Tuesday, July 10, 2012

Trusted Domain Authentication issues

Intermittently we had servers that were unable to authenticate to the secondary domain - noobs
It seem that when the PDC2 was restarted the problem was fixed. I believe the servers switched to back to using PDC1 or another DC and were happy.

The trust was verified, etc but I think this was done on PDC1, started to annoy me... so had a look around.

On PDC1 there is a noobs.domainname secondary zone

On PDC2 Primary DNS is itself Secondary DNS being PDC1

On pdc2  was unable to resolve noobs.domainname
ping noobs.domainname
Ping request could not find host noobs.domainname

nltest /SC_Verify:noobs.domainname
Flags: 80Trusted DC NameTrusted DC Connection Status Status = 1311 0x51f ERROR_NO_LOGON_SERVERS
Trust Verification Status = 1311 0x51f
ERROR_NO_LOGON_SERVERS


[FIX] On Pdc2 Added a conditional forwarder for  noobs.domainname  to pdc1

nltest /SC_Verify:noobs.domainname
Flags: b0 HAS_IP  HAS_TIMESERV
Trusted DC Name \\ExternalPDC.noobs.domainname
Trusted DC Connection Status Status = 0 0x0 NERR_
SuccessTrust Verification Status = 0 0x0 NERR_Success

No comments: