Active Directory Failover Problem

[weejie]

Hi, we have two DC's in our AD environment. On testing failover, ie shutdown DC1 tried logging onto DC2 message alerted that the domain is not available. I can ping the clients from this server ok. I've checked DNS - was getting event id 4004 I've added reverse lookup for our external ip address, if i add new users to DC2 they replicate to dc1 AD users - anybody any ideas? Need help urgently! cheers

 

[micronmega]

Is DC2 running DNS? if so is it pointing to itself for resolution?

 

[weejie]

hi, DNS is config'd on DC2 preferred address points to DC1
second address to DC2. DC2 is config'd as a secondary dns server. thanks for your quick response

 

[LordRings]

Is DC2 a Global Catalog server? You can check this in AD Sites and Services, NTDS Settings for DC2.

 

[weejie]

it was a GC but i removed it cause i thought it might be an issue - i think the DNS settings is the issue, i've yet to test it. Would GC cause a problem or not? do you think i should enable GC again on DC2, both DC's are on the same site. thanks

 

[weejie]

DNS preferred/alternate isn't the issue. i changed the dns address for DC2 to point to self this doesn't resolve the issue - anybody any ideas? thanks

 

[xmsre]

FSMO role placement?
GC Placment?
DNS?
WINS [for downlevel clients]?

 

[weejie]

All roles on DC1,DC1 is the Dns server+ gc, dc2 secondary dns server, no wins needed. DC2 was a GC but i removed that while troubleshooting the issue

 

[ragnarok75]

We have a similiar issue, Did you ever get a resolution to this?

 

[markdmac]

If you are taking DC1 offline you will need to do some extra steps. first off you need to have a GC available for your clients to be able to login properly. Set DC2 as a GC.

Second, if DC1 were to go offline permanently, then you would need to Seize the FSMO roles.

If you just want to test, then gracefully TRANSFER the FSMO roles to DC2 and then take DC1 offline.

having a server be offline will not automatically get the FSMO roles to move to another server. You need to either transfer of seize the roles.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[mlichstein]

If your domain is in native mode, a GC is a requirement for logon.

 

[ecunupe]

Try making the zones active directory integrated zones to eliminate a single point of failure for DNS. Make sure you have the correct entries in the _msds folder for that zone. Also like everyone else said make sure you have a GC available if you are in Native Mode.

 

[mlichstein]

DC2 should have DC1 as its primary DNS server. DC1 should have itself as a primary DNS server.

If that is not the case, make the change, then do the following:

ipconfig /flushdns
ipconfig /registerdns
net stop netlogn & net start netlogon

 

[weejie]

to resolve this i gave the workstations a static ip address. both servers are GC's - however i had dhcp server running on DC1. on giving the workstations a static ip and making the preferred dns server dc2, i was able to logon to our system.