windows 2003 dc's and user authentication

[iainm2]

I have two domain controllers and two dhcp servers. If the domain controller which holds the FSMO roles is powered off users cannot authenticate. When the dc is powered up all is fine again. DHCP is set to give out both dc's DNS to the client machines. DNS settings on both controllers looks similar as do the forward lookups. Both DC's have GC option ticked. Thanks for looking, any suggestions appreciated.

 

[penguin69]

Why do you have two DHCP servers? Can you not setup DHCP relay agents?

You need to spread your FSMO roles out.

Read this...

http://oreilly.com/pub/a/windows/2004/06/15/fsmo.html

 

[AW78]

is your toerh DC a GC?

Allen White MCSE,MCSA,MCITP,MCTS,CCA,CCSP,VCP

http://techieshelp.com

IT Problems? the fix may be here

 

[iainm2]

Both DC's are GC servers. At least the GC option is ticked on both servers settings.

 

[pagy]

When the server holding the FSMO roles is off can you login using the administrator account??

Are all srv records registered correctly for the DC not holding the FSMO roles? Use the link below if you are not sure

http://technet.microsoft.com/en-us/library/cc959303.aspx

Paul
VCP4

https://www.mcpvirtualbusinesscard.com/VBCServer/PaulP/profile

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[pagy]

Also what are the results of a dcdiag?

Paul
VCP4

https://www.mcpvirtualbusinesscard.com/VBCServer/PaulP/profile

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week

 

[iainm2]

I have attached the dcdiag results but all tests seem to have passed ok. Thank you for the link, as far as I can tell all of the srv records are correct.
Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\PAKISTAN
Starting test: Connectivity
......................... PAKISTAN passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\PAKISTAN
Starting test: Replications
......................... PAKISTAN passed test Replications
Starting test: NCSecDesc
......................... PAKISTAN passed test NCSecDesc
Starting test: NetLogons
......................... PAKISTAN passed test NetLogons
Starting test: Advertising
......................... PAKISTAN passed test Advertising
Starting test: KnowsOfRoleHolders
......................... PAKISTAN passed test KnowsOfRoleHolders
Starting test: RidManager
......................... PAKISTAN passed test RidManager
Starting test: MachineAccount
......................... PAKISTAN passed test MachineAccount
Starting test: Services
......................... PAKISTAN passed test Services
Starting test: ObjectsReplicated
......................... PAKISTAN passed test ObjectsReplicated
Starting test: frssysvol
......................... PAKISTAN passed test frssysvol
Starting test: frsevent
......................... PAKISTAN passed test frsevent
Starting test: kccevent
......................... PAKISTAN passed test kccevent
Starting test: systemlog
......................... PAKISTAN passed test systemlog
Starting test: VerifyReferences
......................... PAKISTAN passed test VerifyReferences

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : opml
Starting test: CrossRefValidation
......................... opml passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... opml passed test CheckSDRefDom

Running enterprise tests on : opml.co.uk
Starting test: Intersite
......................... opml.co.uk passed test Intersite
Starting test: FsmoCheck
......................... opml.co.uk passed test FsmoCheck


Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\RUSSIA
Starting test: Connectivity
......................... RUSSIA passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\RUSSIA
Starting test: Replications
......................... RUSSIA passed test Replications
Starting test: NCSecDesc
......................... RUSSIA passed test NCSecDesc
Starting test: NetLogons
......................... RUSSIA passed test NetLogons
Starting test: Advertising
......................... RUSSIA passed test Advertising
Starting test: KnowsOfRoleHolders
......................... RUSSIA passed test KnowsOfRoleHo
Starting test: RidManager
......................... RUSSIA passed test RidManager
Starting test: MachineAccount
......................... RUSSIA passed test MachineAccoun
Starting test: Services
......................... RUSSIA passed test Services
Starting test: ObjectsReplicated
......................... RUSSIA passed test ObjectsReplic
Starting test: frssysvol
......................... RUSSIA passed test frssysvol
Starting test: frsevent
......................... RUSSIA passed test frsevent
Starting test: kccevent
......................... RUSSIA passed test kccevent
Starting test: systemlog
......................... RUSSIA passed test systemlog
Starting test: VerifyReferences
......................... RUSSIA passed test VerifyReferen

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test Cross

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test Check

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValid
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossR
Starting test: CheckSDRefDom
......................... Configuration passed test CheckS

Running partition tests on : opml
Starting test: CrossRefValidation
......................... opml passed test CrossRefValidat
Starting test: CheckSDRefDom
......................... opml passed test CheckSDRefDom

Running enterprise tests on : opml.co.uk
Starting test: Intersite
......................... opml.co.uk passed test Intersite
Starting test: FsmoCheck
......................... opml.co.uk passed test FsmoCheck

Pakistan holds the FSMO roles.

 

[pagy]

Can you login using the administrator when Pakistan is powered off?

run dciag again with a /v

it'll be a lot of info but look for errors from that output and post any errors

Paul
VCP4

https://www.mcpvirtualbusinesscard.com/VBCServer/PaulP/profile

RFC 2795 - The Infinite Monkey Protocol Suite (IMPS)

http://www.faqs.org/rfcs/rfc2795.html

Difficult takes a day, impossible takes a week