Why can't I logon, I have more than one DC?

by Pber June 09, 2009 21:43

I see questions about this all the time.  One of my DCs failed, why don't the other DCs pick up the load?  The answer is they should, but a few key settings may need to be configured.  Rest assure, you are probably only a few clicks a way of having it setup right.

Several reason can contribute to why you can't logon when you have a failed DC.  Here are the two most common:

  • Make all your DCs global catalogs (GCs).  The only caveat to that rule is if you have a multi domain environment, don't put a GC on the DC that holds the Infrastructure Master FSMO role.  See this link for further info: http://technet.microsoft.com/en-us/library/cc728188(WS.10).aspx
  • The second and most commonly missed issue is TCP/IP DNS settings on the client.  Since it is best practice to make a DC a DNS server as well, when it fails so does DNS.  So ensure your clients point to multiple DNS servers so they can resolve other DCs that are still online.  If you use DHCP in your environment, ensure your scopes are setup to hand out at least two different DNS servers.

Other reasons for failed logons during a DC failure could be:

  • The DC has not properly registered its SRV records and the client can't find a DC because the SRV records are missing in DNS.  This can be caused by the DHCP Client service not running on a DC.   Bizarre as it may seem, even though you have statically assigned an IP address and you don't think you need the DHCP Client service running, you do.  It is responsible for providing Dynamic DNS (DDNS) updates which is what registers SRV records. 
  • The DC may have properly registered its SRV records, but DNS aging may be set too aggressively and DNS scavenging is removing SRV records.  If this were the case, you would likely have much more logon issues and even while all DCs are online.  Never set DNS aging to age our records quicker than 24 hours.  See this for further info: http://technet.microsoft.com/en-us/library/cc759204(WS.10).aspx

Tags: , , ,

Active Directory

Add comment




  Country flag

biuquote
  • Comment
  • Preview
Loading



Powered by BlogEngine.NET 1.6.1.0
Theme by Mads Kristensen | Modified by Pber