General discussion

Locked

active directory problems

By traquinop ·
I have a domain controller running Windows Server 2003 Standard. When I try to add an additional domain controller to my existing domain, I get the error message "The operation failed because Active Directory Wizard could not create the NTDS settings object for the domain controller...........

Ensure the provided network credentials have sufficient permissions.

"The RPC server is unavailable"

After several retries, the error changed to :
The operation failed because The AD Installation wizard was unable to convert the computer account SERVER2$ to a domain controller account. "Access is Denied"

I have run out of ideas and I desperately need to add a domain controller to my network.

This conversation is currently closed to new comments.

9 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

active directory problems

by n.u.r.v. In reply to active directory problems

Did you set up the currently running AD?

The error messages suggest you are having access / password problems.

Is there good connectivity between the running AD and Server2?

Collapse -

active directory issues

by traquinop In reply to active directory problems

I personally set it up just over a year ago,
the existing domain controller and server2 are on the same LAN, connecting through a 10/100 switch. connectivity is perfectly fine.
any suggestions?

Collapse -

Suggestions

by BFilmFan In reply to active directory problems

This is not Small Business Server edition is it? SBS only allows one DC to be in the domain.

Verify that the current domain controller ins't out of ARPC endpoints. You can increase the available ports and avoid this error by adding the following registry key:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort=50000

By default, Microsoft doesn't add that registry key.

Does the current DC run DNS? Is the new server pointing to the DC for DNS? Is the new server listed in DNS?

Is the remote registry service working on both systems?

Is the new server a member of the domain?

Is the new server in the correct time zone and talking to the PDC Emulator for time synchronization?

Collapse -

still not working

by traquinop In reply to Suggestions

I am running Windows 2003 Server (Standard Edition). Its definately NOT SBS.

How do I verify that the current domain controller ins't out of ARPC endpoints.

I have checked the registry key
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort
It has a value of 65535 already, so I did not change it.

Does the current DC run DNS? = I installed but did not configure the DNS service on the new server. The current DC definately has DNS, you do know that it is mandatory in order for it to run active directory... right?

Is the new server pointing to the DC for DNS? = Yes it is

Is the new server listed in DNS? = Yes it is

Is the remote registry service working on both systems? = yes it is

Is the new server a member of the domain? = yes it is

Is the new server in the correct time zone and talking to the PDC Emulator for time synchronization? = yes it is

AND ITS STILL NOT WORKING!!!!

Collapse -

Some more suggestions

by BFilmFan In reply to still not working

If the registry key is in place, then you shouldn't be out of RPC connections.

Can you reach network resources from the server? If not, I would reset the secure channel with NETDOM.

The account that you are using to DCPROMO this server is a domain administrator for the domain in which it is being promoted?

I would recommend running DCDiag on the existing controller with this command line string, which will give a deep analysis of what the controller is doing and any potential issues:

dcdiag /v /e /f:dcdiagLOG.txt /ferr:dcdiagERROR.txt

Note that depending on your DC, that process might have to run for as long as half-an-hour.

Is the DC that is in the same AD site as the new server a Global Catalog?

Are there any errors at all the Directory Services, DNS, System or security log on the DC? Just as a thought, restart the DNS server service on the DC to see if the issue clears up.

I am sure you've done most of these, but via the net it is an elimination game.

Just another thought is to peruse some of the information from the Google search that I have lsited in my quick answers links:

http://www.google.com/search?q=%22The+RPC+server+is+unavailable%22+AND+%22DCPromo%22&hl=en&lr=&rls=GGLD%2CGGLD%3A2003-46%2CGGLD%3Aen

Collapse -

active directory problems still

by traquinop In reply to Some more suggestions

I am using the domain administrator account.
DCdiag passes all tests xcept the one for system log
...........SERVER failed test systemlog


I found this in my directory service event log:

Active Directory was unable to establish a connection with the global catalog.

Additional Data
Error value:
1460 This operation returned because the timeout period expired.
Internal I
3200c77

User Action:
Make sure a global catalog is available in the forest, and is reachable from this domain controller. You may use the nltest utility to diagnose this problem.

still not working!!!!


F1... anybody

Collapse -

Check Server NTDS settings

by curlergirl In reply to active directory problems ...

Sounds like there a problem with the global catalog setting on your AD site. On your DC, open AD Sites and Services, open the Sites/Default-First-Site-Name/Servers/[servername] object. Right-click the NTDS Settings and go to Properties. The Global Catalog check box should be checked - if not, you don't have a global catalog server in your forest and this could be the problem.

Collapse -

Work for me

by fcarle In reply to active directory problems

I know it's almost a year since the last post but ... hey who knows.

MS KB232070 worked for me A1

Collapse -

Check your DNS settings, as DNS is the core of AD

by Why Me Worry? In reply to active directory problems

if your DNS server and zone is not functioning properly, then you will have issues joining new machines to the domain and promoting member servers to domain controllers. Also, make sure you are logged into the domain as a domain admin or someone with the permissions to create computer objects in the domain.

You can run dcdiag and netdiag commands on your existing domain controller to make sure your domain is functioning properly.

Back to IT Employment Forum
9 total posts (Page 1 of 1)  

Related Discussions

Related Forums