Clients can't validate to BDC????

Did they ever log on to the BDC? One thing I seem to remember is that workstations will log into whichever domain controller that last validated them (sort of like they create a secure channel to it).

We have a PDC in New York and a BDC in Massachusetts. When I find my users consistently logging on via the PDC, restarting and trying again usually gets them the BDC.

You can stop the server service on the PDC and try to logon with a client, look if they get validated. Its also possible that the server service is not working properly on the bdc. Question: what operating system are using the clients. You can also check the event log after manualy try to sync the domain.

Good luck.

You may want to make sure that the PDC is reachable by the BDC and vice versa.

To add a BDC to a domain, the PDC has to be contactable. Therefore the first task is to check that communications are working.

If you are using TCP/IP then ensure you can PING the PDC,

ping

If this is OK then the problem is at the NetBIOS level. If you have WINS on the network ensure the BDC is configured to use the WINS server as when the PDC starts it will register the WINS name <1Bh> which is used to identify the domain controller.

Alternatively the LMHOSTS file can be updated.

Start Notepad
Open the file \system32\drivers\etc\lmhosts
Add a line with the following syntax
#PRE #DOM:
Save the file
To use the lmhosts file during installation you should create the file on another machine and copy it over when the BDC is being installed.

Try this and we'll take it from there. . .

You don't say how you are doing NetBIOS name resolution. If you're using a WINS server and WINS is on the PDC only, this may be why the clients are always contacting the PDC first and logging on there. They have to get to the PDC for name resolution anyway, and then since they've already found the PDC they will use it as their logon server. One thing to try would be to set up WINS on the BDC as a replication partner with the PDC. Then, set your clients in location 2 to use the BDC as their primary WINS server instead of going to the PDC directly for name resolution. You could also solve this with an LMHOSTS file, as suggested by others, but I'm not a fan of static name resolution unless you have to. Hope this helps!

Is the BDC able to synchronize with PDC via WAN ?
One thing you should check on this is the NetBIOS Scope ID on the BDC.

Let me know.

I think what you need is force your clients to log on your PDC so , best way is make sure they run the logon script from your BDC, so go to user manager for domain, pick a user on your brank domain and under logon sript, change the path to you BDCserver netlgon share and it would do the trick

How are your clients logging on your network?

Make sure the sript is running on the BDC,

R u sure your BDC netlogon service is not too busy too validate users?

Good luck

Available as a hotfix utility after SP3 and included in SP4 and later, SetPrfDC.exe allows you to control the order the workstation (or server) attempts to establish a secure channel connection for login. Normally NT makes a secure channel connection with the first domain control in its domain which responds. This is a race condition. Normally this is the closest domain controller but should the closest be busy momentarily, a remote BDC across a WAN connection could answer first. When this happens, the login process is slow. In some cases VERY slow. SP3 added the ability to direct the NETLOGON process to a preferred DC for the secure channel. SetPrfDC.exe is a commandline utility you can set in the user profile. The syntax is:

SETPRFDCDomain ListOfDCsInOrderofPreference(DC1,DC2,DC3,...)

Example:

setprfdc accntdom accsanfran1,accsanfran2,acclosang1

....
taken from my tip:
http://is-it-true.org/nt/atips/atips236.shtml

Windows NT's SetPrfDC controls login domain controller in WAN environ

you really did not get into the configuration of your wan or lan. Is there a router hop count issue to contend with? Just because the BDC is on the client side of the wan link does not mean it is the shortest hop count, therefore the pdc could be getting the request and responding quicker then the bdc.

Also, client os may make a difference. Someone correct me if i am wrong, but i believe NTWS establishes a channel connection to the pdc.