ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    DC seems to have fallen off the Domain

    IT Discussion
    4
    38
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NerdyDadN
      NerdyDad
      last edited by

      Forest and Domain level is 2008R2. Local DC seems to have fallen off of the domain because it is not pulling from other DC's Users and Computers, etc. When I attempt to have it connect back to another DC, it keeps telling me "A local error has occurred."

      Should I demote by dcpromo then repromote?

      I do have backups, just in case.

      1 Reply Last reply Reply Quote 1
      • DashrenderD
        Dashrender
        last edited by

        I wouldn't. what do the event logs say? Why is it failing?

        1 Reply Last reply Reply Quote 1
        • DashrenderD
          Dashrender
          last edited by

          Run dcdiag on the controller in question, and from other working DCs and see what the results are.

          1 Reply Last reply Reply Quote 3
          • DashrenderD
            Dashrender
            last edited by

            Can you ping the other DCs? can they ping you?

            Both both name and IP?

            NerdyDadN 1 Reply Last reply Reply Quote 0
            • NerdyDadN
              NerdyDad
              last edited by

              Seeing Event ID 1311 in the event logs under ADDS.

              0_1485964388881_Capture.JPG

              1 Reply Last reply Reply Quote 0
              • NerdyDadN
                NerdyDad @Dashrender
                last edited by

                @Dashrender said in DC seems to have fallen off the Domain:

                Can you ping the other DCs? can they ping you?

                Both both name and IP?

                Problem server and known good server can ping each other via both IP address and FQDN.

                thwrT 1 Reply Last reply Reply Quote 0
                • DashrenderD
                  Dashrender
                  last edited by

                  Many suggestions in this thread

                  https://social.technet.microsoft.com/Forums/windowsserver/en-US/f03f2cb1-74cf-4bea-ac11-0cbed4a06204/the-knowledge-consistency-checker-kcc-has-detected-problems-with-the-following-directory?forum=winserverDS

                  1 Reply Last reply Reply Quote 2
                  • thwrT
                    thwr @NerdyDad
                    last edited by

                    @NerdyDad said in DC seems to have fallen off the Domain:

                    @Dashrender said in DC seems to have fallen off the Domain:

                    Can you ping the other DCs? can they ping you?

                    Both both name and IP?

                    Problem server and known good server can ping each other via both IP address and FQDN.

                    Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                    NerdyDadN 1 Reply Last reply Reply Quote 0
                    • NerdyDadN
                      NerdyDad @thwr
                      last edited by

                      @thwr said in DC seems to have fallen off the Domain:

                      @NerdyDad said in DC seems to have fallen off the Domain:

                      @Dashrender said in DC seems to have fallen off the Domain:

                      Can you ping the other DCs? can they ping you?

                      Both both name and IP?

                      Problem server and known good server can ping each other via both IP address and FQDN.

                      Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                      No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                      thwrT DashrenderD 2 Replies Last reply Reply Quote 1
                      • thwrT
                        thwr @NerdyDad
                        last edited by

                        @NerdyDad said in DC seems to have fallen off the Domain:

                        @thwr said in DC seems to have fallen off the Domain:

                        @NerdyDad said in DC seems to have fallen off the Domain:

                        @Dashrender said in DC seems to have fallen off the Domain:

                        Can you ping the other DCs? can they ping you?

                        Both both name and IP?

                        Problem server and known good server can ping each other via both IP address and FQDN.

                        Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                        No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                        You did... oh... consider self-flagellation as a viable learning strategy 😛

                        Just kidding, I don't know both products (the specific versions mentioned here).

                        1 Reply Last reply Reply Quote 0
                        • DashrenderD
                          Dashrender @NerdyDad
                          last edited by

                          @NerdyDad said in DC seems to have fallen off the Domain:

                          @thwr said in DC seems to have fallen off the Domain:

                          @NerdyDad said in DC seems to have fallen off the Domain:

                          @Dashrender said in DC seems to have fallen off the Domain:

                          Can you ping the other DCs? can they ping you?

                          Both both name and IP?

                          Problem server and known good server can ping each other via both IP address and FQDN.

                          Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                          No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                          Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

                          NerdyDadN 1 Reply Last reply Reply Quote 1
                          • NerdyDadN
                            NerdyDad @Dashrender
                            last edited by

                            @Dashrender said in DC seems to have fallen off the Domain:

                            @NerdyDad said in DC seems to have fallen off the Domain:

                            @thwr said in DC seems to have fallen off the Domain:

                            @NerdyDad said in DC seems to have fallen off the Domain:

                            @Dashrender said in DC seems to have fallen off the Domain:

                            Can you ping the other DCs? can they ping you?

                            Both both name and IP?

                            Problem server and known good server can ping each other via both IP address and FQDN.

                            Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                            No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                            Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

                            It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

                            DashrenderD 1 Reply Last reply Reply Quote 0
                            • DashrenderD
                              Dashrender @NerdyDad
                              last edited by

                              @NerdyDad said in DC seems to have fallen off the Domain:

                              @Dashrender said in DC seems to have fallen off the Domain:

                              @NerdyDad said in DC seems to have fallen off the Domain:

                              @thwr said in DC seems to have fallen off the Domain:

                              @NerdyDad said in DC seems to have fallen off the Domain:

                              @Dashrender said in DC seems to have fallen off the Domain:

                              Can you ping the other DCs? can they ping you?

                              Both both name and IP?

                              Problem server and known good server can ping each other via both IP address and FQDN.

                              Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                              No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                              Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

                              It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

                              Now you've (ok not you) have expanded the goal of the product. That's all fine and good if you need it.

                              wirestyle22W 1 Reply Last reply Reply Quote 1
                              • wirestyle22W
                                wirestyle22 @Dashrender
                                last edited by wirestyle22

                                @Dashrender said in DC seems to have fallen off the Domain:

                                @NerdyDad said in DC seems to have fallen off the Domain:

                                @Dashrender said in DC seems to have fallen off the Domain:

                                @NerdyDad said in DC seems to have fallen off the Domain:

                                @thwr said in DC seems to have fallen off the Domain:

                                @NerdyDad said in DC seems to have fallen off the Domain:

                                @Dashrender said in DC seems to have fallen off the Domain:

                                Can you ping the other DCs? can they ping you?

                                Both both name and IP?

                                Problem server and known good server can ping each other via both IP address and FQDN.

                                Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                                No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                                Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

                                It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

                                Now you've (ok not you) have expanded the goal of the product. That's all fine and good if you need it.

                                Sounds like when he was referring to AV he meant Symantec Endpoint protection. So he went from one Endpoint protection to another. New one seems to have more inventory management stuff

                                1 Reply Last reply Reply Quote 0
                                • DashrenderD
                                  Dashrender
                                  last edited by

                                  So have you rebooted it yet?

                                  NerdyDadN 1 Reply Last reply Reply Quote 0
                                  • NerdyDadN
                                    NerdyDad @Dashrender
                                    last edited by

                                    @Dashrender said in DC seems to have fallen off the Domain:

                                    So have you rebooted it yet?

                                    Did the reboot. Still a no-go.

                                    Symantec.cloud is their SEP product that points to a cloud controller instead of a manager, as with normal SEP, which has a manager on the network. Symantec.cloud is marketed for the SMB market.

                                    1 Reply Last reply Reply Quote 0
                                    • NerdyDadN
                                      NerdyDad
                                      last edited by

                                      Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                                      I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                                      wirestyle22W 1 Reply Last reply Reply Quote 1
                                      • wirestyle22W
                                        wirestyle22 @NerdyDad
                                        last edited by wirestyle22

                                        @NerdyDad said in DC seems to have fallen off the Domain:

                                        Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                                        I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                                        It's not uncommon for Symantec products to not fully or correctly uninstall

                                        NerdyDadN 1 Reply Last reply Reply Quote 4
                                        • NerdyDadN
                                          NerdyDad @wirestyle22
                                          last edited by

                                          @wirestyle22 said in DC seems to have fallen off the Domain:

                                          @NerdyDad said in DC seems to have fallen off the Domain:

                                          Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                                          I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                                          It's not uncommon with Symantec products to not fully or correctly uninstall

                                          I'm seeing that with another DC. This other DC is working correctly, but I want to get Symantec off of there before it gets to be too big of a problem. Considering using CleanWipe but not sure if I should or not.

                                          1 Reply Last reply Reply Quote 0
                                          • DashrenderD
                                            Dashrender
                                            last edited by Dashrender

                                            If you're DC is just a DC - you can demote it, then leave the domain, wipe and reload it, join the domain and promote.

                                            If it's also a fileserver, etc, well - have fun.

                                            This of course assumes you can't use the normal tools to remove the old AV cleanly.

                                            thwrT 1 Reply Last reply Reply Quote 1
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post