yet another DNS issue

[Gersen]

howdy all,

I tried searching the forum for a while, and while I found a lot of DNS posts asking questions, I did not find this problem. If there is already a thread on this, please point me to it!

I am experienced with NT networks but not a DNS expert by any means. Most of my issues get solved through additional research rather than existing experience.

In preparation for upgrading our PDC from Win NT to Win 2000, I made sure DNS was working on a Win 2000 member server, because I have read that properly configured DNS is vital to Active Directory. Once I had that DNS config'd and the clients pointed to it were resoving names properly, I proceeded with the Win 2000 upgrade on the PDC.

During the upgrade, the install could not locate a DNS server it was happy with, and insisted on installing DNS on the PDC. Ok, no problem, I just finished the upgrade then added the additional host and MX records manually to bring this DNS server to the same config as the standalone.

Afterwards, logins to the domain started to take a LOOOONG time, as much as 20 minutes, during most of which the client screens would say "Applying Computer Settings" or "Loading Personal Settings". I started some DNS troubleshooting. DCDIAG gave me an interesting error: "Server GUID DNS name could not be resolved to an IP address. Although the GUID DNS name could not be resolved, the server name resolved to an IP address and was pingable."

Following up on this, I found in TechNet how to determine the GUID DNS name. I opened DNS Manager and looked under my forward lookup zone, expecting to find folders named "_msdcs", "_sites", "_tcp", and "_udp". There were none! There are no folders under the forward lookup zone. These folders are all there on the forward zone on the standalone server's DNS.

Figuring I'd screwed up the DNS setup, I removed DNS from the server and rebooted, then re-installed DNS again. Same result: no sub-folders under the forward zone... Also the DNS doesn't work, as I can't resolve Internet names from this server (while it's pointed to itself as a DNS server) even though the forwarders are set up, and I can't get Exchange to send mail, though the MX record is the same as on the standalone server. When I point the PDC to the standalone server's DNS, then I can resolve names and Exchange can send mail.

Looks like my weekend will be spent here learning more about DNS and AD. Can you give me some input on what I should try/read/change?

thanks in advance!

 

[SilviaS]

Have you made sure all workstations are registering with DNS and get the address of the DNS server through DHCP?

 

[GiaBetiu]

At the begining of your message, you are saying that during install the server could not locate the DNS server. Did you test the connection before? Nslookup? Ping? Was your NT server configured to use that DNS?

As about that long time during log on,.. it is normal to happen this, as long as your workstation could not have an answer for SRV records that they are looking for (kerberos, site, domain).

What can you see in EventViewer? Normally you should find information like: "DNS could not create record xxx".
IP address should be fixed. Are you using a fixed IP (Internal network)? Also, those records are created by a Windows2k domain controller. But this is happen just if you are setting your dynamic updates to yes (secure or not). Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[Gersen]

madferret: The workstations are registering with DNS and have the IP of the DNS assigned, as our internal network is static addresses. I had not pointed all the workstations to the PDC DNS yet, based on the strange results I was getting trying to test it.

Gia: The standalone DNS server was working and the PDC was pointed to it for resolution. It was tested by simply using it, and it was successfully resolving our internal network names and allowing Exchange to use our ISA server as a mail exchanger, and it forwarded Internet names to our ISP's DNS for resolution. I am not getting an error like you described in Event Viewer.

I have finally found something in TechNet's Knowledge Base that I think can help, after wording the query about 12 different ways. KB Article 310568. I'm going to try the procedures it describes as soon as I can take the server offline again.

 

[Odissey]

Two things: 1 - dynamic DNS registration allow, 2 - create reverse lookup zone and pointer for DC vadimp@yandex.ru

 

[Gersen]

Ok... I have gone through the procedure in MS KB article 310568. Twice. Even the parts that say "if this doesn't work, then..." Odissey, both those things have been done. I create my reverse lookup zone first, before creating any host records, so my PTRs will be right.

So, we're beyond the point where TechNet can help, so I do as I always do in that circumstance: throw it out to y'all who have to make this stuff work in real life.

Throw me some more ideas...

G.

 

[doomhamur]

Here is something to try during non-production hours:

"In preparation for upgrading our PDC from Win NT to Win 2000, I made sure DNS was working on a Win 2000 member server, because I have read that properly configured DNS is vital to Active Directory."
DNS is vital to AD, but it works best when all DNS servers being used for the domain are AD integrated (i have tried the way you are doing it and it was not very successful for me)- I only run DNS on DC's.
Disable DNS on the member server. if DNS is not AD integrated on the DC, reinstall so it is. when you do this it will make a forward lookup zone. create a reverse lookup zone and make sure that automatic updates is enabled. be sure to setup forewarders properly. Set the DC to use only itself for DNS in the IP properties. See faq96-3017 for explicit instructions.

after doing this, setup a workstation with only the DC as the DNS server in ipconfig and test your access.

good luck Doomhamur
Network Engineer
"Certifications? we dont need no stinking certifiaction."
yahoo IM handle: greater_vortex

 

[Odissey]

On which of two servers you keep primary zone? If primary on DNS server, - be convinced, that type of zone on DC is secondary, not integrated or primary.
vadimp@yandex.ru

 

[wb5vrd]

I have had a similiar problem. I solved it by installing DNS on the domain controller and then pointing to the DNS member server address as a secondary DNS source. R. Henson CCNA,CCAI,MCP