Scenario:
NT4 domain, win2k stand-alone with IAS authenticating users agains SAM, stand-alone win2k3 DNS server with primary forward and reverse lookup zones (dynamic update disabled).
Last week I’ve attmpted to upgrade to AD. It went as follows:
Set up a new NT PDC.
Synchronized the entire domain, took old PDC off line.
Started the upgrade on the new PDC to win2k3.
Finished off the upgrade, which went with no issues.
Verified user account replication, authentication.
Registered the stand-alone 2k IAS server with AD (I verified the computer account exists in AD in the members of RAS and IAS access group).
Two problems I encounered:
1. When users try to connect via VPN or Dial-Up, it keeps promting them for the password. On the IAS server I keep getting:
Access request for user cfallis was discarded.
Fully-Qualified-User-Name = DOAMIN\user
NAS-IP-Address = x.x.x.x
NAS-Identifier =
Called-Station-Identifier = 8378
Calling-Station-Identifier = xxxxxxxxxx
Client-Friendly-Name = Dial-Up Chassis
Client-IP-Address = x.x.x.x
NAS-Port-Type = Async
NAS-Port = 2835
Reason-Code = 6
Reason = The server is unavailable.
I can see each server from either one, ping them…and what not.
The authentication works again after I reverted back to NT4 Domain
2. On the stand-alone 2k3 DNS server I have a lot of entries in both forward and reverse lookup zones. It’s configured to load them from file. How can I incorporate them to the newely set up AD integrated DNS on the DC.
I changed the primary zones to secondary on the stand alone DNS and allowed repliacation between the two. That resulted in wiping all entries out of the stand alon dns.
I was going to change the AD integrated zone to load from file and just copy and pasted the entries, but that’s not allowed with AD integrated zones.