Access Denied

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi there,

Really need help from you guys how I'm going to solve this problem.

I have 2 DC in one domain. One named ILSAS1 and ILSAS2.
The problem are:

1. ILSAS2 unable to connect to ILSAS1. The error message is "The domain
controller ilsas1 was not validated because : Access is denied" but not from
vice versa.

2. ILSAS2 DNS can't connect to ILSAS1 by using computer name. It can only
connect by using IP add.

I'm trying to install "Fix DNS errors" app to ILSAS1 but it seems failed to
install as no respond with that app not for ILSAS2. User experiencing
difficulties to log in every morning. Really need someone's help as this
already take 2 weeks for me to resolve this problem before I format the
ILSAS1 DC.

Your help is really appreciate and thanking you in advance.
 
This could be a machine account sync problem, look at the link below if it
doesn't work try the diagnostics further down.
http://support.microsoft.com/kb/325850/en-us




Run diagnostics against your Active Directory domain.

If you don't have the tools installed, install them from your server install
disk.
d:\support\tools\setup.exe

Run dcdiag and netdiag in verbose mode.

If you download a gui script I wrote it should be simple to set and run. It
also has the option to run individual tests without having to learn all the
switch options.

The script is at http://pbbergs.dynu.com/windows/windows.htm, download it
and save it to c:\program files\support tools\

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Hi Paul, thanks for your input, but still really need your further help if
can...

I ran the dcdiag /fix from ILSAS2. ( I can't install it at ILSAS1, this
server seems can't install anything - going crazy ). I believed that the
replications are not happening from this both DC. For your information ILSAS1
is Master role. I've tried to transfer the role to ILSAS2, but failed.

There are some errors and warnings

Testing server: Default-First-Site-Name\ILSAS2
Starting test: Replications
[Replications Check,ILSAS2] A recent replication attempt failed:
From ILSAS1 to ILSAS2
Naming Context: N=Schema,CN=Configuration,DC=ilsas,DC=uniten,DC=edu,DC=my
The replication generated an error (1753):
There are no more endpoints available from the endpoint mapper.
The failure occurred at 2005-12-28 00:53.16.
The last success occurred at 2005-09-18 16:57.02.
2328 failures have occurred since the last success.
The directory on ILSAS1 is in the process.
of starting up or shutting down, and is not available.
Verify machine is not hung during boot.
[ILSAS1] DsBind() failed with error -2146893022,
The target principal name is incorrect..

The Warnings :

Warning: ILSAS1 is the Schema Owner, but is not responding to DS RPC Bind.
[ILSAS1] LDAP bind failed with error 31,
A device attached to the system is not functioning..
Warning: ILSAS1 is the Schema Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to DS
RPC Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to DS RPC Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to LDAP Bind.

I tried to replicate from AD sites and services - access denied.

Really need help how to solve this problem
 
This server has tombstoned data in AD and needs to be rebuilt.

What are tombstones? Because of Windows 2000's and Active Directory's (AD's)
complex replication, if you simply delete an object, Win2K's replication
algorithm might recreate the object at the next replication interval. Thus,
AD marks deleted objects with tombstones.
Win2K deletes tombstone objects 60 days after their original tombstone
status setting. From:
http://www.windowsitpro.com/Article/ArticleID/13394/13394.html


Try dcpromo. If that doesn't work try dcpromo /forceremoval this should
demote the system. If this doesn't work you will have to power the system
off and rebuild it from scratch.

Steps to take if the initial dcpromo didn't work and you had to do a
forceremoval or power off.

Seize any fsmo roles the current active dc doesn't hold
http://support.microsoft.com/default.aspx?scid=kb;en-us;255504

Next cleanup metadata
http://support.microsoft.com/?id=216498

Once done you should be able to reinstall the o/s on the old machine and
repromote it.

When complete you should allow replication to occur and try dcdiag and
netdiag again.


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


Helme said:
Hi Paul, thanks for your input, but still really need your further help if
can...

I ran the dcdiag /fix from ILSAS2. ( I can't install it at ILSAS1, this
server seems can't install anything - going crazy ). I believed that the
replications are not happening from this both DC. For your information
ILSAS1
is Master role. I've tried to transfer the role to ILSAS2, but failed.

There are some errors and warnings

Testing server: Default-First-Site-Name\ILSAS2
Starting test: Replications
[Replications Check,ILSAS2] A recent replication attempt failed:
From ILSAS1 to ILSAS2
Naming Context: N=Schema,CN=Configuration,DC=ilsas,DC=uniten,DC=edu,DC=my
The replication generated an error (1753):
There are no more endpoints available from the endpoint mapper.
The failure occurred at 2005-12-28 00:53.16.
The last success occurred at 2005-09-18 16:57.02.
2328 failures have occurred since the last success.
The directory on ILSAS1 is in the process.
of starting up or shutting down, and is not available.
Verify machine is not hung during boot.
[ILSAS1] DsBind() failed with error -2146893022,
The target principal name is incorrect..

The Warnings :

Warning: ILSAS1 is the Schema Owner, but is not responding to DS RPC Bind.
[ILSAS1] LDAP bind failed with error 31,
A device attached to the system is not functioning..
Warning: ILSAS1 is the Schema Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to DS
RPC Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to DS RPC Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to LDAP Bind.

I tried to replicate from AD sites and services - access denied.

Really need help how to solve this problem

Paul Bergson said:
This could be a machine account sync problem, look at the link below if
it
doesn't work try the diagnostics further down.
http://support.microsoft.com/kb/325850/en-us




Run diagnostics against your Active Directory domain.

If you don't have the tools installed, install them from your server
install
disk.
d:\support\tools\setup.exe

Run dcdiag and netdiag in verbose mode.

If you download a gui script I wrote it should be simple to set and run.
It
also has the option to run individual tests without having to learn all
the
switch options.

The script is at http://pbbergs.dynu.com/windows/windows.htm, download it
and save it to c:\program files\support tools\

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no
rights.
 
Thanks Paul,

I will do it this coming weekend. Happy New Year to you

Paul Bergson said:
This server has tombstoned data in AD and needs to be rebuilt.

What are tombstones? Because of Windows 2000's and Active Directory's (AD's)
complex replication, if you simply delete an object, Win2K's replication
algorithm might recreate the object at the next replication interval. Thus,
AD marks deleted objects with tombstones.
Win2K deletes tombstone objects 60 days after their original tombstone
status setting. From:
http://www.windowsitpro.com/Article/ArticleID/13394/13394.html


Try dcpromo. If that doesn't work try dcpromo /forceremoval this should
demote the system. If this doesn't work you will have to power the system
off and rebuild it from scratch.

Steps to take if the initial dcpromo didn't work and you had to do a
forceremoval or power off.

Seize any fsmo roles the current active dc doesn't hold
http://support.microsoft.com/default.aspx?scid=kb;en-us;255504

Next cleanup metadata
http://support.microsoft.com/?id=216498

Once done you should be able to reinstall the o/s on the old machine and
repromote it.

When complete you should allow replication to occur and try dcdiag and
netdiag again.


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.


Helme said:
Hi Paul, thanks for your input, but still really need your further help if
can...

I ran the dcdiag /fix from ILSAS2. ( I can't install it at ILSAS1, this
server seems can't install anything - going crazy ). I believed that the
replications are not happening from this both DC. For your information
ILSAS1
is Master role. I've tried to transfer the role to ILSAS2, but failed.

There are some errors and warnings

Testing server: Default-First-Site-Name\ILSAS2
Starting test: Replications
[Replications Check,ILSAS2] A recent replication attempt failed:
From ILSAS1 to ILSAS2
Naming Context: N=Schema,CN=Configuration,DC=ilsas,DC=uniten,DC=edu,DC=my
The replication generated an error (1753):
There are no more endpoints available from the endpoint mapper.
The failure occurred at 2005-12-28 00:53.16.
The last success occurred at 2005-09-18 16:57.02.
2328 failures have occurred since the last success.
The directory on ILSAS1 is in the process.
of starting up or shutting down, and is not available.
Verify machine is not hung during boot.
[ILSAS1] DsBind() failed with error -2146893022,
The target principal name is incorrect..

The Warnings :

Warning: ILSAS1 is the Schema Owner, but is not responding to DS RPC Bind.
[ILSAS1] LDAP bind failed with error 31,
A device attached to the system is not functioning..
Warning: ILSAS1 is the Schema Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to DS
RPC Bind.
Warning: ILSAS1 is the Domain Owner, but is not responding to LDAP
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the PDC Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to DS RPC
Bind.
Warning: ILSAS1 is the Rid Owner, but is not responding to LDAP Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to DS RPC Bind.
Warning: ILSAS1 is the Infrastructure Update Owner, but is not
responding to LDAP Bind.

I tried to replicate from AD sites and services - access denied.

Really need help how to solve this problem

Paul Bergson said:
This could be a machine account sync problem, look at the link below if
it
doesn't work try the diagnostics further down.
http://support.microsoft.com/kb/325850/en-us




Run diagnostics against your Active Directory domain.

If you don't have the tools installed, install them from your server
install
disk.
d:\support\tools\setup.exe

Run dcdiag and netdiag in verbose mode.

If you download a gui script I wrote it should be simple to set and run.
It
also has the option to run individual tests without having to learn all
the
switch options.

The script is at http://pbbergs.dynu.com/windows/windows.htm, download it
and save it to c:\program files\support tools\

Just select both dcdiag and netdiag make sure verbose is set. (Leave the
default settings for dcdiag as set when selected)

When complete search for fail, error and warning messages.


--


Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no
rights.


Hi there,

Really need help from you guys how I'm going to solve this problem.

I have 2 DC in one domain. One named ILSAS1 and ILSAS2.
The problem are:

1. ILSAS2 unable to connect to ILSAS1. The error message is "The domain
controller ilsas1 was not validated because : Access is denied" but not
from
vice versa.

2. ILSAS2 DNS can't connect to ILSAS1 by using computer name. It can
only
connect by using IP add.

I'm trying to install "Fix DNS errors" app to ILSAS1 but it seems
failed
to
install as no respond with that app not for ILSAS2. User experiencing
difficulties to log in every morning. Really need someone's help as
this
already take 2 weeks for me to resolve this problem before I format the
ILSAS1 DC.

Your help is really appreciate and thanking you in advance.
 
Back
Top