Sever 2012 R2 DNS/AD Issues

kennethlott2 · 2024-10-28T18:51:15.657Z

Disclaimer: Before I start, I already know Server 2012 R2 is beyond out of support and we need to upgrade but the client has refused any attempt to upgrade the server so server upgrades are out of the question.

We are having a somewhat random issue with DNS queries on the network mainly dealing with accessing resources over the network via the hostname.

I am not able to access shares on the server by using a UNC path like \server1\sharename or \server1\printername but if I do \10.0.0.1\sharename or \10.0.0.1\printername I am able to access the resources without issue. I’ve tried clearing DNS cache on the client and the DC and verifying that the DNS service is running.

The workstation appears to function fine with DNS requests like using ping -a to do a reverse DNS lookup of a server hosting network resources before and after DNS cache is cleared on the client. Also to make matters more confusing, the issue appears to be random in regards to what machines are affected but the issue persists on that machine once it has been identified.

I’m leaning towards the issue being corruption in Active Directory rather than DNS related as DNS queries appear to work fine on problem machines outside of accessing network resources using a hostname but odd that it clears up as soon as we substitute the hostname with its relative IP address.

What are your thoughts on this issue? What about any troubleshooting steps I may have missed or repair steps I may attempt?

Thanks in advance for your consideration.

matt7863 · 2024-10-28T22:01:18.453Z

My first thought is that it is a Kerberos issue. shares working via IP but not name is a classic symptom.
Try connecting by name and then check the logs on client, server, and DC.

PatrickFarrell · 2024-10-29T02:42:42.247Z

It’s almost never AD corruption. I have yet to see a legitimately corrupted AD in decades. Has it happened to someone? Sure, but it’s rare. It however almost always DNS.

Start here and verify the basics, this fixes a great deal of things and will at least rule everything out. There are many times where DNS is broken but will work for some things therefore people believe it’s not DNS.

Active Directory DNS Refresher Windows

It’s DNS. It’s always DNS. No, DNS is fine, it’s not DNS, trust me. It was DNS. I’m posting because in the last few weeks we’ve had a few posts that turned out to be misconfigurations with DNS in a domain environment. Things like Domain controllers pointing at themself first for DNS, or having a public DNS server on the NIC of the Domain Controller or the clients. Hopefully this will help some people get out in front of potential issues. The general rules for DNS in an AD E…

Out of curiosity does it work if you do \\server.doman.com\printer using the full FQDN?

adrian_ych · 2024-10-29T06:17:16.531Z

Alkura:

Disclaimer: Before I start, I already know Server 2012 R2 is beyond out of support and we need to upgrade but the client has refused any attempt to upgrade the server so server upgrades are out of the question.

We are having a somewhat random issue with DNS queries on the network mainly dealing with accessing resources over the network via the hostname.

I am not able to access shares on the server by using a UNC path like \server1\sharename or \server1\printername but if I do \10.0.0.1\sharename or \10.0.0.1\printername I am able to access the resources without issue. I’ve tried clearing DNS cache on the client and the DC and verifying that the DNS service is running.

The workstation appears to function fine with DNS requests like using ping -a to do a reverse DNS lookup of a server hosting network resources before and after DNS cache is cleared on the client. Also to make matters more confusing, the issue appears to be random in regards to what machines are affected but the issue persists on that machine once it has been identified.

I’m leaning towards the issue being corruption in Active Directory rather than DNS related as DNS queries appear to work fine on problem machines outside of accessing network resources using a hostname but odd that it clears up as soon as we substitute the hostname with its relative IP address.

What are your thoughts on this issue? What about any troubleshooting steps I may have missed or repair steps I may attempt?

Thanks in advance for your consideration.

How many workstations are there and how many have issues ??

As mentioned by others that this is not DC’s corruption but just a DNS issue or a config issue.

if its DC corruption, you may be having “user does not have rights to access resource” errors

Then when did this started happening as it could also be some networking issue if there were changes made to network appliances like routers or switches even.

do tracert to the affected hostnames (instead of ping)
test by adding host file to one workstation (this is like a static DNS service)
do a IPconfig /all on the affected workstation to see what is the IP address of the DNS server(s)
if possible, check the DNS server IPs on ALL the DCs, then also the config for DHCP servers if the 2 DCs IP addresses were used as part of the addresses (as DNS servers).

From some of your test like ping and clearing DNS cache (I supposed on workstation) is that there are no “round robin” or DNS server IP issues on the DCs, thus the DCs may not have synced DNS records & not the full DNS records. Thus when certain workstations uses certain DNS servers, some servers DNS records may not be there, when you clear DNS cache, it might use another DC as DNS. Then it the issue seems to be random (but actually is not random but can ping host name might depend on which DC’s DNS service it uses).

user35092 · 2024-10-29T09:49:14.285Z

Assuming the windows clients are reasonably modern. Is the target on a differnet site? If the problem machine on a site that has its own AD/DNS Server or is this been done over a VPN?

Sounds more like a frangmentation issue if they are, I had a similar problem here.

shaneharvey · 2024-10-29T13:40:28.798Z

On the workstations, do you have 8.8.8.8 or another ip as a secondary?

kennethlott2 · 2024-10-29T17:29:07.272Z

We usually use DNS filter which auto configs the DNS setting to the loopback 127.0.0.2 which then forwards the request to DNS Filter’s DNS servers or the local DNS server to resolve local requests however, I have tried removing DNS filter entirely and going directly with the DC for DNS to try to eliminate DNS filter as a problem. The issue persists even with DNS filter removed from the equation.

kennethlott2 · 2024-10-29T17:51:01.100Z

Looks like it still doesnt work with the FQDN but I may have found some more applicable info. I believe the issue is limited to recently added PCs meaning machines that have been recently added to the network/AD. I tried swapping the DNS to another DC and got the same results.

kennethlott2 · 2024-10-29T18:09:35.886Z

The issue just appeared no more than 2 weeks ago. I tried a tracert and it successfully made the trip with just 1 hop directly to the DC. Good call on the host file, I didnt even think of that but unfortunately the host file did not resolve the issue either. The DNS is usually set to the loopback which sends requests to the DNS filter software which then forwards to their servers for external requests or the DC for local requests but I’ve tried uninstalling DNS Filter already, issue still persists. When DNS Filter is uninstalled, the DNS reverts back to the DC. I tried changing the DNS to the other DC as well with the same issue flushing DNS between all changes. Lastly, I’m not sure on this but I believe the issue is limited to newly added PCs. Here’s the exact message I receive:

frol · 2024-10-29T20:05:15.440Z

Do those new machines have the correct ‘Primary DNS Suffix’? Are they registered with reverse zone on DNS servers. Never used DNS filter software, so not sure if it’s matter.

adrian_ych · 2024-10-30T02:30:16.446Z

Alkura:

The issue just appeared no more than 2 weeks ago. I tried a tracert and it successfully made the trip with just 1 hop directly to the DC. Good call on the host file, I didnt even think of that but unfortunately the host file did not resolve the issue either. The DNS is usually set to the loopback which sends requests to the DNS filter software which then forwards to their servers for external requests or the DC for local requests but I’ve tried uninstalling DNS Filter already, issue still persists. When DNS Filter is uninstalled, the DNS reverts back to the DC. I tried changing the DNS to the other DC as well with the same issue flushing DNS between all changes. Lastly, I’m not sure on this but I believe the issue is limited to newly added PCs. Here’s the exact message I receive:

Why are you trying to access the DCs ?? Can you ping the DCs from that machine ?

What is a DNS filter (at least in LAN or Domain terms) ?
Then what is 127.0.0.2 ?

Then can you maybe try to use the UNC paths in each of the DC’s File Explorer ? Just to confirm that the DCs themselves have no issues using the UNC (remember to login to DC using a Domain Admin that have access rights to the servers).

But I would think you really need to try from 2 prong approach as the issue can be on

DC’s DNS settings
DHCP Settings (therefore from workstations)

PatrickFarrell · 2024-10-30T03:10:09.578Z

adrian_ych:

What is a DNS filter (at least in LAN or Domain terms) ?
Then what is 127.0.0.2 ?

If I had to guess, it’s the source of the problems. Also probably this

DNSFilter

Set up Local Domains in DNSFilter dashboard

What are Local Domains? Most corporate networks will have some ‘source of truth’ for Split-Horizon DNS. This may include lan-only domains such as BigCo.mycorp or local IPs returned for corporate re...