I installed AD couple of days ago on Windows 2008 R2 with SP1. after installing Lync server and join it to this AD I noticed that it loses connection from time to time. also resolving hostnames takes 2 seconds time out and then resolves! I have had the same AD installed on another machine and I needed to re-install everything from scratch since I had some issues with Lync! Right after I launched DCPromo and installed the DC and DNS and after restart I started receiving those errors and still up to this moment im not sure why? Any help is much appreciated. ========= The dynamic registration of the DNS record '_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.mydomain.local. 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the following DNS server: DNS server IP address: 216.92.3.83 Returned Response Code (RCODE): 9 Returned Status Code: 9009 For computers and users to locate this domain controller, this record must be registered in DNS. USER ACTION Determine what might have caused this failure, resolve the problem, and initiate registration of the DNS records by the domain controller. To determine what might have caused this failure, run DCDiag.exe. To learn more about DCDiag.exe, see Help and Support Center. To initiate registration of the DNS records by this domain controller, run 'nltest.exe /dsregdns' from the command prompt on the domain controller or restart Net Logon service. Or, you can manually add this record to DNS, but it is not recommended. ADDITIONAL DATA Error Value: DNS server not authoritative for zone. C:\Users\Administrator>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = demoad * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Connectivity The host 703e3364-e707-4112-a9ef-e2e77b55f388._msdcs.mydomain.local could not be resolved to an IP address. Check the DNS server, DHCP, server name, etc. Got error while checking LDAP and RPC connectivity. Please check your firewall settings. ......................... DEMOAD failed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DEMOAD Skipping all tests, because server DEMOAD is not responding to directory service requests. Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : demotesas Starting test: CheckSDRefDom ......................... demotesas passed test CheckSDRefDom Starting test: CrossRefValidation ......................... demotesas passed test CrossRefValidation Running enterprise tests on : mydomain.local Starting test: LocatorCheck ......................... mydomain.local passed test LocatorCheck Starting test: Intersite ......................... mydomain.local passed test Intersite Mohammed JH

check this Kb article http://support.microsoft.com/kb/978387 http://msmvps.com/blogs/mweber/archive/2011/02/07/possible-error-messages-on-windows-server-2008-and-windows-server-2008-r2-domain-controllers.aspxhttp://www.arabitpro.com

Tried the hotfix, it says the update is not applicable on your computer. I have the latest updates on this DC so i'm not sure if this is the reason why I'm getting this message. Mohammed JH

could you please disable the AV/FW on the server for some time and check it ? http://www.arabitpro.com

Hi Syed, Firewall is already disabled on the Server! Also in File Replication Service under DFRS-Global Settings seems to be empty, and under DFRS-GS there's Domain System Volume and then Topology container, it has the Old Server name right after I installed Win2k8 R2. Should I rename this to the DC FQDN or the server's hostname ? I'm following the below article http://technet.microsoft.com/en-us/library/cc794759(WS.10).aspx thanksMohammed JH

mohammed can you please check this wilson has given some solutions here, first try this http://social.technet.microsoft.com/Forums/en/winserverNIS/thread/0507f7cc-c426-439b-a0c6-d36cda2dfee8http://www.arabitpro.com

I'm not sure what happened but after latest updates that I applied 5 minutes ago I restarted the server and the dcdiag command gives something totally different.. C:\Users\Administrator>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = demoad * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Connectivity ......................... DEMOAD passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Advertising ......................... DEMOAD passed test Advertising Starting test: FrsEvent ......................... DEMOAD passed test FrsEvent Starting test: DFSREvent ......................... DEMOAD passed test DFSREvent Starting test: SysVolCheck ......................... DEMOAD passed test SysVolCheck Starting test: KccEvent ......................... DEMOAD passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DEMOAD passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DEMOAD passed test MachineAccount Starting test: NCSecDesc ......................... DEMOAD passed test NCSecDesc Starting test: NetLogons ......................... DEMOAD passed test NetLogons Starting test: ObjectsReplicated ......................... DEMOAD passed test ObjectsReplicated Starting test: Replications ......................... DEMOAD passed test Replications Starting test: RidManager ......................... DEMOAD passed test RidManager Starting test: Services ......................... DEMOAD passed test Services Starting test: SystemLog A warning event occurred. EventID: 0x0000A000 Time Generated: 08/01/2012 11:49:50 Event String: The Security System detected an authentication error for the server ldap/demoad.mydomain.local. The failure code from authentication protocol Kerbero s was "An attempt was made to logon, but the netlogon service was not started. A warning event occurred. EventID: 0x0000A000 Time Generated: 08/01/2012 11:50:00 Event String: The Security System detected an authentication error for the server LDAP/demoad.mydomain.local/mydomain.local. The failure code from authentication pr otocol Kerberos was "An attempt was made to logon, but the netlogon service was not started. A warning event occurred. EventID: 0x0000A000 Time Generated: 08/01/2012 11:50:00 Event String: The Security System detected an authentication error for the server ldap/demoad.mydomain.local/mydomain.local@mydomain.local. The failure code from aut hentication protocol Kerberos was "An attempt was made to logon, but the netlogo n service was not started. An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:04 Event String: The dynamic registration of the DNS record 'gc._msdcs.mydomain.local. 600 IN A 192.168.1.180' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:04 Event String: The dynamic registration of the DNS record 'ForestDnsZones.demotesas .com. 600 IN A 192.168.1.180' failed on the following DNS server: A warning event occurred. EventID: 0x0000A000 Time Generated: 08/01/2012 11:50:03 Event String: The Security System detected an authentication error for the server LDAP/DEMOAD. The failure code from authentication protocol Kerberos was "An atte mpt was made to logon, but the netlogon service was not started. An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:05 Event String: The dynamic registration of the DNS record 'mydomain.local. 600 IN A 192.168.1.180' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:05 Event String: The dynamic registration of the DNS record '_ldap._tcp.mydomain.local . 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the following DNS server : An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:06 Event String: The dynamic registration of the DNS record '_ldap._tcp.Default-First -Site-Name._sites.mydomain.local. 600 IN SRV 0 100 389 demoad.mydomain.local.' fai led on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:06 Event String: The dynamic registration of the DNS record '_ldap._tcp.pdc._msdcs.de motesas.com. 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:07 Event String: The dynamic registration of the DNS record '_ldap._tcp.gc._msdcs.dem otesas.com. 600 IN SRV 0 100 3268 demoad.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:07 Event String: The dynamic registration of the DNS record '_ldap._tcp.Default-First -Site-Name._sites.gc._msdcs.mydomain.local. 600 IN SRV 0 100 3268 demoad.demotesa s.com.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:08 Event String: The dynamic registration of the DNS record '_ldap._tcp.b1b4e58e-8d00 -41f0-bec8-47d0bb88dd8b.domains._msdcs.mydomain.local. 600 IN SRV 0 100 389 demoa d.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:10 Event String: The dynamic registration of the DNS record '_kerberos._tcp.dc._msdcs .mydomain.local. 600 IN SRV 0 100 88 demoad.mydomain.local.' failed on the followi ng DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:10 Event String: The dynamic registration of the DNS record '_kerberos._tcp.Default-F irst-Site-Name._sites.dc._msdcs.mydomain.local. 600 IN SRV 0 100 88 demoad.demote sas.com.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:11 Event String: The dynamic registration of the DNS record '_ldap._tcp.dc._msdcs.dem otesas.com. 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:12 Event String: The dynamic registration of the DNS record '_ldap._tcp.Default-First -Site-Name._sites.dc._msdcs.mydomain.local. 600 IN SRV 0 100 389 demoad.demotesas .com.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:12 Event String: The dynamic registration of the DNS record '_kerberos._tcp.demotesas .com. 600 IN SRV 0 100 88 demoad.mydomain.local.' failed on the following DNS ser ver: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:13 Event String: The dynamic registration of the DNS record '_kerberos._tcp.Default-F irst-Site-Name._sites.mydomain.local. 600 IN SRV 0 100 88 demoad.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:13 Event String: The dynamic registration of the DNS record '_gc._tcp.mydomain.local. 600 IN SRV 0 100 3268 demoad.mydomain.local.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:14 Event String: The dynamic registration of the DNS record '_gc._tcp.Default-First-S ite-Name._sites.mydomain.local. 600 IN SRV 0 100 3268 demoad.mydomain.local.' fail ed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:15 Event String: The dynamic registration of the DNS record '_kerberos._udp.demotesas .com. 600 IN SRV 0 100 88 demoad.mydomain.local.' failed on the following DNS ser ver: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:15 Event String: The dynamic registration of the DNS record '_kpasswd._tcp.demotesas. com. 600 IN SRV 0 100 464 demoad.mydomain.local.' failed on the following DNS ser ver: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:15 Event String: The dynamic registration of the DNS record '_kpasswd._udp.demotesas. com. 600 IN SRV 0 100 464 demoad.mydomain.local.' failed on the following DNS ser ver: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:16 Event String: The dynamic registration of the DNS record '_ldap._tcp.ForestDnsZone s.mydomain.local. 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the follo wing DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:16 Event String: The dynamic registration of the DNS record '_ldap._tcp.Default-First -Site-Name._sites.ForestDnsZones.mydomain.local. 600 IN SRV 0 100 389 demoad.demo tesas.com.' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:16 Event String: The dynamic registration of the DNS record 'DomainDnsZones.demotesas .com. 600 IN A 192.168.1.180' failed on the following DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:17 Event String: The dynamic registration of the DNS record '_ldap._tcp.DomainDnsZone s.mydomain.local. 600 IN SRV 0 100 389 demoad.mydomain.local.' failed on the follo wing DNS server: An error event occurred. EventID: 0x0000168E Time Generated: 08/01/2012 11:50:17 Event String: The dynamic registration of the DNS record '_ldap._tcp.Default-First -Site-Name._sites.DomainDnsZones.mydomain.local. 600 IN SRV 0 100 389 demoad.demo tesas.com.' failed on the following DNS server: A warning event occurred. EventID: 0x00000090 Time Generated: 08/01/2012 11:50:26 Event String: The time service has stopped advertising as a good time source. A warning event occurred. EventID: 0x000727AA Time Generated: 08/01/2012 11:52:36 Event String: The WinRM service failed to create the following SPNs: WSMAN/demoad. mydomain.local; WSMAN/demoad. An error event occurred. EventID: 0x00000014 Time Generated: 08/01/2012 11:53:27 Event String: Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Internet Explorer 8 Compatibility View List f or Windows Server 2008 R2 x64 Edition (KB2598845). ......................... DEMOAD failed test SystemLog Starting test: VerifyReferences ......................... DEMOAD passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : demotesas Starting test: CheckSDRefDom ......................... demotesas passed test CheckSDRefDom Starting test: CrossRefValidation ......................... demotesas passed test CrossRefValidation Running enterprise tests on : mydomain.local Starting test: LocatorCheck ......................... mydomain.local passed test LocatorCheck Starting test: Intersite ......................... mydomain.local passed test Intersite Mohammed JH

can you please share ipconfig /all from the server ? http://www.arabitpro.com

Windows IP Configuration Host Name . . . . . . . . . . . . : demoad Primary Dns Suffix . . . . . . . : mydomain.local Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : mydomain.local Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft Virtual Machine Bus Network Ada pter Physical Address. . . . . . . . . : 00-15-5D-34-7E-63 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.1.180(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 DNS Servers . . . . . . . . . . . : 192.168.1.180 195.175.39.40 NetBIOS over Tcpip. . . . . . . . : Enabled C:\Users\Administrator>Mohammed JH

seems you have missing srv records please check this links and let us know and if missing please run dcdiag /fix and chekc it http://technet.microsoft.com/en-us/library/dd378970(v=ws.10).aspx http://www.arabitpro.com

btw, just for the record! Before creating this new DC I have had another server acting up as DC with the same hostname and had couple of other servers joined to it. In the event viewer I can see some errors that these servers are trying to connect to it using the old trust relationship, I haven't demoted these servers from the old setup yet. I just wanted to mention this as it might shed some light on the error im receiving! thanksMohammed JH

first check the above mentioned link and make it sure that you have all the srv records if not found then dcdiag /fix if you find them you might have to perform a metadata clean up check this http://support.microsoft.com/kb/230306 http://www.arabitpro.com

That's weird, I have removed the DNS 192.168.1.180 which is the DC's IP address and now there are no errors except for the connectivity! C:\Users\Administrator>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = demoad * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Connectivity The host 703e3364-e707-4112-a9ef-e2e77b55f388._msdcs.mydomain.local could not be resolved to an IP address. Check the DNS server, DHCP, server name, etc. Got error while checking LDAP and RPC connectivity. Please check your firewall settings. ......................... DEMOAD failed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DEMOAD Skipping all tests, because server DEMOAD is not responding to directory service requests. Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : demotesas Starting test: CheckSDRefDom ......................... demotesas passed test CheckSDRefDom Starting test: CrossRefValidation ......................... demotesas passed test CrossRefValidation Running enterprise tests on : mydomain.local Starting test: LocatorCheck ......................... mydomain.local passed test LocatorCheck Starting test: Intersite ......................... mydomain.local passed test Intersite Mohammed JH

Ok now this is really funny. look at what happened below. C:\Users\Administrator>netsh advfirewall set allprofiles state on << This command Enables the firewall on all the profiles on the DC since I already have it disabled. Ok. C:\Users\Administrator>netsh advfirewall set allprofiles state off << I disabled it here again. Ok. C:\Users\Administrator>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = demoad * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Connectivity ......................... DEMOAD passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DEMOAD Starting test: Advertising ......................... DEMOAD passed test Advertising Starting test: FrsEvent ......................... DEMOAD passed test FrsEvent Starting test: DFSREvent ......................... DEMOAD passed test DFSREvent Starting test: SysVolCheck ......................... DEMOAD passed test SysVolCheck Starting test: KccEvent ......................... DEMOAD passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DEMOAD passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DEMOAD passed test MachineAccount Starting test: NCSecDesc ......................... DEMOAD passed test NCSecDesc Starting test: NetLogons ......................... DEMOAD passed test NetLogons Starting test: ObjectsReplicated ......................... DEMOAD passed test ObjectsReplicated Starting test: Replications ......................... DEMOAD passed test Replications Starting test: RidManager ......................... DEMOAD passed test RidManager Starting test: Services ......................... DEMOAD passed test Services Starting test: SystemLog ......................... DEMOAD failed test SystemLog Starting test: VerifyReferences ......................... DEMOAD passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : demotesas Starting test: CheckSDRefDom ......................... demotesas passed test CheckSDRefDom Starting test: CrossRefValidation ......................... demotesas passed test CrossRefValidation Running enterprise tests on : mydomain.local Starting test: LocatorCheck ......................... mydomain.local passed test LocatorCheck Starting test: Intersite ......................... mydomain.local passed test Intersite C:\Users\Administrator> Mohammed JH

I have demoted all the servers from the this AD. Reformatted the Virtual machine and reinstalled win2k8 r2 with sp1 and re installed DC with DNS and CA role. I have also removed the DNS entry from all the servers which pointed to this particular DC (DNS). I have also changed the hostname of the server from demoad to demad. but the domain name is still the same. i'm not sure what else do I have to do ? Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access. any suggestion? Mohammed JH

I finally got rid of the error, here's what I did. 1- Reformatted the Machine and did the following: - Installed NET Framework first. - Installed ADDS second. - Launched dcpromo next. 2- Changed the IP address from 180 to a different IP. 3- Changed the Hostname to something different than the old one. 4- Disabled IPv6 and sit the DNS on the NIC to 127.0.0.1 EVERYTHING IS WORKING FINE NOW :DMohammed JH

Hi, Im glad to hear that you have resolved the issue by yourself and thanks for sharing your solutions in the forum. If you have anything else I can do for you, please do not hesitate to let me know and I will be very happy to help. Regards, Andy