Windows Forum

Ask something
Discussion Locked

2nd DC in 2k NOT Authentication Users

0 helpful
3 replies

by techrerpublic 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

100% 2000 Environment, we have 2 DC in our Domain.
When the Main DC is ?down?, the second aka BDC is not able to Authenticate Users!!!
*FSMO and GC is on our main DC
*FRS Services is running on bth DC?S
*Replmon to verify the AD replication, is successful every hour (I thought it replicates every 15 minutes and is hardcoded??)
*Used netdiag on all DC?s, came back with all OK (DNS, NetBT, LDAP etc)
*able to ping + net use and map drives
Event Viewer is clean except of a msg in the DNS log;
*The attempt to communicate with global catalog \\pmi-main.possis.com failed with the following status:
There are no more endpoints available from the endpoint mapper.
* Unable to establish connection with global catalog.
Any help would be appreciated ?

3 replies

by tony.colgrove

Event Viewer told you the whole story. When a computer and then a user logon to AD they first contact a GC. When your main DC, which is the only GC is down, users will have problems. Since this is a single domain, you should make all DCs into GC's. This should help your logon issues.
In a single domain, there is no additional replication even when all DCs are GCs.

by techrerpublic

Yes your where right, last late late night I come to the smae conclusion.
The GC is responsibel for authentication and LDAP searches.
On a different Note, regarding ACCOUNT POLICIES are only enforced at the DOMAIN LEVEL "not" at the OU's.
Quote from George Spalding Email to me;
*****NO WORKAROUND. THIS IS ARCHITECTURAL. You can't have different
password policies within a domain. Different account policies means
different domain for password, lockout, and kerberos.

This discussion is closed to new replies.