ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    DC seems to have fallen off the Domain

    IT Discussion
    4
    38
    2.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • NerdyDadN
      NerdyDad @thwr
      last edited by

      @thwr said in DC seems to have fallen off the Domain:

      @NerdyDad said in DC seems to have fallen off the Domain:

      @Dashrender said in DC seems to have fallen off the Domain:

      Can you ping the other DCs? can they ping you?

      Both both name and IP?

      Problem server and known good server can ping each other via both IP address and FQDN.

      Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

      No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

      thwrT DashrenderD 2 Replies Last reply Reply Quote 1
      • thwrT
        thwr @NerdyDad
        last edited by

        @NerdyDad said in DC seems to have fallen off the Domain:

        @thwr said in DC seems to have fallen off the Domain:

        @NerdyDad said in DC seems to have fallen off the Domain:

        @Dashrender said in DC seems to have fallen off the Domain:

        Can you ping the other DCs? can they ping you?

        Both both name and IP?

        Problem server and known good server can ping each other via both IP address and FQDN.

        Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

        No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

        You did... oh... consider self-flagellation as a viable learning strategy 😛

        Just kidding, I don't know both products (the specific versions mentioned here).

        1 Reply Last reply Reply Quote 0
        • DashrenderD
          Dashrender @NerdyDad
          last edited by

          @NerdyDad said in DC seems to have fallen off the Domain:

          @thwr said in DC seems to have fallen off the Domain:

          @NerdyDad said in DC seems to have fallen off the Domain:

          @Dashrender said in DC seems to have fallen off the Domain:

          Can you ping the other DCs? can they ping you?

          Both both name and IP?

          Problem server and known good server can ping each other via both IP address and FQDN.

          Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

          No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

          Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

          NerdyDadN 1 Reply Last reply Reply Quote 1
          • NerdyDadN
            NerdyDad @Dashrender
            last edited by

            @Dashrender said in DC seems to have fallen off the Domain:

            @NerdyDad said in DC seems to have fallen off the Domain:

            @thwr said in DC seems to have fallen off the Domain:

            @NerdyDad said in DC seems to have fallen off the Domain:

            @Dashrender said in DC seems to have fallen off the Domain:

            Can you ping the other DCs? can they ping you?

            Both both name and IP?

            Problem server and known good server can ping each other via both IP address and FQDN.

            Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

            No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

            Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

            It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

            DashrenderD 1 Reply Last reply Reply Quote 0
            • DashrenderD
              Dashrender @NerdyDad
              last edited by

              @NerdyDad said in DC seems to have fallen off the Domain:

              @Dashrender said in DC seems to have fallen off the Domain:

              @NerdyDad said in DC seems to have fallen off the Domain:

              @thwr said in DC seems to have fallen off the Domain:

              @NerdyDad said in DC seems to have fallen off the Domain:

              @Dashrender said in DC seems to have fallen off the Domain:

              Can you ping the other DCs? can they ping you?

              Both both name and IP?

              Problem server and known good server can ping each other via both IP address and FQDN.

              Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

              No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

              Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

              It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

              Now you've (ok not you) have expanded the goal of the product. That's all fine and good if you need it.

              wirestyle22W 1 Reply Last reply Reply Quote 1
              • wirestyle22W
                wirestyle22 @Dashrender
                last edited by wirestyle22

                @Dashrender said in DC seems to have fallen off the Domain:

                @NerdyDad said in DC seems to have fallen off the Domain:

                @Dashrender said in DC seems to have fallen off the Domain:

                @NerdyDad said in DC seems to have fallen off the Domain:

                @thwr said in DC seems to have fallen off the Domain:

                @NerdyDad said in DC seems to have fallen off the Domain:

                @Dashrender said in DC seems to have fallen off the Domain:

                Can you ping the other DCs? can they ping you?

                Both both name and IP?

                Problem server and known good server can ping each other via both IP address and FQDN.

                Any chance you added another IP to the server's NIC/LAG/whatever? Could be a bad DNS entry of some sort.

                No changes in IP addresses, NIC, etc. Think I might have found the issue with dualing AV's. We recently changed from Symantec cloud AV to Cisco SourceFire AMP. Failed to uninstall Symantec first. Need to wait for a quick reboot window before I can reboot WINDOWS. You see what I did there? Huh? Huh? ...Okay, I'll see myself out.

                Glad to hear you got rid of that virus from your network - Symantec - though I wonder if the SourceFire stuff is any better?

                It seems to be a lot more thorough compared to Symantec. Symantec did find a few things here and there along the year. However, when we installed AMP, it started reporting back a lot more information in regards to security situations. It also gives me a more thorough analysis of either the infection or the device. Not sure if it is better or worse for the money (didn't write the check).

                Now you've (ok not you) have expanded the goal of the product. That's all fine and good if you need it.

                Sounds like when he was referring to AV he meant Symantec Endpoint protection. So he went from one Endpoint protection to another. New one seems to have more inventory management stuff

                1 Reply Last reply Reply Quote 0
                • DashrenderD
                  Dashrender
                  last edited by

                  So have you rebooted it yet?

                  NerdyDadN 1 Reply Last reply Reply Quote 0
                  • NerdyDadN
                    NerdyDad @Dashrender
                    last edited by

                    @Dashrender said in DC seems to have fallen off the Domain:

                    So have you rebooted it yet?

                    Did the reboot. Still a no-go.

                    Symantec.cloud is their SEP product that points to a cloud controller instead of a manager, as with normal SEP, which has a manager on the network. Symantec.cloud is marketed for the SMB market.

                    1 Reply Last reply Reply Quote 0
                    • NerdyDadN
                      NerdyDad
                      last edited by

                      Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                      I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                      wirestyle22W 1 Reply Last reply Reply Quote 1
                      • wirestyle22W
                        wirestyle22 @NerdyDad
                        last edited by wirestyle22

                        @NerdyDad said in DC seems to have fallen off the Domain:

                        Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                        I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                        It's not uncommon for Symantec products to not fully or correctly uninstall

                        NerdyDadN 1 Reply Last reply Reply Quote 4
                        • NerdyDadN
                          NerdyDad @wirestyle22
                          last edited by

                          @wirestyle22 said in DC seems to have fallen off the Domain:

                          @NerdyDad said in DC seems to have fallen off the Domain:

                          Scratch that. Its fixed. Thanks @Dashrender. That article led me to the right answer and cause of action.

                          I don't have a firewall on this server, but the conflict in AV's is what caused the issue and trying to keep the system secured.

                          It's not uncommon with Symantec products to not fully or correctly uninstall

                          I'm seeing that with another DC. This other DC is working correctly, but I want to get Symantec off of there before it gets to be too big of a problem. Considering using CleanWipe but not sure if I should or not.

                          1 Reply Last reply Reply Quote 0
                          • DashrenderD
                            Dashrender
                            last edited by Dashrender

                            If you're DC is just a DC - you can demote it, then leave the domain, wipe and reload it, join the domain and promote.

                            If it's also a fileserver, etc, well - have fun.

                            This of course assumes you can't use the normal tools to remove the old AV cleanly.

                            thwrT 1 Reply Last reply Reply Quote 1
                            • wirestyle22W
                              wirestyle22
                              last edited by

                              @nerdydad is this a VM or a standalone server?

                              1 Reply Last reply Reply Quote 0
                              • NerdyDadN
                                NerdyDad
                                last edited by

                                It's a vm. All of my DC's are vm's.

                                wirestyle22W 1 Reply Last reply Reply Quote 1
                                • thwrT
                                  thwr @Dashrender
                                  last edited by

                                  @Dashrender said in DC seems to have fallen off the Domain:

                                  If you're DC is just a DC - you can demote it, then leave the domain, wipe and reload it, join the domain and promote.

                                  If it's also a fileserver, etc, well - have fun.

                                  This of course assumes you can't use the normal tools to remove the old AV cleanly.

                                  mkfs.ntfs & format ... The only tools I know to fully remove Symantec products - except for a snapshot maybe.

                                  DashrenderD 1 Reply Last reply Reply Quote 4
                                  • DashrenderD
                                    Dashrender @thwr
                                    last edited by

                                    @thwr said in DC seems to have fallen off the Domain:

                                    @Dashrender said in DC seems to have fallen off the Domain:

                                    If you're DC is just a DC - you can demote it, then leave the domain, wipe and reload it, join the domain and promote.

                                    If it's also a fileserver, etc, well - have fun.

                                    This of course assumes you can't use the normal tools to remove the old AV cleanly.

                                    mkfs.ntfs & format ... The only tools I know to fully remove Symantec products - except for a snapshot maybe.

                                    LOL

                                    1 Reply Last reply Reply Quote 0
                                    • wirestyle22W
                                      wirestyle22 @NerdyDad
                                      last edited by

                                      @NerdyDad Is that secondary domain controller doing anything else like being a file server?

                                      NerdyDadN 1 Reply Last reply Reply Quote 0
                                      • NerdyDadN
                                        NerdyDad @wirestyle22
                                        last edited by

                                        @wirestyle22 said in DC seems to have fallen off the Domain:

                                        @NerdyDad Is that secondary domain controller doing anything else like being a file server?

                                        It is a secondary controller. FSMO roles are on another DC. The only other thing this server does is ots a print server and DHCP server.

                                        DashrenderD 1 Reply Last reply Reply Quote 0
                                        • DashrenderD
                                          Dashrender @NerdyDad
                                          last edited by

                                          @NerdyDad said in DC seems to have fallen off the Domain:

                                          @wirestyle22 said in DC seems to have fallen off the Domain:

                                          @NerdyDad Is that secondary domain controller doing anything else like being a file server?

                                          It is a secondary controller. FSMO roles are on another DC. The only other thing this server does is ots a print server and DHCP server.

                                          Well, as I said, if you can't remove the old AV using the typical tools, you do have other options, not great ones, but they are there.

                                          1 Reply Last reply Reply Quote 0
                                          • NerdyDadN
                                            NerdyDad
                                            last edited by

                                            As I am digging into this more and more, I am finding replication issues between DC's, namely the original problem child.

                                            <code>
                                            Source DSA largest delta fails/total %% error

                                            DOS3 38d.14h:20m:23s 5 / 10 50 (8457) The destination server is currently rejecting replication requests.

                                            DOS4B 38d.14h:20m:22s 5 / 15 33 (8457) The destination server is currently rejecting replication requests.

                                            SMC4A 38d.14h:20m:23s 5 / 15 33 (8457) The destination server is currently rejecting replication requests.

                                            SMC4B 35d.14h:24m:28s 15 / 15 100 (8456) The source server is currently rejecting replication requests.

                                            Destination DSA largest delta fails/total %% error

                                            DOS3 35d.14h:16m:35s 5 / 15 33 (8456) The source server is currently rejecting replication requests.

                                            DOS4B 35d.14h:02m:35s 5 / 15 33 (8456) The source server is currently rejecting replication requests.

                                            SMC4A 35d.14h:22m:52s 5 / 10 50 (8456) The source server is currently rejecting replication requests.

                                            SMC4B 38d.14h:20m:24s 15 / 15 100 (8457) The destination server is currently rejecting replication requests.
                                            </code>

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post