Windows 2003 - When down / Rebooting

[Sikosis]

We have two Windows 2003 Servers at work, both set as Domain Controllers.

One is what we like to call the PDC (yes old term but it fits) and the other a BDC, even though they both do the same job.

The problem is ... when we restart the PDC for updates, etc - if a user has not logged onto the system, they can't log in at all. The 2nd Windows box won't do the authenicating for them, even though I have seen it do it during the day when I have checked to see what their Logon Server was.

I've also checked that the BDC is listed as a secondary DNS server, so it should work.

I'm guessing its a DHCP issue ...

Any ideas ?

 

[WhoKilledKenny]

Sounds like a DNS configuration issue.
Check both domain controllers two make sure each server is pointing to themselves and to each other as a DNS servers. It doesnt matter if DC01 points to itself as primary or secondary, the only issue I have seen (and confirmed with Microsoft) is if the DC points to itself as primary, it's own reboot takes a little longer as it has to wait for the DNS Service to start locally.

Check your workstations to make sure they have both DNS servers in the TCP/IP config. You mentioned DHCP, if the scope options for DNS have both servers configed check that you clents are set to get their DNS setting from a DCHP server.

 

[Daveyd123]

Are all FSMO roles on your PDC? If so, and your PDC goes down, NEW users could have trouble logging into the domain

 

[itsp1965]

Make sure you make your secondary domain controller a global catalog server also. In the absence of a GC, regular users will not be able to logon to the domain. It looks like this role is only on your primary domain controller

 

[bobsa32]

In order to allow user to log on when the "pdc" is down the "bdc" must have a copy of the global catalog. to do this:

Goto AD sites and services, default-first-site-name, servers.
right click on the ntds settings of the "bdc" and make sure there is a tick in the global catalog box.

Await replication, i usually wait 12-24 hours. (probably too long). after replication, shutdown the "pdc" and test the "bdc" by logging on from a workstation.

 

[bobsa32]

Also, its worth mentioning that the infrastructure master role should be on a non global catalog AD server, unless all AD servers in the domain are global catalog servers.

http://support.microsoft.com/default.aspx?scid=kb;en-us;223346

 

[WhoKilledKenny]

bobsa32 is correct regarding the infrastructure master, if you have a multi-domain forest. If you have a single domian with only two domain controllers then do as suggested above, make both of them GCs. You don't have to be concerned with the infrastructure master running on one of the two GCs in a single domain environment.