1

I had two Domain Controllers (one for 2k, and another 2k3). The 2k server was the primary controller with all the FSMO roles. I transferred those roles, as well as the GC to the 2k3 server. I followed the steps described in this kb article to transfer the FSMO roles. I went to demote the 2k server however ran into issues demoting it. I followed the steps in this kb article to demote it forcefully.

Now when I go to log on to the domain, I get this error:

enter image description here

I'm able to log on to the server directly, but when I try to connect via RDP I get the error above. Running nslookup I get this result:

enter image description here

Which is the correct ip address of the new DC. However, running nslooup domain I get the following error:

domain can't find nslookup. Non-Existent domain.

I'm pretty stumped at this point, and really don't know what to do.

Running a dcdiag I get the following error:

enter image description here

James Mertz
  • 251
  • 6
  • 18
  • After helping you earlier, this error is unrelated to the main error - this one is purely because you do not have reverse IP setup on your DNS server so it is not resolving this ip to the FQDN of the server. – William Hilsum Oct 24 '11 at 01:41
  • @WilliamHilsum including the 'non-existen domain' error? – James Mertz Oct 24 '11 at 01:42
  • You "transferred" the GC? Can you clarify? It's not the sort of thing that you can transfer. Anyway, is the DNS service running on the new DC? – Shane Madden Oct 24 '11 at 01:57

1 Answers1

4

After connecting to this machine and trying to help out, I found two problems:

The first with regards to the DNS issues. This was just down to the fact that no reverse lookup zone was created. I created this and it was able to resolve the server via IP just fine.

As for non-existent domain, I am unsure where this was seen. Typing the domain name worked fine.

As for the more serious issue of users not being able to log in, it turned out to be rather simple - I checked the event log and it turned out that as it said, the GC was malfunctioning. After some more tests, I discovered that the SysVol folder was not being shared. I checked the basic NTFS settings, followed by sharing it and all machines now appear to be able to log in just fine.

There still seems to be a few issues that just shouldn't be there, and I think reinstall AD from scratch may just be the safest solution - but, the most important thing is that it appears to be working for now and the main errors have been dealt with.

William Hilsum
  • 3,536
  • 6
  • 29
  • 39