WINS and DNS issue

[Guest]

Hello,

I hope someone out there will find the time to help me!

Our school has a Windows 2003 domain controller that is multihomed as it
services 2 VLAN'ed networks. I know that this is a bad start, but Im trying
to get the powers at be to pay to have this rectified. As you can expect, we
do have various DNS issues and our event viewer is full on DNS errors about
the DC trying to register its own IP and failing to do so etc. Our last IT
technician has left the school and we are trying to do what we can in house
(I am the IT lecturer and have some skills as I used to work int he IT
industry but im a bit rusty to say the least!) so I have a few questions for
you all.

Firstly, what is the correct way to go about taking a client off a domain.
Is it ok to just place it into a workgroup?

Secondly, When renaming a domain client, should the client be put into a
work group, renamed and then put back on the domain? (These are all win 2k
and XP clients)

Thirdly, our DNS forward lookup zone hardly has any registered clients in
it. I presume this is from multihoming the DC, but is there a way to remedy
this? Maybe by manually creating A records for each client? Our 2 reverse
lookup zones (for the 2 different networks) are fully populated as far as I
can see...is this true to form on a multihomed DC?

Next, the WINS database, even after scavaging, is full of entries/records
(about 1850 in total most of them released/tombstaoned). We have about 250
clients in the school, surely this isnt right? Some records in there are
from old clients and even some ghost images created over a year ago.....I
dont want to blame our old technician but is this bad management on his
behalf? I know that the WINS is pretty much just turned on and it works
without too much configuration, am I able to just start WINS from scratch to
see if it helps?

Also we have problems with some group policies (especially assigning
applications) do you think that any of the above problems could be the root
cause of there failings?

Sorry about the long post, hopefully someone out there will help me!!

Cheers

 

[Herb Martin]

Hello,

I hope someone out there will find the time to help me!

Our school has a Windows 2003 domain controller that is multihomed as it
services 2 VLAN'ed networks. I know that this is a bad start, but Im
trying
to get the powers at be to pay to have this rectified.

Just fix it. It can service more than one VLAN as long as you
(the switch) routes between them.

As you can expect, we
do have various DNS issues and our event viewer is full on DNS errors
about
the DC trying to register its own IP and failing to do so etc. Our last
IT
technician has left the school and we are trying to do what we can in
house
(I am the IT lecturer and have some skills as I used to work int he IT
industry but im a bit rusty to say the least!) so I have a few questions
for
you all.

You probably should get your MCSE -- it won't make you
an expert but it will guarantee a certain minimum of knowledge,
and after all, you are one of the teachers.

Firstly, what is the correct way to go about taking a client off a domain.
Is it ok to just place it into a workgroup?

Yes, but you should also delete the computer account from
the domain.

One wonders WHY you won't to remove a client though...

Secondly, When renaming a domain client, should the client be put into a
work group, renamed and then put back on the domain? (These are all win
2k
and XP clients)

Generally not necessary if your authentication is working
correctly. And not a good idea since it recreates the computers
SID (security ID.) Recreating a computer SID is not as bad as
doing that for a user but can matter in modern Windows domains.

Thirdly, our DNS forward lookup zone hardly has any registered clients in
it. I presume this is from multihoming the DC, but is there a way to
remedy
this?

Make sure that dynamic updates are allowed, that all clients are
properly authenticating. Generally the latter is through making them
all domain computers (joining them to the domain) AND making
sure they use ONLY the internal DNS server on their NICs. (See
below "DNS for AD".)

Maybe by manually creating A records for each client?

This always works, but dynamic registration is easier, and since
you need that for the DCs anyway it might as well be used.

Our 2 reverse
lookup zones (for the 2 different networks) are fully populated as far as
I
can see...is this true to form on a multihomed DC?

Reverse zones are generally (largely) irrelevant except perhaps for
public Email (SMTP) servers.

Next, the WINS database, even after scavaging, is full of entries/records
(about 1850 in total most of them released/tombstaoned). We have about
250
clients in the school, surely this isnt right?

Sure it may well be since clients that register and don't get removed
(tombstoned) can add to the database.

This number of registrations is no big deal for a WINS server.
Either manually clean it up or don't worry about it unless you
identify some real problem.

Some records in there are
from old clients and even some ghost images created over a year ago.....I
dont want to blame our old technician but is this bad management on his
behalf?

Maybe -- maybe not.

I know that the WINS is pretty much just turned on and it works
without too much configuration, am I able to just start WINS from scratch
to
see if it helps?

Why mess with it if its working?

Also we have problems with some group policies (especially assigning
applications) do you think that any of the above problems could be the
root
cause of there failings?

DNS must be correct for authentication and (perhaps) for downloading
software (assignments).

Sorry about the long post, hopefully someone out there will help me!!

DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

 

[Guest]

Thanks Herb.

Sorry for posting in the other newsgroup, i posted the question and then
realised that the title was that of Windows 2000 DNS so i thought that this
one seemed to be more apt.

All clients are configured to automatically register theirself in DNS but
this doesn't seem to work.

Thanks for all your comments Herb, I dont know a great deal about VLANs
apart from that they are used here to seperate the curriculum network and the
admin network. Ive been told that this is futile anyway because it has 2
NICs so both networks can access it directly - is this true? Do you know of
anywhere where I can get up to speed on this issue? I would be very grateful
if you could let me know.

In terms of the WINS situation, I dont mind not fixing it, im just trying to
get our systems back in some sort of order, I'll go through them and manually
delete any old entries.

So would you agree that creating manual a records may be the way to go?
Doesnt DHCP impact on this in terms of IP addresses changing after the lease
expires and not updating the DNS record accordingly?

In regards to the MSCE, I started that about 18 months ago at great expense
(i paid about £1,200 British pounds for the Win2k version) and I now seem to
be in limbo.....i cant decide whether to go for it now or upgrade to XP and
start over. Any suggestions?

Thanks again Herb

Sambo

Hello,

I hope someone out there will find the time to help me!

Our school has a Windows 2003 domain controller that is multihomed as it
services 2 VLAN'ed networks. I know that this is a bad start, but Im
trying
to get the powers at be to pay to have this rectified.

Just fix it. It can service more than one VLAN as long as you
(the switch) routes between them.

As you can expect, we
do have various DNS issues and our event viewer is full on DNS errors
about
the DC trying to register its own IP and failing to do so etc. Our last
IT
technician has left the school and we are trying to do what we can in
house
(I am the IT lecturer and have some skills as I used to work int he IT
industry but im a bit rusty to say the least!) so I have a few questions
for
you all.

You probably should get your MCSE -- it won't make you
an expert but it will guarantee a certain minimum of knowledge,
and after all, you are one of the teachers.

Firstly, what is the correct way to go about taking a client off a domain.
Is it ok to just place it into a workgroup?

Yes, but you should also delete the computer account from
the domain.

One wonders WHY you won't to remove a client though...

Secondly, When renaming a domain client, should the client be put into a
work group, renamed and then put back on the domain? (These are all win
2k
and XP clients)

Generally not necessary if your authentication is working
correctly. And not a good idea since it recreates the computers
SID (security ID.) Recreating a computer SID is not as bad as
doing that for a user but can matter in modern Windows domains.

Thirdly, our DNS forward lookup zone hardly has any registered clients in
it. I presume this is from multihoming the DC, but is there a way to
remedy
this?

Make sure that dynamic updates are allowed, that all clients are
properly authenticating. Generally the latter is through making them
all domain computers (joining them to the domain) AND making
sure they use ONLY the internal DNS server on their NICs. (See
below "DNS for AD".)

Maybe by manually creating A records for each client?

This always works, but dynamic registration is easier, and since
you need that for the DCs anyway it might as well be used.

Our 2 reverse
lookup zones (for the 2 different networks) are fully populated as far as
I
can see...is this true to form on a multihomed DC?

Reverse zones are generally (largely) irrelevant except perhaps for
public Email (SMTP) servers.

Next, the WINS database, even after scavaging, is full of entries/records
(about 1850 in total most of them released/tombstaoned). We have about
250
clients in the school, surely this isnt right?

Sure it may well be since clients that register and don't get removed
(tombstoned) can add to the database.

This number of registrations is no big deal for a WINS server.
Either manually clean it up or don't worry about it unless you
identify some real problem.

Some records in there are
from old clients and even some ghost images created over a year ago.....I
dont want to blame our old technician but is this bad management on his
behalf?

Maybe -- maybe not.

I know that the WINS is pretty much just turned on and it works
without too much configuration, am I able to just start WINS from scratch
to
see if it helps?

Why mess with it if its working?

Also we have problems with some group policies (especially assigning
applications) do you think that any of the above problems could be the
root
cause of there failings?

DNS must be correct for authentication and (perhaps) for downloading
software (assignments).

Sorry about the long post, hopefully someone out there will help me!!

DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Cheers

 

[Herb Martin]

Thanks Herb.

All clients are configured to automatically register theirself in DNS but
this doesn't seem to work.

Configured how? They do that by default.

Do they have their DNS name configured in the SYSTEM CONTROL
panel? (Don't depend on trying to override this on the NIC, but rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

Thanks for all your comments Herb, I dont know a great deal about VLANs
apart from that they are used here to seperate the curriculum network and
the
admin network.

VLANs are conceptually just TWO SUBNETS separated by a ROUTER.

VLAN switches just let you 'custom configure' which machines/legs are
on the same VLAN (single subnet) and which must be routed.

Ive been told that this is futile anyway because it has 2
NICs so both networks can access it directly - is this true?

"This...futile" -- what "this"?

It may be unnecessary to have the server on "both nets" directly.
(Sometimes there are reasons for that however.)

It is not something that is ALWAYS required. Since all of the
things you need to do (AD Domain, DNS clients servers etc.)
can be routed from one VLAN to the other through the switch.

Do you know of
anywhere where I can get up to speed on this issue? I would be very
grateful
if you could let me know.

Well, you could attend my class but I suspect you are outside the
US -- and I don't have another class until late January anyway.

Also, I do FREE mentoring for MCSE self-study -- email me
privately from if you wish help with that.

Other than that, you can keep asking questions here and use the
BUILT-IN HELP plus searching at Microsoft A LOT.

We'll help. Just ask.

In terms of the WINS situation, I dont mind not fixing it, im just trying
to
get our systems back in some sort of order, I'll go through them and
manually
delete any old entries.

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you have
more than one WINS server (or had one that disappeared.)

So would you agree that creating manual a records may be the way to go?

Not particularly. I will agree it will work. But it is generally
a lot of unnecessary work and chance are that you have some
other problem that it will just cover up.

Doesnt DHCP impact on this in terms of IP addresses changing after the
lease
expires and not updating the DNS record accordingly?

Perhaps -- if DCHP is doing the DNS registration.

Not for WINS. ANd not if the clients register themselves.

In regards to the MSCE, I started that about 18 months ago at great
expense
(i paid about £1,200 British pounds for the Win2k version) and I now seem
to
be in limbo.....i cant decide whether to go for it now or upgrade to XP
and
start over. Any suggestions?

If you haven't completed any (many) exams you should just do the
Win2003 with XP.

Thanks again Herb

Run DCDiag on every DC. Report (here) by pasting the TEXT or fix any
errors.

Run NetDIAG on a few (representative) clients that are not registering
in DNS properly.

Reasons they won't register:

1) Not using STRICTLY the internal (dynamic) DNS server (set)
2) Not set with their DOMAIN name correctly (where would they register)
3) DNS server not dynamic
4) Client not authenticated if you use "Secure only"
(due usually to DC or client not using DNS correctly)
5) DHCP server trying to register FOR the clients with similar problems


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Hello,

I hope someone out there will find the time to help me!

Our school has a Windows 2003 domain controller that is multihomed as
it
services 2 VLAN'ed networks. I know that this is a bad start, but Im
trying
to get the powers at be to pay to have this rectified.

Just fix it. It can service more than one VLAN as long as you
(the switch) routes between them.

As you can expect, we
do have various DNS issues and our event viewer is full on DNS errors
about
the DC trying to register its own IP and failing to do so etc. Our
last
IT
technician has left the school and we are trying to do what we can in
house
(I am the IT lecturer and have some skills as I used to work int he IT
industry but im a bit rusty to say the least!) so I have a few
questions
for
you all.

You probably should get your MCSE -- it won't make you
an expert but it will guarantee a certain minimum of knowledge,
and after all, you are one of the teachers.

Firstly, what is the correct way to go about taking a client off a
domain.
Is it ok to just place it into a workgroup?

Yes, but you should also delete the computer account from
the domain.

One wonders WHY you won't to remove a client though...

Secondly, When renaming a domain client, should the client be put into
a
work group, renamed and then put back on the domain? (These are all
win
2k
and XP clients)

Generally not necessary if your authentication is working
correctly. And not a good idea since it recreates the computers
SID (security ID.) Recreating a computer SID is not as bad as
doing that for a user but can matter in modern Windows domains.

Thirdly, our DNS forward lookup zone hardly has any registered clients
in
it. I presume this is from multihoming the DC, but is there a way to
remedy
this?

Make sure that dynamic updates are allowed, that all clients are
properly authenticating. Generally the latter is through making them
all domain computers (joining them to the domain) AND making
sure they use ONLY the internal DNS server on their NICs. (See
below "DNS for AD".)

Maybe by manually creating A records for each client?

This always works, but dynamic registration is easier, and since
you need that for the DCs anyway it might as well be used.

Our 2 reverse
lookup zones (for the 2 different networks) are fully populated as far
as
I
can see...is this true to form on a multihomed DC?

Reverse zones are generally (largely) irrelevant except perhaps for
public Email (SMTP) servers.

Next, the WINS database, even after scavaging, is full of
entries/records
(about 1850 in total most of them released/tombstaoned). We have about
250
clients in the school, surely this isnt right?

Sure it may well be since clients that register and don't get removed
(tombstoned) can add to the database.

This number of registrations is no big deal for a WINS server.
Either manually clean it up or don't worry about it unless you
identify some real problem.

Some records in there are
from old clients and even some ghost images created over a year
ago.....I
dont want to blame our old technician but is this bad management on his
behalf?

Maybe -- maybe not.

I know that the WINS is pretty much just turned on and it works
without too much configuration, am I able to just start WINS from
scratch
to
see if it helps?

Why mess with it if its working?

Also we have problems with some group policies (especially assigning
applications) do you think that any of the above problems could be the
root
cause of there failings?

DNS must be correct for authentication and (perhaps) for downloading
software (assignments).

Sorry about the long post, hopefully someone out there will help me!!

DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or
indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Cheers

 

[Guest]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL

panel? (Don't depend on trying to override this on the NIC, but rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured correctly
for most instances by default). What I failed to mention earlier was that
we also have a single label domain name which really confounds our miseries
further!! I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without some
consultation on the likelyhood of it screwing up our network completely.
Have you got first hand experience of attempting this?

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you have
more than one WINS server (or had one that disappeared.)

There used to be a different WINS server on the network before a new DC was
installed 2 years ago. The old DC was demoted and is now a member server.
WINS is no longer configured on this server. Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we being
niave thinking that if DNS isnt functioning properly then we dont really need
to have a back up system in place?

I dont live in the US, im here in sunny Britain but I would like to take you
up on your offer, your obviously very enthusiastic about your work so your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -


Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Rougemont\PLATO
Starting test: Connectivity
......................... PLATO passed test Connectivity

Doing primary tests

Testing server: Rougemont\PLATO
Starting test: Replications
......................... PLATO passed test Replications
Starting test: NCSecDesc
......................... PLATO passed test NCSecDesc
Starting test: NetLogons
......................... PLATO passed test NetLogons
Starting test: Advertising
......................... PLATO passed test Advertising
Starting test: KnowsOfRoleHolders
......................... PLATO passed test KnowsOfRoleHolders
Starting test: RidManager
......................... PLATO passed test RidManager
Starting test: MachineAccount
......................... PLATO passed test MachineAccount
Starting test: Services
......................... PLATO passed test Services
Starting test: ObjectsReplicated
......................... PLATO passed test ObjectsReplicated
Starting test: frssysvol
......................... PLATO passed test frssysvol
Starting test: frsevent
......................... PLATO passed test frsevent
Starting test: kccevent
......................... PLATO passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 12/13/2005 21:01:31
(Event String could not be retrieved)
......................... PLATO failed test systemlog
Starting test: VerifyReferences
......................... PLATO passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : rougemont
Starting test: CrossRefValidation
......................... rougemont passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... rougemont passed test CheckSDRefDom

Running enterprise tests on : rougemont
Starting test: Intersite
......................... rougemont passed test Intersite
Starting test: FsmoCheck
......................... rougemont passed test FsmoCheck

Netdiag on a sample non-registering XP client


........................................

Computer Name: BQR1
DNS Host Name: BQR1.rougemont
System info : Windows 2000 Professional (Build 2600)
Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
List of installed hotfixes :
KB893803v2
KB898461
Q147222


Netcard queries test . . . . . . . : Passed
[WARNING] The net card 'RAS Async Adapter' may not be working because it
has not received any packets.



Per interface results:

Adapter : Local Area Connection

Netcard queries test . . . : Passed

Host Name. . . . . . . . . : BQR1.rougemont
IP Address . . . . . . . . : 10.0.10.54
Subnet Mask. . . . . . . . : 255.255.0.0
Default Gateway. . . . . . : 10.0.0.2
Primary WINS Server. . . . : 10.0.0.3
Dns Servers. . . . . . . . : 10.0.0.3


AutoConfiguration results. . . . . . : Passed

Default gateway test . . . : Passed

NetBT name test. . . . . . : Passed

WINS service test. . . . . : Passed


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{C010AE27-A5BF-4E33-B64F-60FF08B13C43}
1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.


Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{C010AE27-A5BF-4E33-B64F-60FF08B13C43}
The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser
NetBT_Tcpip_{C010AE27-A5BF-4E33-B64F-60FF08B13C43}
The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Passed
Secure channel for domain 'ROUGEMONT' is to '\\plato.rougemont'.


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Passed
Service status is: Started
Service startup is: Automatic
IPSec service is available, but no policy is assigned or active
Note: run "ipseccmd /?" for more detailed information


The command completed successfully


I can see the failure there, but whats the fix?

Hope you can help me out

Cheers

Sambo

Thanks Herb.

All clients are configured to automatically register theirself in DNS but
this doesn't seem to work.

Configured how? They do that by default.

Do they have their DNS name configured in the SYSTEM CONTROL
panel? (Don't depend on trying to override this on the NIC, but rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

Thanks for all your comments Herb, I dont know a great deal about VLANs
apart from that they are used here to seperate the curriculum network and
the
admin network.

VLANs are conceptually just TWO SUBNETS separated by a ROUTER.

VLAN switches just let you 'custom configure' which machines/legs are
on the same VLAN (single subnet) and which must be routed.

Ive been told that this is futile anyway because it has 2
NICs so both networks can access it directly - is this true?

"This...futile" -- what "this"?

It may be unnecessary to have the server on "both nets" directly.
(Sometimes there are reasons for that however.)

It is not something that is ALWAYS required. Since all of the
things you need to do (AD Domain, DNS clients servers etc.)
can be routed from one VLAN to the other through the switch.

Do you know of
anywhere where I can get up to speed on this issue? I would be very
grateful
if you could let me know.

Well, you could attend my class but I suspect you are outside the
US -- and I don't have another class until late January anyway.

Also, I do FREE mentoring for MCSE self-study -- email me
privately from if you wish help with that.

Other than that, you can keep asking questions here and use the
BUILT-IN HELP plus searching at Microsoft A LOT.

We'll help. Just ask.

In terms of the WINS situation, I dont mind not fixing it, im just trying
to
get our systems back in some sort of order, I'll go through them and
manually
delete any old entries.

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you have
more than one WINS server (or had one that disappeared.)

So would you agree that creating manual a records may be the way to go?

Not particularly. I will agree it will work. But it is generally
a lot of unnecessary work and chance are that you have some
other problem that it will just cover up.

Doesnt DHCP impact on this in terms of IP addresses changing after the
lease
expires and not updating the DNS record accordingly?

Perhaps -- if DCHP is doing the DNS registration.

Not for WINS. ANd not if the clients register themselves.

In regards to the MSCE, I started that about 18 months ago at great
expense
(i paid about £1,200 British pounds for the Win2k version) and I now seem
to
be in limbo.....i cant decide whether to go for it now or upgrade to XP
and
start over. Any suggestions?

If you haven't completed any (many) exams you should just do the
Win2003 with XP.

Thanks again Herb

Run DCDiag on every DC. Report (here) by pasting the TEXT or fix any
errors.

Run NetDIAG on a few (representative) clients that are not registering
in DNS properly.

Reasons they won't register:

1) Not using STRICTLY the internal (dynamic) DNS server (set)
2) Not set with their DOMAIN name correctly (where would they register)
3) DNS server not dynamic
4) Client not authenticated if you use "Secure only"
(due usually to DC or client not using DNS correctly)
5) DHCP server trying to register FOR the clients with similar problems


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Hello,

I hope someone out there will find the time to help me!

Our school has a Windows 2003 domain controller that is multihomed as
it
services 2 VLAN'ed networks. I know that this is a bad start, but Im
trying
to get the powers at be to pay to have this rectified.

Just fix it. It can service more than one VLAN as long as you
(the switch) routes between them.

As you can expect, we
do have various DNS issues and our event viewer is full on DNS errors
about
the DC trying to register its own IP and failing to do so etc. Our
last
IT
technician has left the school and we are trying to do what we can in
house
(I am the IT lecturer and have some skills as I used to work int he IT
industry but im a bit rusty to say the least!) so I have a few
questions
for
you all.

You probably should get your MCSE -- it won't make you
an expert but it will guarantee a certain minimum of knowledge,
and after all, you are one of the teachers.

Firstly, what is the correct way to go about taking a client off a
domain.
Is it ok to just place it into a workgroup?

Yes, but you should also delete the computer account from
the domain.

One wonders WHY you won't to remove a client though...

Secondly, When renaming a domain client, should the client be put into
a
work group, renamed and then put back on the domain? (These are all
win
2k
and XP clients)

Generally not necessary if your authentication is working
correctly. And not a good idea since it recreates the computers
SID (security ID.) Recreating a computer SID is not as bad as
doing that for a user but can matter in modern Windows domains.

Thirdly, our DNS forward lookup zone hardly has any registered clients
in
it. I presume this is from multihoming the DC, but is there a way to
remedy
this?

Make sure that dynamic updates are allowed, that all clients are
properly authenticating. Generally the latter is through making them
all domain computers (joining them to the domain) AND making
sure they use ONLY the internal DNS server on their NICs. (See
below "DNS for AD".)

Maybe by manually creating A records for each client?

This always works, but dynamic registration is easier, and since
you need that for the DCs anyway it might as well be used.

Our 2 reverse
lookup zones (for the 2 different networks) are fully populated as far
as
I
can see...is this true to form on a multihomed DC?

Reverse zones are generally (largely) irrelevant except perhaps for
public Email (SMTP) servers.

Next, the WINS database, even after scavaging, is full of
entries/records
(about 1850 in total most of them released/tombstaoned). We have about
250
clients in the school, surely this isnt right?

Sure it may well be since clients that register and don't get removed
(tombstoned) can add to the database.

This number of registrations is no big deal for a WINS server.
Either manually clean it up or don't worry about it unless you
identify some real problem.

Some records in there are
from old clients and even some ghost images created over a year
ago.....I
dont want to blame our old technician but is this bad management on his
behalf?

Maybe -- maybe not.

I know that the WINS is pretty much just turned on and it works
without too much configuration, am I able to just start WINS from
scratch
to
see if it helps?

Why mess with it if its working?

Also we have problems with some group policies (especially assigning
applications) do you think that any of the above problems could be the
root
cause of there failings?

DNS must be correct for authentication and (perhaps) for downloading
software (assignments).


Sorry about the long post, hopefully someone out there will help me!!


DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or
indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

Single Label domain zone names are a problem Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]


--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]


Cheers

 

[Herb Martin]

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured
correctly
for most instances by default). What I failed to mention earlier was
that
we also have a single label domain name which really confounds our
miseries
further!!

Yes, and especially with DYNANIC registration.

Single Label domain zone names are a problem, Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without some
consultation on the likelyhood of it screwing up our network completely.
Have you got first hand experience of attempting this?

You cannot rename a Win2000 domain (and can only rename a Win2003
under certain special cases.)

There used to be a different WINS server on the network before a new DC
was
installed 2 years ago. The old DC was demoted and is now a member server.
WINS is no longer configured on this server.

A missing WINS server may "Own" some of the records which will
therefore never be scavenged (the owning server does that) so you
can continue to take ownership and delete the abandoned entries manually.

For newer entries the automatic expiration and scavenging of records may
be adjusted but then should JUST WORK.

Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we being
niave thinking that if DNS isnt functioning properly then we dont really
need
to have a back up system in place?

"isn't functioning properly" you NEED a backup system in place.

If you care about your network you will have at least 2 DCs, 2 DNS
servers, 2 WINS servers (they might all be on the same pair of machines.)

WINS servers can (and should) replicate but must be setup manually to do
this
(by the admins).

DNS must also (except for AD DNS) but the creation of the ZONES on
the DNS server pretty much forces you to do that (walks you through the
process of having Secondaries pull from MASTER.)

I dont live in the US, im here in sunny Britain but I would like to take
you
up on your offer, your obviously very enthusiastic about your work so your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are
registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -

RUNNING DCDIAG on DCs is BETTER. Us NETDiag mainly for NON-DCs

But you have at least one issue with DNS there:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.

Chances are you DCs are not all properly registered with DNS.

Deal with the KB articles about single lable DNS.

Make sure the DNS zone is DYNAMIC.

Then run DCDiag /fix

The following was in one or more of my earlier messages (along
with the info about single label DNS):

--
DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

 

[Guest]

Thanks for your response yet again Herb.

We do run a win2003 domain so I will google the domain rename, but do you
have any first hand experience with tackling this? I've been told that its
frought with danger, but maybe if I address a few issues with DNS and WINS
our netwwork will at least function a little better which may not require
anyting drastic like a domain rename.

Ideally we would like to have 2 DCS, 2 DNS and 2 WINS servers but our budget
is very limited as to what we can afford. I will suggest this as the way
forward though.

The output from the DC was from running dcdiag, i incorrectly typed netdiag.

DNS is setup to be AD integrated, to replicate to all other DCs and to allow
secure and unsecure updates. DNS isnt set up for zone transfers and "Use
WINS forward lookup" is not selected. Does this sound about right?

Why is it that win2k clients seem to register with dns but XP clients dont?

I will look at all your suggestions and attempt to address our problems. Is
it completely safe to run dcdiag /fix?

Our DNS eventvwr is full of errors about the DC not being able to register
itself with DNS. Here are a few sample errors: -

"The DNS server has encountered a critical error from the Active Directory.
Check that the Active Directory is functioning properly. The extended error
debug information (which may be empty) is "". The event data contains the
error."

****************

The DNS server was unable to complete directory service enumeration of zone
rougemont. This DNS server is configured to use information obtained from
Active Directory for this zone and is unable to load the zone without it.
Check that the Active Directory is functioning properly and repeat
enumeration of the zone. The extended error debug information (which may be
empty) is "". The event data contains the error.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

**********

The zone 1.168.192.in-addr.arpa was previously loaded from the directory
partition MicrosoftDNS but another copy of the zone has been found in
directory partition ForestDnsZones.rougemont. The DNS Server will ignore this
new copy of the zone. Please resolve this conflict as soon as possible.

If an administrator has moved this zone from one directory partition to
another this may be a harmless transient condition. In this case, no action
is necessary. The deletion of the original copy of the zone should soon
replicate to this server.

If there are two copies of this zone in two different directory partitions
but this is not a transient caused by a zone move operation then one of these
copies should be deleted as soon as possible to resolve this conflict.

To change the replication scope of an application directory partition
containing DNS zones and for more details on storing DNS zones in the
application directory partitions, please see Help and Support.

***************

DNS server has updated its own host (A) records. In order to ensure that
its DS-integrated peer DNS servers are able to replicate with this server, an
attempt was made to update them with the new records through dynamic update.
An error was encountered during this update, the record data is the error
code.

If this DNS server does not have any DS-integrated peers, then this error
should be ignored.

If this DNS server's Active Directory replication partners do not have the
correct IP address(es) for this server, they will be unable to replicate with
it.

To ensure proper replication:
1) Find this server's Active Directory replication partners that run the DNS
server.
2) Open DnsManager and connect in turn to each of the replication partners.
3) On each server, check the host (A record) registration for THIS server.
4) Delete any A records that do NOT correspond to IP addresses of this
server.
5) If there are no A records for this server, add at least one A record
corresponding to an address on this server, that the replication partner can
contact. (In other words, if there multiple IP addresses for this DNS
server, add at least one that is on the same network as the Active Directory
DNS server you are updating.)
6) Note, that is not necessary to update EVERY replication partner. It is
only necessary that the records are fixed up on enough replication partners
so that every server that replicates with this server will receive (through
replication) the new data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I think its fair to say that we have quite a few problems!!

Thanks for your continued help Herb,

Cheers

Sam

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured
correctly
for most instances by default). What I failed to mention earlier was
that
we also have a single label domain name which really confounds our
miseries
further!!

Yes, and especially with DYNANIC registration.

Single Label domain zone names are a problem, Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without some
consultation on the likelyhood of it screwing up our network completely.
Have you got first hand experience of attempting this?

You cannot rename a Win2000 domain (and can only rename a Win2003
under certain special cases.)

There used to be a different WINS server on the network before a new DC
was
installed 2 years ago. The old DC was demoted and is now a member server.
WINS is no longer configured on this server.

A missing WINS server may "Own" some of the records which will
therefore never be scavenged (the owning server does that) so you
can continue to take ownership and delete the abandoned entries manually.

For newer entries the automatic expiration and scavenging of records may
be adjusted but then should JUST WORK.

Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we being
niave thinking that if DNS isnt functioning properly then we dont really
need
to have a back up system in place?

"isn't functioning properly" you NEED a backup system in place.

If you care about your network you will have at least 2 DCs, 2 DNS
servers, 2 WINS servers (they might all be on the same pair of machines.)

WINS servers can (and should) replicate but must be setup manually to do
this
(by the admins).

DNS must also (except for AD DNS) but the creation of the ZONES on
the DNS server pretty much forces you to do that (walks you through the
process of having Secondaries pull from MASTER.)

I dont live in the US, im here in sunny Britain but I would like to take
you
up on your offer, your obviously very enthusiastic about your work so your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are
registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -

RUNNING DCDIAG on DCs is BETTER. Us NETDiag mainly for NON-DCs

But you have at least one issue with DNS there:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.

Chances are you DCs are not all properly registered with DNS.

Deal with the KB articles about single lable DNS.

Make sure the DNS zone is DYNAMIC.

Then run DCDiag /fix

The following was in one or more of my earlier messages (along
with the info about single label DNS):

--
DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

 

[Herb Martin]

Thanks for your response yet again Herb.

We do run a win2003 domain so I will google the domain rename, but do you
have any first hand experience with tackling this? I've been told that
its
frought with danger, but maybe if I address a few issues with DNS and WINS
our netwwork will at least function a little better which may not require
anyting drastic like a domain rename.

Follow the KB articles explicitly and you should be ok.

BUT, I would also see about making sure my DNS was correct
to begin with -- even if that requires manual registration of the
DC (not ordinary computer) records.

If you don't make everything able to find the DCs (and each other)
then you will just be complicating the existing problems.

Ideally we would like to have 2 DCS, 2 DNS and 2 WINS servers but our
budget
is very limited as to what we can afford. I will suggest this as the way
forward though.

The alternative is REALLY GOOD (e.g., daily) backups AND
UPS systems.

The output from the DC was from running dcdiag, i incorrectly typed
netdiag.

It did sort of look like that.

DNS is setup to be AD integrated, to replicate to all other DCs and to
allow
secure and unsecure updates. DNS isnt set up for zone transfers and "Use
WINS forward lookup" is not selected. Does this sound about right?

Well, if you have more than one DC then you already have a place
to put your 2 DNS/WINS servers.

Why is it that win2k clients seem to register with dns but XP clients
dont?

My guess would be that the XP still has something wrong on their
NIC (multiple irrelevant DNS servers) OR that one of the NICs
is unroutable from the XP side but is the one listed in DNS.

I will look at all your suggestions and attempt to address our problems.
Is
it completely safe to run dcdiag /fix?

Yes. I always run it once, capture to file FIRST, so that I can compare the
results after the fix (I like to know if anything was actually improved.)

BUT notice it won't fix EVERYTHING, just some limited problems.

Our DNS eventvwr is full of errors about the DC not being able to register
itself with DNS. Here are a few sample errors: -

Yes. This is where I have been pointing you all along.

"The DNS server has encountered a critical error from the Active
Directory.
Check that the Active Directory is functioning properly. The extended
error
debug information (which may be empty) is "". The event data contains the
error."

****************

The DNS server was unable to complete directory service enumeration of
zone
rougemont. This DNS server is configured to use information obtained from
Active Directory for this zone and is unable to load the zone without it.
Check that the Active Directory is functioning properly and repeat
enumeration of the zone. The extended error debug information (which may
be
empty) is "". The event data contains the error.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

**********

The zone 1.168.192.in-addr.arpa was previously loaded from the directory
partition MicrosoftDNS but another copy of the zone has been found in
directory partition ForestDnsZones.rougemont. The DNS Server will ignore
this
new copy of the zone. Please resolve this conflict as soon as possible.

If an administrator has moved this zone from one directory partition to
another this may be a harmless transient condition. In this case, no
action
is necessary. The deletion of the original copy of the zone should soon
replicate to this server.

If there are two copies of this zone in two different directory partitions
but this is not a transient caused by a zone move operation then one of
these
copies should be deleted as soon as possible to resolve this conflict.

To change the replication scope of an application directory partition
containing DNS zones and for more details on storing DNS zones in the
application directory partitions, please see Help and Support.

***************

DNS server has updated its own host (A) records. In order to ensure that
its DS-integrated peer DNS servers are able to replicate with this server,
an
attempt was made to update them with the new records through dynamic
update.
An error was encountered during this update, the record data is the error
code.

If this DNS server does not have any DS-integrated peers, then this error
should be ignored.

If this DNS server's Active Directory replication partners do not have the
correct IP address(es) for this server, they will be unable to replicate
with
it.

To ensure proper replication:
1) Find this server's Active Directory replication partners that run the
DNS
server.
2) Open DnsManager and connect in turn to each of the replication
partners.
3) On each server, check the host (A record) registration for THIS server.
4) Delete any A records that do NOT correspond to IP addresses of this
server.
5) If there are no A records for this server, add at least one A record
corresponding to an address on this server, that the replication partner
can
contact. (In other words, if there multiple IP addresses for this DNS
server, add at least one that is on the same network as the Active
Directory
DNS server you are updating.)
6) Note, that is not necessary to update EVERY replication partner. It is
only necessary that the records are fixed up on enough replication
partners
so that every server that replicates with this server will receive
(through
replication) the new data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I think its fair to say that we have quite a few problems!!

Thanks for your continued help Herb,

Cheers

Sam

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL
panel? (Don't depend on trying to override this on the NIC, but
rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured
correctly
for most instances by default). What I failed to mention earlier was
that
we also have a single label domain name which really confounds our
miseries
further!!

Yes, and especially with DYNANIC registration.

Single Label domain zone names are a problem, Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without some
consultation on the likelyhood of it screwing up our network
completely.
Have you got first hand experience of attempting this?

You cannot rename a Win2000 domain (and can only rename a Win2003
under certain special cases.)

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you have
more than one WINS server (or had one that disappeared.)

There used to be a different WINS server on the network before a new
DC
was
installed 2 years ago. The old DC was demoted and is now a member
server.
WINS is no longer configured on this server.

A missing WINS server may "Own" some of the records which will
therefore never be scavenged (the owning server does that) so you
can continue to take ownership and delete the abandoned entries manually.

For newer entries the automatic expiration and scavenging of records may
be adjusted but then should JUST WORK.

Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we
being
niave thinking that if DNS isnt functioning properly then we dont
really
need
to have a back up system in place?

"isn't functioning properly" you NEED a backup system in place.

If you care about your network you will have at least 2 DCs, 2 DNS
servers, 2 WINS servers (they might all be on the same pair of machines.)

WINS servers can (and should) replicate but must be setup manually to do
this
(by the admins).

DNS must also (except for AD DNS) but the creation of the ZONES on
the DNS server pretty much forces you to do that (walks you through the
process of having Secondaries pull from MASTER.)

I dont live in the US, im here in sunny Britain but I would like to
take
you
up on your offer, your obviously very enthusiastic about your work so
your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are
registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -

RUNNING DCDIAG on DCs is BETTER. Us NETDiag mainly for NON-DCs

But you have at least one issue with DNS there:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for
the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.

Chances are you DCs are not all properly registered with DNS.

Deal with the KB articles about single lable DNS.

Make sure the DNS zone is DYNAMIC.

Then run DCDiag /fix

The following was in one or more of my earlier messages (along
with the info about single label DNS):

--
DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or
indirectly)

netdiag /fix

....or maybe:

dcdiag /fix

(Win2003 can do this from Support tools):
nltest /dsregdns /serverC-ServerNameGoesHere
http://support.microsoft.com/kb/q260371/

Ensure that DNS zones/domains are fully replicated to all DNS
servers for that (internal) zone/domain.

Also useful may be running DCDiag on each DC, sending the
output to a text file, and searching for FAIL, ERROR, WARN.

 

[Guest]

Thanks Herb, my apologies if Im beginning to bore you now but there are few
things I have to raise regarding your response.

When I said the that DNS server is configured to to replicate to all other
DCs and to allow secure and unsecure updates this is what is selected in the
properties for our forward lookup zone - We dont actually have another server
configured to replicate to. I have double checked and the old server doesn't
have anything configured for DNS. Does this mean that its causing errors
when trying to replicate? Ive had a look at the options under replication,
at the moment its set to Replicate to all domain controllers in the AD domain
Domainname. It says to set this if you want a 2000 server to load the zone.
Im happy to "fire-up" the old server to be used as a backup system for DNS
and WINS but dont know how and whether or not this option is viable. What do
you think? CAn it be configured to accept logons also if the main DC goes
down? So many questions I know...sorry to be a pain

You were right to suspect the old server of still running WINS, it is and it
has about 10 records in the Active Registrations folder, all of which are
valid for another 6 days. What would you do if you were in this
scenario....delete the old server from the list or setup the replication
properly (im presuming that it isnt setup correctly if its only holding 10
records!)

I have run dcdiag /fix and it has cleared up one problem but it had caused a
failure in another, the DC now fails on: -

An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
......................... PLATO failed test kccevent

and

PLATO failed test systemlog

So is the main issue here to do with the fact that my DC is trying to
replicate and register itself with another server which it cant find?

I ran the nltest command on the DC and got this message back: -

Flags: 0
Connection Status = 0 0x0 NERR_Success
The command completed successfully

How can I check if issuing this command has made any difference?

Im so grateful for your help and support, I promise I wont bug you again if
you can just help me this one last time!!

Cheers

Sam

Thanks for your response yet again Herb.

We do run a win2003 domain so I will google the domain rename, but do you
have any first hand experience with tackling this? I've been told that
its
frought with danger, but maybe if I address a few issues with DNS and WINS
our netwwork will at least function a little better which may not require
anyting drastic like a domain rename.

Follow the KB articles explicitly and you should be ok.

BUT, I would also see about making sure my DNS was correct
to begin with -- even if that requires manual registration of the
DC (not ordinary computer) records.

If you don't make everything able to find the DCs (and each other)
then you will just be complicating the existing problems.

Ideally we would like to have 2 DCS, 2 DNS and 2 WINS servers but our
budget
is very limited as to what we can afford. I will suggest this as the way
forward though.

The alternative is REALLY GOOD (e.g., daily) backups AND
UPS systems.

The output from the DC was from running dcdiag, i incorrectly typed
netdiag.

It did sort of look like that.

DNS is setup to be AD integrated, to replicate to all other DCs and to
allow
secure and unsecure updates. DNS isnt set up for zone transfers and "Use
WINS forward lookup" is not selected. Does this sound about right?

Well, if you have more than one DC then you already have a place
to put your 2 DNS/WINS servers.

Why is it that win2k clients seem to register with dns but XP clients
dont?

My guess would be that the XP still has something wrong on their
NIC (multiple irrelevant DNS servers) OR that one of the NICs
is unroutable from the XP side but is the one listed in DNS.

I will look at all your suggestions and attempt to address our problems.
Is
it completely safe to run dcdiag /fix?

Yes. I always run it once, capture to file FIRST, so that I can compare the
results after the fix (I like to know if anything was actually improved.)

BUT notice it won't fix EVERYTHING, just some limited problems.

Our DNS eventvwr is full of errors about the DC not being able to register
itself with DNS. Here are a few sample errors: -

Yes. This is where I have been pointing you all along.

"The DNS server has encountered a critical error from the Active
Directory.
Check that the Active Directory is functioning properly. The extended
error
debug information (which may be empty) is "". The event data contains the
error."

****************

The DNS server was unable to complete directory service enumeration of
zone
rougemont. This DNS server is configured to use information obtained from
Active Directory for this zone and is unable to load the zone without it.
Check that the Active Directory is functioning properly and repeat
enumeration of the zone. The extended error debug information (which may
be
empty) is "". The event data contains the error.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

**********

The zone 1.168.192.in-addr.arpa was previously loaded from the directory
partition MicrosoftDNS but another copy of the zone has been found in
directory partition ForestDnsZones.rougemont. The DNS Server will ignore
this
new copy of the zone. Please resolve this conflict as soon as possible.

If an administrator has moved this zone from one directory partition to
another this may be a harmless transient condition. In this case, no
action
is necessary. The deletion of the original copy of the zone should soon
replicate to this server.

If there are two copies of this zone in two different directory partitions
but this is not a transient caused by a zone move operation then one of
these
copies should be deleted as soon as possible to resolve this conflict.

To change the replication scope of an application directory partition
containing DNS zones and for more details on storing DNS zones in the
application directory partitions, please see Help and Support.

***************

DNS server has updated its own host (A) records. In order to ensure that
its DS-integrated peer DNS servers are able to replicate with this server,
an
attempt was made to update them with the new records through dynamic
update.
An error was encountered during this update, the record data is the error
code.

If this DNS server does not have any DS-integrated peers, then this error
should be ignored.

If this DNS server's Active Directory replication partners do not have the
correct IP address(es) for this server, they will be unable to replicate
with
it.

To ensure proper replication:
1) Find this server's Active Directory replication partners that run the
DNS
server.
2) Open DnsManager and connect in turn to each of the replication
partners.
3) On each server, check the host (A record) registration for THIS server.
4) Delete any A records that do NOT correspond to IP addresses of this
server.
5) If there are no A records for this server, add at least one A record
corresponding to an address on this server, that the replication partner
can
contact. (In other words, if there multiple IP addresses for this DNS
server, add at least one that is on the same network as the Active
Directory
DNS server you are updating.)
6) Note, that is not necessary to update EVERY replication partner. It is
only necessary that the records are fixed up on enough replication
partners
so that every server that replicates with this server will receive
(through
replication) the new data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I think its fair to say that we have quite a few problems!!

Thanks for your continued help Herb,

Cheers

Sam

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL
panel? (Don't depend on trying to override this on the NIC, but
rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured
correctly
for most instances by default). What I failed to mention earlier was
that
we also have a single label domain name which really confounds our
miseries
further!!

Yes, and especially with DYNANIC registration.

Single Label domain zone names are a problem, Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without some
consultation on the likelyhood of it screwing up our network
completely.
Have you got first hand experience of attempting this?

You cannot rename a Win2000 domain (and can only rename a Win2003
under certain special cases.)

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you have
more than one WINS server (or had one that disappeared.)

There used to be a different WINS server on the network before a new
DC
was
installed 2 years ago. The old DC was demoted and is now a member
server.
WINS is no longer configured on this server.

A missing WINS server may "Own" some of the records which will
therefore never be scavenged (the owning server does that) so you
can continue to take ownership and delete the abandoned entries manually.

For newer entries the automatic expiration and scavenging of records may
be adjusted but then should JUST WORK.

Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we
being
niave thinking that if DNS isnt functioning properly then we dont
really
need
to have a back up system in place?

"isn't functioning properly" you NEED a backup system in place.

If you care about your network you will have at least 2 DCs, 2 DNS
servers, 2 WINS servers (they might all be on the same pair of machines.)

WINS servers can (and should) replicate but must be setup manually to do
this
(by the admins).

DNS must also (except for AD DNS) but the creation of the ZONES on
the DNS server pretty much forces you to do that (walks you through the
process of having Secondaries pull from MASTER.)

I dont live in the US, im here in sunny Britain but I would like to
take
you
up on your offer, your obviously very enthusiastic about your work so
your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are
registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -

RUNNING DCDIAG on DCs is BETTER. Us NETDiag mainly for NON-DCs

But you have at least one issue with DNS there:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server for
the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.

Chances are you DCs are not all properly registered with DNS.

Deal with the KB articles about single lable DNS.

Make sure the DNS zone is DYNAMIC.

Then run DCDiag /fix

The following was in one or more of my earlier messages (along
with the info about single label DNS):

--
DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or
indirectly)

netdiag /fix

 

[Herb Martin]

Thanks Herb, my apologies if Im beginning to bore you now but there are
few
things I have to raise regarding your response.

No, you won't bore me probably as long as you are explicit
in stating problems. (I get frustrated with people who post
long 'explanations' using ambiguous language and unclear
problem statements.)

When I said the that DNS server is configured to to replicate to all other
DCs and to allow secure and unsecure updates this is what is selected in
the
properties for our forward lookup zone - We dont actually have another
server
configured to replicate to.

Then saying it is so configured is misleading. There is no
replication if you have only one DNS server.

I have double checked and the old server doesn't
have anything configured for DNS. Does this mean that its causing errors
when trying to replicate?

If any DNS client (including itself or any other DC) is set to still
use it then it might be causing a problem.

Make sure you have EVERY Internal DNS client using strictly
the WORKING INTERNAL DNS server (set). Whatever that
set really is.

Ive had a look at the options under replication,
at the moment its set to Replicate to all domain controllers in the AD
domain
Domainname.

Then if you are fully replicated (DCDiag) then why not just
make a similar (AD Integrated Primary zone) on EVER such
DC.

They have the records anyway, why not let them service DNS.

It says to set this if you want a 2000 server to load the zone.
Im happy to "fire-up" the old server to be used as a backup system for DNS
and WINS but dont know how and whether or not this option is viable. What
do
you think? CAn it be configured to accept logons also if the main DC goes
down? So many questions I know...sorry to be a pain

Such "configuration" is unnecessary; if you make sure there there is
a DC with DNS working (and maybe WINS server) then that is just
the way such DCs "work".

Win2000+ DCs are multimastered -- all can log you own (true even
of NT BDCs) AND all can accept changes to the database (not true in NT.)

You were right to suspect the old server of still running WINS, it is and
it
has about 10 records in the Active Registrations folder, all of which are
valid for another 6 days.

This explain a "split NetBIOS" -- some machines registered and using
ONE WINS Server, others using another.

Make sure these replicate or turn off the unneeded and MAKE SURE t
that all NetBIOS clients (including DCs and even the WINS SERVERS
themselves) use STRICTLY the "approved and working" WINS Server(s).

What would you do if you were in this
scenario....delete the old server from the list or setup the replication
properly (im presuming that it isnt setup correctly if its only holding 10
records!)

I would prefer multiple WINS Servers that are fully replicated.

If I had two DCs then I would make both of them AD-DNS Integrated AND
WINS servers in most cases.

I would make sure they replicate AD, DNS, and WINS records.

I have run dcdiag /fix and it has cleared up one problem but it had caused
a
failure in another, the DC now fails on: -

An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
An Warning Event occured. EventID: 0x80250829
Time Generated: 12/14/2005 14:12:55
(Event String could not be retrieved)
......................... PLATO failed test kccevent

If this is in the "Event Log" section then go CLEAR your event
logs (save current entries if you wish).

DCDiag will forever report a problem if certain errors are
present in the System, AD, etc. logs. Even if the underlying
problems have been (long since) repaired.

If he errors come back then the problem however has not been
fixed.

and

PLATO failed test systemlog

So is the main issue here to do with the fact that my DC is trying to
replicate and register itself with another server which it cant find?

This could easily be. ALL DCs must be registered in the common
DNS zone (database) and use strictly the DNS servers (on their client
NIC->IP settings) which can resolve ALL of these internal names in
that zone.

I ran the nltest command on the DC and got this message back: -

Flags: 0
Connection Status = 0 0x0 NERR_Success
The command completed successfully

How can I check if issuing this command has made any difference?

NLTest is one of the most frustratingly complex command lines;
I generally recommend DCDiag for chechking DCs and NetDiag
for checking other machines.

Im so grateful for your help and support, I promise I wont bug you again
if
you can just help me this one last time!!

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Cheers

Sam

Thanks for your response yet again Herb.

We do run a win2003 domain so I will google the domain rename, but do
you
have any first hand experience with tackling this? I've been told that
its
frought with danger, but maybe if I address a few issues with DNS and
WINS
our netwwork will at least function a little better which may not
require
anyting drastic like a domain rename.

Follow the KB articles explicitly and you should be ok.

BUT, I would also see about making sure my DNS was correct
to begin with -- even if that requires manual registration of the
DC (not ordinary computer) records.

If you don't make everything able to find the DCs (and each other)
then you will just be complicating the existing problems.

Ideally we would like to have 2 DCS, 2 DNS and 2 WINS servers but our
budget
is very limited as to what we can afford. I will suggest this as the
way
forward though.

The alternative is REALLY GOOD (e.g., daily) backups AND
UPS systems.

The output from the DC was from running dcdiag, i incorrectly typed
netdiag.

It did sort of look like that.

DNS is setup to be AD integrated, to replicate to all other DCs and to
allow
secure and unsecure updates. DNS isnt set up for zone transfers and
"Use
WINS forward lookup" is not selected. Does this sound about right?

Well, if you have more than one DC then you already have a place
to put your 2 DNS/WINS servers.

Why is it that win2k clients seem to register with dns but XP clients
dont?

My guess would be that the XP still has something wrong on their
NIC (multiple irrelevant DNS servers) OR that one of the NICs
is unroutable from the XP side but is the one listed in DNS.

I will look at all your suggestions and attempt to address our
problems.
Is
it completely safe to run dcdiag /fix?

Yes. I always run it once, capture to file FIRST, so that I can compare
the
results after the fix (I like to know if anything was actually improved.)

BUT notice it won't fix EVERYTHING, just some limited problems.

Our DNS eventvwr is full of errors about the DC not being able to
register
itself with DNS. Here are a few sample errors: -

Yes. This is where I have been pointing you all along.

"The DNS server has encountered a critical error from the Active
Directory.
Check that the Active Directory is functioning properly. The extended
error
debug information (which may be empty) is "". The event data contains
the
error."

****************

The DNS server was unable to complete directory service enumeration of
zone
rougemont. This DNS server is configured to use information obtained
from
Active Directory for this zone and is unable to load the zone without
it.
Check that the Active Directory is functioning properly and repeat
enumeration of the zone. The extended error debug information (which
may
be
empty) is "". The event data contains the error.

--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

**********

The zone 1.168.192.in-addr.arpa was previously loaded from the
directory
partition MicrosoftDNS but another copy of the zone has been found in
directory partition ForestDnsZones.rougemont. The DNS Server will
ignore
this
new copy of the zone. Please resolve this conflict as soon as possible.

If an administrator has moved this zone from one directory partition to
another this may be a harmless transient condition. In this case, no
action
is necessary. The deletion of the original copy of the zone should soon
replicate to this server.

If there are two copies of this zone in two different directory
partitions
but this is not a transient caused by a zone move operation then one of
these
copies should be deleted as soon as possible to resolve this conflict.

To change the replication scope of an application directory partition
containing DNS zones and for more details on storing DNS zones in the
application directory partitions, please see Help and Support.

***************

DNS server has updated its own host (A) records. In order to ensure
that
its DS-integrated peer DNS servers are able to replicate with this
server,
an
attempt was made to update them with the new records through dynamic
update.
An error was encountered during this update, the record data is the
error
code.

If this DNS server does not have any DS-integrated peers, then this
error
should be ignored.

If this DNS server's Active Directory replication partners do not have
the
correct IP address(es) for this server, they will be unable to
replicate
with
it.

To ensure proper replication:
1) Find this server's Active Directory replication partners that run
the
DNS
server.
2) Open DnsManager and connect in turn to each of the replication
partners.
3) On each server, check the host (A record) registration for THIS
server.
4) Delete any A records that do NOT correspond to IP addresses of this
server.
5) If there are no A records for this server, add at least one A record
corresponding to an address on this server, that the replication
partner
can
contact. (In other words, if there multiple IP addresses for this DNS
server, add at least one that is on the same network as the Active
Directory
DNS server you are updating.)
6) Note, that is not necessary to update EVERY replication partner. It
is
only necessary that the records are fixed up on enough replication
partners
so that every server that replicates with this server will receive
(through
replication) the new data.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I think its fair to say that we have quite a few problems!!

Thanks for your continued help Herb,

Cheers

Sam

:



--
Herb Martin, MCSE, MVP
Accelerated MCSE
http://www.LearnQuick.Com
[phone number on web site]

Herb,

Thanks for the reply.

A few things: -

Do they have their DNS name configured in the SYSTEM CONTROL
panel? (Don't depend on trying to override this on the NIC, but
rather
set the System computer name properties.)

Make sure they use ONLY the INTERNAL DNS (don't try to mix
the ISPs DNS server.)

They do have their names configured int he system control panel, the
settings on the NIC are untouched (as you say they are configured
correctly
for most instances by default). What I failed to mention earlier
was
that
we also have a single label domain name which really confounds our
miseries
further!!

Yes, and especially with DYNANIC registration.

Single Label domain zone names are a problem, Google:
[ "SINGLE LABEL" domain names DNS 2000 | 2003 microsoft: ]

I have thought about tackling this and have downloaded MS KBs on
the subject of domain renaming but wouldnt fancy trying it without
some
consultation on the likelyhood of it screwing up our network
completely.
Have you got first hand experience of attempting this?

You cannot rename a Win2000 domain (and can only rename a Win2003
under certain special cases.)

Fine. Maybe not best use of your time. Is there just one WINS
Server? Usually the entries only get left (after cleanup) if you
have
more than one WINS server (or had one that disappeared.)

There used to be a different WINS server on the network before a
new
DC
was
installed 2 years ago. The old DC was demoted and is now a member
server.
WINS is no longer configured on this server.

A missing WINS server may "Own" some of the records which will
therefore never be scavenged (the owning server does that) so you
can continue to take ownership and delete the abandoned entries
manually.

For newer entries the automatic expiration and scavenging of records
may
be adjusted but then should JUST WORK.

Replication of anything (can you
replicate WINS like DNS?) does not take place on our network, are we
being
niave thinking that if DNS isnt functioning properly then we dont
really
need
to have a back up system in place?

"isn't functioning properly" you NEED a backup system in place.

If you care about your network you will have at least 2 DCs, 2 DNS
servers, 2 WINS servers (they might all be on the same pair of
machines.)

WINS servers can (and should) replicate but must be setup manually to
do
this
(by the admins).

DNS must also (except for AD DNS) but the creation of the ZONES on
the DNS server pretty much forces you to do that (walks you through
the
process of having Secondaries pull from MASTER.)

I dont live in the US, im here in sunny Britain but I would like to
take
you
up on your offer, your obviously very enthusiastic about your work
so
your
knowledge will be invaluable to me. Many thanks for the offer

Upon further investigation, it seems that only 2000 clients are
registering
in DNS, XP clients down seem to (see example below)

Netdiag on the DC: -

RUNNING DCDIAG on DCs is BETTER. Us NETDiag mainly for NON-DCs

But you have at least one issue with DNS there:

DNS test . . . . . . . . . . . . . : Passed
[WARNING] Cannot find a primary authoritative DNS server
for
the
name
'BQR1.rougemont.'. [RCODE_SERVER_FAILURE]
The name 'BQR1.rougemont.' may not be registered in DNS.

Chances are you DCs are not all properly registered with DNS.

Deal with the KB articles about single lable DNS.

Make sure the DNS zone is DYNAMIC.

Then run DCDiag /fix

The following was in one or more of my earlier messages (along
with the info about single label DNS):

--
DNS for AD
1) Dynamic for the zone supporting AD
2) All internal DNS clients NIC\IP properties must specify SOLELY
that internal, dynamic DNS server (set.)
3) DCs and even DNS servers are DNS clients too -- see #2
4) If you have more than one Domain, every DNS server must
be able to resolve ALL domains (either directly or
indirectly)

netdiag /fix

 

[Mark]

http://support.microsoft.com/default.aspx?scid=kb;en-us;289735

Ensure that all clients can access the DC on a single IP. If this is
not the case, then it will never work.

When a client wants to connect, it will do a lookup for domain.com. As
it goes through the logon process, it will request a gc record. If
that DC is the DC it wants to authenticate to, and it has 2 GC
records, the client needs to be able to connect to both of them. If
the client receives the GC record for an IP on a subnet it cannot
access, then the logon will fail.

You cannot have a multi-homed DC on 2 networks, unless both are
accessable, and if thats the case, then you don't need both NICs
anyways

If you MUST have clients on both subnets, and they cannot route to
each other for authentication, then you must have a DC on each subnet,
and replicate between them.