1

Hey guys,

We have two sites connected via site-to-site VPN. Each site has its own Domain controller, and both running win2k8R2. As soon as the site-to-site VPN link goes down, users aren’t able to authenticate to any network resources. DCDiag /a does show any errors and I attempted to force replications between the two DCs but still having the same issues. Times are sync’ed and network connectivity is solid between the two DCs. Am I missing something that is disallowing the 2nd DC take over authentication?

  • Also, all the FSMO roles are held by the 2nd DC (that one that doesn’t allow authentication once VPN link is down .)
12 Spice ups
2

Are you running 2 DNS servers? Can you ping your local resources by name when the link is down? Is this for all users?

3

how is your dns configured on each DC? Are they pointing to each other?

4

Site 1 has DC1/DNS

Site 2 has DC2/DNS

DNS is configuration on both DCs = Primary DNS is DC1, 2ndary DNS is DC2

Pingable via FQDN while link is down, and yes, this is for all users.

5

Yes, Running two dns servers, one on each DC, and yes I can ping resources via name while link is down (except resources on the other site of course)

6

I should probably note that currently, I don’t have different ‘Sites’ setup in AD. Both DCs are in the same default site …

7

Proper domain controller DNS setup is vital for Active Directory to work properly. Each Domain controller should be setup with a different DNS server as it’s primary, and itself (127.0.0.1) as it’s secondary. If you have more than 2 DNS servers in your domain or forest, you should setup a pattern whereby they all have different primary DNS partners, so that each server is used as someone else’s primary.

If you have just 2 DC’s

DC1: 192.168.1.2
DC2: 192.168.1.3

Then

DC 1 Static DNS should be: Primary: 192.168.1.3 Secondary 127.0.0.1
DC 2 Static DNS should be: Primary: 192.168.1.2. Secondary 127.0.0.1

You MUST setup Sites and Services properly for AD to know how to deal with lack of connections between sites, and also how to deal with authentication at each site (where the clients authenticate with the local DC unless it’s down.)

5 Spice ups
8

To add, DHCP Should be giving out the local DNS server first, then the remote DNS server, so at each site the local DC is handling DNS requests and they are not going across the WAN.

1 Spice up
9

Thank you! This makes sense … there’s no DHCP is setup setup, but I will try your suggestion including creating a new site in AD Sites & services, and will test.

Thank you,

10

What you should do is make the DC2 on site 2 as the main DNs on the network and the DC1 as secondary through DHCP and viceversa on the other network.

You also need different sites for each dc and subnets configured on each site so it is recognized properly.

11

How are the client’s getting IPs in both sites? 1 DHCP server? Do clients on the 2 sites have 2 different IP Ranges/Subnets?

You can setup DHCP to hand out 2 subnets and the router can be the one to handle the DHCP Relay.

12

Sorry @overdrive did not see your post, I did not see it on my mobile.

13

Thanks all,

I have created a new site/subnet in AD sites and services, and “Moved” DC into it. (keeping site1 as the default-first-sitename, and it’s subnet)

I also changed the replication freq. to the min. of 15 min to speed things along.

I’m seeing all sorts of AD erros in Event viewer now:

"This computer is now hosting the specified directory instance, but Active Directory Web Services could not service it. Active Directory Web Services will retry this operation periodically.

Directory instance: NTDS

Directory instance LDAP port: 389

Directory instance SSL port: 636"

and

"

The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.

Directory partition:

CN=Configuration,DC=“MyDomainName”,DC=com

There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers.

User Action

Perform one of the following actions:

  • Publish sufficient site connectivity information so that the KCC can determine a route by which this directory partition can reach this site. This is the preferred option.

  • Add a Connection object to a directory service that contains the directory partition in this site from a directory service that contains the same directory partition in another site.

If neither of the tasks correct this condition, see previous events logged by the KCC that identify the inaccessible directory servers."

It is also worth to mention that all of the sites and services changes never it (at least so far) to DC1

"

14

Did you fix the dns? Give it some time… You can set the replication to less time like immediately. Or 5 minutes

1 Spice up
15

i did. I setup each domain controller with the other DC IP address it’s primary DNS config, and it’s own (127.0.0.1) as the 2ndary

16

just a quick update … I see the sites and subnet changes on the other Domain Controller now, however, one of the NTDS settings is missing a connection on the DC2 … I will give it more time.

17

I ran “echo %logonserver%” on several random servers in the 2nd subnet, and they’re still being logon to DC1 instead of DC2 … is that normal?

18

Have you renewed the DHCP on the servers or added those Static DNS on each of them DNS 1 = DC2 and DNS 2= DC1?

19

Being or was last authenticated by, if you haven’t logged in since the sites have replicated, and we need to know they have, then you may still be logged on to a previous DC

20

there are no DHCP settings in this infrastructure. all static (all servers). I have changed the DNS settings on each of the Domain Controller, where the primary on each points to the other DC while the secondary DNS points to (itself) 127.0.0.1

As for servers (in this case “clients”) each of them currently is pointing to DC1 as primary DNS and DC2 as secondary DNS.

Should I change servers DNS settings in site 1 to reflect:

DNS1 = DC1

DNS2=DC2

and change servers DNS settings in site 2 to reflect:

DNS1=DC2

DNS2=DC1

???

and if so, does that help with the DC failover (authentication) … please advise,

Thank you,