Hi,

I have a domain with 3 domain controllers: one of them with Windows 2008 R2 SP1, the others with Windows 2003 R2 SP2.

I have a member server with Windows 2008 R2 SP1, a Vmware virtual machine.

I can't connect to this server via RDP. An authentication error prevents the connection, though I give the correct credentials.

I log as Domain admin in the VMWare console. If I run GPUPDATE, I got the following error:

User policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not resolve the user name.
This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctlyUser policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not resolve the user name.
This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify yourDomain Name System (DNS) is configured and working correctly.

Also, events 1053, 1054 and 1055 are registered in event viewer, all of them with error 1722.

I have made a intense search of this problems, and none of them applies to my case: I don't have DNS errors (resolution works perfectly, I can reach all domain controllers from the server). I don't have replication problems (the rest of the computers doesn't show the problem). There is no firewall blocking comunication between server and domain controllers. 

The time syncronization appears to work well (w32tm /resync and w32tm /query /status appears to work without issues).

What else can I do to troubleshoot this problem?

Thanks

Thank you for your help.

Here is the output of dcdiag:         

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Nombre-predeterminado-primer-sitio\SVR-CONTROLBCK
      Starting test: Connectivity
         ......................... SVR-CONTROLBCK passed test Connectivity

Doing primary tests

   Testing server: Nombre-predeterminado-primer-sitio\SVR-CONTROLBCK
      Starting test: Replications
         ......................... SVR-CONTROLBCK passed test Replications
      Starting test: NCSecDesc
         ......................... SVR-CONTROLBCK passed test NCSecDesc
      Starting test: NetLogons
         ......................... SVR-CONTROLBCK passed test NetLogons
      Starting test: Advertising
         ......................... SVR-CONTROLBCK passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... SVR-CONTROLBCK passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... SVR-CONTROLBCK passed test RidManager
      Starting test: MachineAccount
         ......................... SVR-CONTROLBCK passed test MachineAccount
      Starting test: Services
         ......................... SVR-CONTROLBCK passed test Services
      Starting test: ObjectsReplicated
         ......................... SVR-CONTROLBCK passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... SVR-CONTROLBCK passed test frssysvol
      Starting test: frsevent
         ......................... SVR-CONTROLBCK passed test frsevent
      Starting test: kccevent
         ......................... SVR-CONTROLBCK passed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0xC000001B
            Time Generated: 08/19/2015   07:40:35
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC000001B
            Time Generated: 08/19/2015   07:58:46
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:14
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:15
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:15
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:16
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:17
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 08/19/2015   08:10:25
            (Event String could not be retrieved)
         ......................... SVR-CONTROLBCK failed test systemlog
      Starting test: VerifyReferences
         ......................... SVR-CONTROLBCK passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : persancentral
      Starting test: CrossRefValidation
         ......................... persancentral passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... persancentral passed test CheckSDRefDom

   Running enterprise tests on : persancentral.es
      Starting test: Intersite
         ......................... persancentral.es passed test Intersite
      Starting test: FsmoCheck
         ......................... persancentral.es passed test FsmoCheck

The repadmin:

repadmin running command /showrepl against server localhost



Nombre-predeterminado-primer-sitio\SVR-CONTROLBCK

DC Options: IS_GC 

Site Options: (none)

DC object GUID: 0227e44f-48d4-40d0-9fbe-31558c29d098

DC invocationID: cebb7ab1-a7f8-4cba-8db1-7b10c18bdff5



==== INBOUND NEIGHBORS ======================================



DC=persancentral,DC=es

    Nombre-predeterminado-primer-sitio\SVR-CONTROLAD01 via RPC

        DC object GUID: f9a0dd59-e533-428c-89eb-25cf3a8484d7

        Last attempt @ 2015-08-19 08:14:51 was successful.

    Nombre-predeterminado-primer-sitio\SVR-CONTROL via RPC

        DC object GUID: 1a605af2-f679-4508-b568-fe8a8f9c1cbf

        Last attempt @ 2015-08-19 08:14:56 was successful.



CN=Configuration,DC=persancentral,DC=es

    Nombre-predeterminado-primer-sitio\SVR-CONTROLAD01 via RPC

        DC object GUID: f9a0dd59-e533-428c-89eb-25cf3a8484d7

        Last attempt @ 2015-08-19 07:55:49 was successful.

    Nombre-predeterminado-primer-sitio\SVR-CONTROL via RPC

        DC object GUID: 1a605af2-f679-4508-b568-fe8a8f9c1cbf

        Last attempt @ 2015-08-19 07:55:49 was successful.



CN=Schema,CN=Configuration,DC=persancentral,DC=es

    Nombre-predeterminado-primer-sitio\SVR-CONTROLAD01 via RPC

        DC object GUID: f9a0dd59-e533-428c-89eb-25cf3a8484d7

        Last attempt @ 2015-08-19 07:55:49 was successful.

    Nombre-predeterminado-primer-sitio\SVR-CONTROL via RPC

        DC object GUID: 1a605af2-f679-4508-b568-fe8a8f9c1cbf

        Last attempt @ 2015-08-19 07:55:49 was successful.



DC=DomainDnsZones,DC=persancentral,DC=es

    Nombre-predeterminado-primer-sitio\SVR-CONTROLAD01 via RPC

        DC object GUID: f9a0dd59-e533-428c-89eb-25cf3a8484d7

        Last attempt @ 2015-08-19 08:11:59 was successful.

    Nombre-predeterminado-primer-sitio\SVR-CONTROL via RPC

        DC object GUID: 1a605af2-f679-4508-b568-fe8a8f9c1cbf

        Last attempt @ 2015-08-19 08:14:41 was successful.



DC=ForestDnsZones,DC=persancentral,DC=es

    Nombre-predeterminado-primer-sitio\SVR-CONTROL via RPC

        DC object GUID: 1a605af2-f679-4508-b568-fe8a8f9c1cbf

        Last attempt @ 2015-08-19 07:55:49 was successful.

    Nombre-predeterminado-primer-sitio\SVR-CONTROLAD01 via RPC

        DC object GUID: f9a0dd59-e533-428c-89eb-25cf3a8484d7

        Last attempt @ 2015-08-19 07:55:49 was successful.

And the IP Config /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : svr-oraem
   Primary Dns Suffix  . . . . . . . : persancentral.es
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : persancentral.es

Ethernet adapter LAN:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : vmxnet3 Ethernet Adapter #3
   Physical Address. . . . . . . . . : 00-50-56-BE-63-8E
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::3583:b7ad:e243:f2e1%11(Preferred) 
   IPv4 Address. . . . . . . . . . . : 172.18.100.120(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 172.18.200.1
   DHCPv6 IAID . . . . . . . . . . . : 285233238
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-41-01-AF-00-50-56-BE-63-8E
   DNS Servers . . . . . . . . . . . : 172.16.100.2
                                       172.16.100.3
   Primary WINS Server . . . . . . . : 172.16.100.2
   Secondary WINS Server . . . . . . : 172.16.100.3
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{570DE3EF-0EDB-4754-AC36-5D7594441CB4}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Another strange thing occurs in the member server: when I type net time, shows a message telling that the windows time service is not running, but in the services.msc it appears as running.

>Also, events 1053, 1054 and 1055 are registered in event viewer, all of them with error 1722.
Please open Event Viewer and find these Events, check the Details tab and find the Error Code number.

Based on the Ipconfig result, the member server configured with DNS Servers: 172.16.100.2 and 172.16.100.3. If they are DCs with DNS installed, try to run dcdiag /test:dns to validate DNS health.

>resolution works perfectly, I can reach all domain controllers from the server
On the member server, open CMD and type below link to resolve the domain name:
Nslookup persancentral.es

Confirm that if all DCs are returned.

Best Regards,
Eve