1

Hello,

Thanks for clicking into this thread. I appreciate any help I can get on this matter.

I’ve been scratching my head for the past day, trying to troubleshoot issues I’m encountering with our Active Directory environment. We just moved into a brand new office space and a lot has changed, especially with our flat network design to a hierarchical network with multiple VLANs. Our domain controllers and physical VMware servers were shut down and moved from the old office space to the new one. Upon getting in Monday morning, I noticed that our Active Directory DNS servers were not working properly. I began investigating and also noticed that domain logins with credentials that were not previously cached was also not possible anymore. I’m wondering if anyone has suggestions on how I can troubleshoot this issue, or if someone has seen something similar. Additionally, what would have been the correct way to move domain controllers?

For reference,

  • Can successfully ping from client VLAN to DCs in server VLAN.

  • Can successfully perform DNS queries from client VLAN to DCs in server VLAN.

  • Can successfully resolve DC hostnames with nslookup.

  • PTR records for DCs were already created.

  • Greyed out _msdcs DNS folder in Forward Lookup Zone was deleted. Attempted to re-register with “ipconfig /registerdns” on DCs.

  • DCs are successfully replicating between each other. Creating/modifying an object on one DC is reflected upon the other DC.

  • Repadmin shows successful replication.

  • Attempted a server restart of all DCs. Attempted a service restart for netlogon, DNS Client, DNS Server, TCP/IP NetBIOS Helper.

  • “Client for Microsoft Networks” NIC property/protocol is installed and enabled.

  • Attempted to troubleshoot with firewall off for Domain, Public, and Private on DCs and client. DCs shares cannot be accessed using FQDN or IP address from File Explorer.

  • No errors in Event Viewer relating to logins or authentications.

  • DCDIAG DNS test results in error 53.

  • Attempting to join a new computer to the domain results in the error “The network path was not found”.

  • Subnets were created in AD Sites and Services to reflect new VLANs. All the new subnets were associated with

Any and all help is appreciated. Thanks in advance.
Paul

4 Spice ups
2

Can you ping your domain?

Check the Advanced section of the TCP/IP properties DNS is set to “Append primary and connection specific DNS suffixes”
and the checkbox beneath it should be ticked as well

Do a ipconfig /all to see, if your DHCP hands out a domain information.

3

Hey Bikerpete, thank you for your reply.

When performing a ipconfig /all, the DHCP server is not handing out any domain information at the moment. As the Windows DNS server was not functioning properly this morning, I had to use alternate DNS servers that are not managed by us. I do currently have my AD DNS servers configured to be the preferred and alternate DNS servers on my workstation.

“Append primary and connection specific DNS suffixes” was already selected under Advanced TCP/IP Settings. I am also able to ping my domain with 0 packet loss.

For additional reference, my DHCP servers are running off Meraki MX firewalls. The configuration of the current DHCP servers are exactly the same as we had it before, except it worked before…

4

Make sure the Network location is forced to Domain on the domain controllers and restart them.

Ive have this a few times where the Network location goes wrong on a full office move and you have to force it

5

All of these errors happen when you don’t have the _MSDS section of your DNS records serving up completely.

+1 on Martin2012 for pointing out that your network location may be wrong on your DCs.

Also, if you are going to use alternate DNS servers for a stopgap, make sure the full structure of your _MSDS, _SITES, _TCP, and _UDP sections are fully replicated (By hand counts)

If you don’t have all of those paths in your substitute DNS you may have issues with servers not responding to their roles.

6

Hey Martin2012,

I can confirm that the NIC on the domain controllers are set to be part of the Domain location. I have gone one step further by specifying the DNS suffix under advanced in hope that it will do something different.

Hey Mike.Campbell,

Thanks for your help. I took a look and it seems like the _msdcs folder has been recreated automatically. All of the subfolders contain records pointing to a DC. However, I do not see any _udp sections.

Inside _msdcs, I get the following:

  • dc
    • _sites
      • Default-First-Site-Name
        - _tcp
    • _tcp
  • domains
    • Bunch of characters
      • _tcp
  • gc
    • _sites
    • _tcp
  • pdc
    • _tcp
7

I will try to dig up my DNS entries tomorrow when I am back on shift. Been a long day, mostly without internet as I have been on other networks and away from my desk. I will try to dig it all out tomorrow and post it here for you to help fix it.

8

Hey Mike,

No need. I managed to get it working today.

For some reason, the domain controllers would not respond to authentication requests originating from other subnets. I noticed this when I placed a client machine on the same subnet/VLAN as the two domain controllers and found the domain controllers to be fully functional. To remediate this problem, I added multiple NICs to the domain controller virtual machines, one for each subnet that has clients. Afterwards, clients are able to successfully authentication against the domain controllers, and new computers are able to be joined to the domain.

I’m not sure if this is the correct way to do things in a multi-VLAN environment where DCs only exist in certain VLANs. Do you have any knowledge on this topic?

Thanks,

Paul

9

Hi Paul,

I would try to avoid multiple NICs on the domain controller (unless you have to use them). :slight_smile:

Setup each VLANs subnet in the MMC Active Directory Sites and Services console and associate them with your site.
That will tie your domain PCs in the VLANs to your AD site.

As long as the VLANs are blocked from each other, you usually will have to set up some firewall/routing rules for the AD related services.
If there is no special reason to separate them completely, you may create a full routed access.

Hope it helps …

our Domain Controller does not need to have a network interface for each VLAN. What you will want to do though is setup each VLANs subnet in the MMC Active Directory Sites and Services console and associate them with your “site”. This will associate any domain PC on these subnets as being in your AD “site”.

1 Spice up
10

ThePaul. Look at what Bikerpete said. Under Active Directory Sites and Services.

@bikerpete @paulzheng