Authentication Problem

You must have selected to DC2 to be a global catalog server. Uncheck this selection from AD sites and services, NTDS properties page of DC2.

I think the PDC Emulator role was seized by DC2 from DC1. If you go to Users and Computers, Right click on the domain and choose operation masters, it will show who is responsible for what.

To change it back to DC1, you'll have to seize control back from DC2 to DC1.

good luck,

Sorry, let me clarify - DC1 and DC2 are the Domain Controllers for my site. Not the master domain controller for the entire domain. Hence, I can not change the Master roles. I can but I'd be in a heep of trouble. Anywaze, anything else?

what about the cost of the links? If DC2 has a lower cost value than Dc1, then that's where all the login requests will go to first.

for you to get your users to get validated on your dc1 you can disconnect the dc2 so the dc1 take control again to authenticate the users. seems like the dc2 pronounce itself as a master browser

I think one of our in house techs discovered the problem - read his report here;

Two domain controllers at different sites (NY-DC1 and LA DC1) share the following patterns under their file replication services event viewers.

I will list these events in the order they appear under their event viewers.
Event id:13555 File Replication is on an error state.
Event id:13502 File Replication services is stopping.
Event id:13504 File Replication stopped without cleaning.
Event id:13501 File Replication services started.
Event id:13514 File Replication services may be preventing computer "DC1" from becoming a domain controller.

BINGO!!!! This has to be our problem. If the DC1 is no longer participating as a domain controller then who do we authenticate too? DC2? Anyone?

Furthermore, when the Ntfrs services are stopped on the domain controllers you will also notice that the Sysvol share is no longer shared. If the domain controller doesn't have a Sysvol to share then the DC can not replicate over to other bridge head servers. The Sysvol is the staging area for each bridge head server! On the other hand if replication is healthy the Sysvol share should automatically be mounted. You can type "net share" at a command prompt to verify that the Sysvol shares are not mounted. In our case none of the DC1s have their Sysvol mounted! The reason for this I believe is because Chicago-DC1 is having problems replicating to all our bridge head servers at each location, therefore no replication has been establish with any of them.

Solution: Increase the staging area limit size on Chicago-DC1 and restart the dam thing so replicating occurs through out the entire forest. Chicago-DC1 has been experiencing thesame type of problems all along as our DCs and because he is the Root domain controller for the entire forest he affects everyone.