin.exe
> > > ReplMon.exe
> > >
> >
> > Okay, understood.
>
> Notice that these tools are for checking a DC or replication
> AFTER you get it DCpromo'd -- or for checking the existing
> DCs before adding a new one.
>
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Let us know how you do or how you solve the problem.

It may help others...

--
Herb Martin


"Caro" <Caro@discussions.microsoft.com> wrote in message
news:AAF841D3-0BCE-4D65-A606-538026E7924E@microsoft.com...
> Herb,
>
> Thanks for the help. Your answers were very good and I should have no
> problem from herein out. I appreciate your patience and understanding and,
> most of all, willingness to help.
>
> Thanks,
>
> Caro
>
> "Herb Martin" wrote:
>
> > "Caro" <Caro@discussions.microsoft.com> wrote in message
> > news:A6D0DBDD-B0E7-416D-85EF-AC67056857CB@microsoft.com...
> > > Thanks, Herb, for your help. Just a few comments and please understand
> > that I
> > > am not trying to be contentious, just that your posts are somewhat
> > confusing
> > > to me. Please bear with me.
> >
> > [Doesn't bother me, unless someone disagree's without
> > providing any evidence AND without a desire to learn.]
> >
> > Technical issues have technical answers, and personalities
> > are unimportant in such (to me.)
> >
> > > > [Joe's is correct, so read that also.]
> > >
> > > Okay, just don't understand what he is driving at. The comment made
> > > regarding Unattended DCPROMO did not help as I could not find the
> > > documentation. A little more clarification would be very helpful.
> >
> > Ok, I didn't really understand that either <grin>, but presumed it
> > would HELP you find the correct documention, i.e., by giving
> > you that search word to plug into Google:
> >
> > [ unattended dcpromo site:microsoft.com ]
> >
> > The above gets hits all over the subject and we are happy to
> > help you with anything specific or guide you to the key points....
> >
> > > > Also make sure you set the DNS correctly (see below).
> > > >
> > > > > Do we build the remote server at Corporate HQ as a
> > > > > DC, then physically move it to the remote office?
> > > >
> > > > That is a viable option but unnecessarily tedious unless
> > > > you now have the hardware at HQ and plan to drive to
> > > > the branch office, or ship it, anyway.
> > > >
> > > > > Or do we attempt to DCPROMO across a WAN link?
> > > >
> > > > That is viable if you WAN will support it.
> > > >
> > > No choice now as the server is at the remote office now.
> >
> > Then building it at HQ is not a real choice -- and it isn't necessary.
> >
> > > What is the requirement for DCPROMO across the WAN link?
> >
> > Same as local:
> > a routable network connection (IP)
> > error free enough to support RPCs
> > no restrictive firewall filters that interfere with the process
> > BUT MAINLY: DNS working correctly
> >
> > > > > If we attempt to DCPROMO across a WAN link, how will we
> > > > > tell it to go to the correct DC within Corporate HQ during the
promo
> > > > process?
> > > >
> > > > Sites and Services, Joe mentioned that.
> > >
> > > Actually, I do not see where he mentioned that at all. Furthermore,
how do
> > > you access Sites and Services without the remote server being a DC?
> >
> > Sorry, he presumed that when he said "set up your
> > subnetting info for that site" that you would understand
> > that Sites and Services does that, and when I mentioned
> > Sites and Services I wasn't looking at his message any
> > longer and didn't notice that the two ideas were not tied
> > together.
> >
> > AD Sites and Services sets the configution for all your
> > EXISTING DCs (for an entire forest actually) so that
> > when a new DC is being promoted it will find a working
> > DC (DNS again) and be told where/how to get the other
> > stuff.
> >
> > So, in Sites and Services you create:
> >
> > Sites
> > Subnets
> > Site Links
> >
> > And on Site Links you configure:
> > Schedule
> > Frequency
> > Cost
> >
> > > This is a
> > > member server only at this point and I cannot get it to DCPROMO across
the
> > > WAN link. This does not make sense or am I missing something?
> >
> > Sure it makes "sense" because it is what you is happening.
> >
> > And yes, you are missing something: Most likely DNS issues.
> >
> > But possibly simple routing, or firewall restriction issues.
> >
> > Can you ping by name and number?
> >
> > Do all the DCs you have now pass a DCDiag?
> >
> > Does the "new" DC-to-be use the SAME DNS server set
> > and no other that the existing DCs use?
> > (and other DNS stuff.)
> >
> > > > Also, the third (and fourth) method is to do a System
> > > > State backup and then restore to the "new to-be DC"
> > > > (for Win2000) or the procedure that was added to Win2003
> > > > to "promote from media" where the DCPromo actually
> > > > understands using such backups.
> > > >
> > > > > Once we set it up at the remote office, how to insure that
replication
> > > > takes
> > > > > place across the WAN link? Just need a little help here
understanding
> > > > remote
> > > > > setups.
> > > >
> > > > Besides the status (and error) messages you see during
> > > > DC promo you use same methods you do for any other DC....
> > > >
> > > > Check the Event Logs (AD, DNS, and System especially).
> > > > Use these tools (from Support Tools):
> > > >
> > > > DCDiag.exe
> > > > RepAdmin.exe
> > > > ReplMon.exe
> > > >
> > >
> > > Okay, understood.
> >
> > Notice that these tools are for checking a DC or replication
> > AFTER you get it DCpromo'd -- or for checking the existing
> > DCs before adding a new one.
> >
> >
> >
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Agreed.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Herb Martin wrote:
> "Caro" <Caro@discussions.microsoft.com> wrote in message
> news:7DDDAA79-808C-47B3-95D8-DB11DDD4D0C4@microsoft.com...
>
>>Joe,
>>
>>Subnetting has been set up correctly and a VPN tunnel created. Still am
>
> not
>
>>sure about the DCPromo process across a WAN link. Tried to DCPromo from
>
> the
>
>>remote site and it could not find the DC to communicate with. Also tried
>>searching for the documentation you suggested and it was either
>
> inapplicable
>
>>to my situation or I did not locate the correct one. Please clarify so
>
> that I
>
>>may resolve this matter.
>
>
> Not finding the DC is almost always a DNS
> issue.
>
>
> DNS for AD
> 1) Dynamic for the zone supporting AD
> 2) All internal DNS clients NIC\IP properties must specify SOLELY
> that internal, dynamic DNS server (set.)
> 3) DCs and even DNS servers are DNS clients too -- see #2
> 4) If you have more than one Domain, every DNS server must
> be able to resolve ALL domains (either directly or indirectly)
>
> netdiag /fix
>
> ...or maybe:
>
> dcdiag /fix
>
> (Win2003 can do this from Support tools):
> nltest /dsregdns /server:DC-ServerNameGoesHere
> http://support.microsoft.com/kb/q260371/
>
> Ensure that DNS zones/domains are fully replicated to all DNS
> servers for that (internal) zone/domain.
>
> Also useful may be running DCDiag on each DC, sending the
> output to a text file, and searching for FAIL, ERROR, WARN.
>
> Single Label domain zone names are a problem Google:
> [ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]
>
>
 
G

Guest

Guest
Archived from groups: microsoft.public.win2000.active_directory (More info?)

Ah the unattended DCPromo option I was trying to allude to is

ReplicationSourceDC

It allows you to chose what DC to source from.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Herb Martin wrote:
> "Caro" <Caro@discussions.microsoft.com> wrote in message
> news:A6D0DBDD-B0E7-416D-85EF-AC67056857CB@microsoft.com...
>
>>Thanks, Herb, for your help. Just a few comments and please understand
>
> that I
>
>>am not trying to be contentious, just that your posts are somewhat
>
> confusing
>
>>to me. Please bear with me.
>
>
> [Doesn't bother me, unless someone disagree's without
> providing any evidence AND without a desire to learn.]
>
> Technical issues have technical answers, and personalities
> are unimportant in such (to me.)
>
>
>>>[Joe's is correct, so read that also.]
>>
>>Okay, just don't understand what he is driving at. The comment made
>>regarding Unattended DCPROMO did not help as I could not find the
>>documentation. A little more clarification would be very helpful.
>
>
> Ok, I didn't really understand that either <grin>, but presumed it
> would HELP you find the correct documention, i.e., by giving
> you that search word to plug into Google:
>
> [ unattended dcpromo site:microsoft.com ]
>
> The above gets hits all over the subject and we are happy to
> help you with anything specific or guide you to the key points....
>
>
>>>Also make sure you set the DNS correctly (see below).
>>>
>>>
>>>>Do we build the remote server at Corporate HQ as a
>>>>DC, then physically move it to the remote office?
>>>
>>>That is a viable option but unnecessarily tedious unless
>>>you now have the hardware at HQ and plan to drive to
>>>the branch office, or ship it, anyway.
>>>
>>>
>>>>Or do we attempt to DCPROMO across a WAN link?
>>>
>>>That is viable if you WAN will support it.
>>>
>>
>>No choice now as the server is at the remote office now.
>
>
> Then building it at HQ is not a real choice -- and it isn't necessary.
>
>
>>What is the requirement for DCPROMO across the WAN link?
>
>
> Same as local:
> a routable network connection (IP)
> error free enough to support RPCs
> no restrictive firewall filters that interfere with the process
> BUT MAINLY: DNS working correctly
>
>
>>>>If we attempt to DCPROMO across a WAN link, how will we
>>>>tell it to go to the correct DC within Corporate HQ during the promo
>>>
>>>process?
>>>
>>>Sites and Services, Joe mentioned that.
>>
>>Actually, I do not see where he mentioned that at all. Furthermore, how do
>>you access Sites and Services without the remote server being a DC?
>
>
> Sorry, he presumed that when he said "set up your
> subnetting info for that site" that you would understand
> that Sites and Services does that, and when I mentioned
> Sites and Services I wasn't looking at his message any
> longer and didn't notice that the two ideas were not tied
> together.
>
> AD Sites and Services sets the configution for all your
> EXISTING DCs (for an entire forest actually) so that
> when a new DC is being promoted it will find a working
> DC (DNS again) and be told where/how to get the other
> stuff.
>
> So, in Sites and Services you create:
>
> Sites
> Subnets
> Site Links
>
> And on Site Links you configure:
> Schedule
> Frequency
> Cost
>
>
>>This is a
>>member server only at this point and I cannot get it to DCPROMO across the
>>WAN link. This does not make sense or am I missing something?
>
>
> Sure it makes "sense" because it is what you is happening.
>
> And yes, you are missing something: Most likely DNS issues.
>
> But possibly simple routing, or firewall restriction issues.
>
> Can you ping by name and number?
>
> Do all the DCs you have now pass a DCDiag?
>
> Does the "new" DC-to-be use the SAME DNS server set
> and no other that the existing DCs use?
> (and other DNS stuff.)
>
>
>>>Also, the third (and fourth) method is to do a System
>>>State backup and then restore to the "new to-be DC"
>>>(for Win2000) or the procedure that was added to Win2003
>>>to "promote from media" where the DCPromo actually
>>>understands using such backups.
>>>
>>>
>>>>Once we set it up at the remote office, how to insure that replication
>>>
>>>takes
>>>
>>>>place across the WAN link? Just need a little help here understanding
>>>
>>>remote
>>>
>>>>setups.
>>>
>>>Besides the status (and error) messages you see during
>>>DC promo you use same methods you do for any other DC....
>>>
>>>Check the Event Logs (AD, DNS, and System especially).
>>>Use these tools (from Support Tools):
>>>
>>> DCDiag.exe
>>> RepAdmin.exe
>>> ReplMon.exe
>>>
>>
>>Okay, understood.
>
>
> Notice that these tools are for checking a DC or replication
> AFTER you get it DCpromo'd -- or for checking the existing
> DCs before adding a new one.
>
>