Preparing Network Connections/Applying Computer Settings takes a while

[bdoub1eu]

Okay, I've nowhere else to turn. I've been looking into this for a few days and can't seem to find any info on it.

Our environment: Mixed 2000/2003 domain, a few DC's...All but one is 2003. I am in the process of taking this last 2000 DC out of comission and putting a 2003 in it's place. I just built a new 2003 SP1 server like I have in the past and dcpromo'd it to a DC. Server has a static IP and DNS is pointing to itself. I haven't had any issues in the past when dcpromo'ing servers...

Rebooted it after DCPROMO and it took a while (10 minutes or so) to actually get to the logon screen.

I have ran dcdiag and netdiag and all tests are passing.

Errors in event viewer are:

Application log:

Event ID 1053
Windows cannot determine the user or computer name. (The system detected a possible attempt to compromise security. Please ensure that you can contact the server that authenticated you. ). Group Policy processing aborted.

Event ID 53258
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: %1

Event ID 53258
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings. Error Specifics: d:\nt\com\complus\dtc\dtc\adme\uiname.cpp:9280, Pid: 476
No Callstack,
CmdLine: C:\WINDOWS\system32\msdtc.exe

Directory Service Logs:

Event ID 2088
Active Directory could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.

Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory forest, including logon authentication or access to network resources.

You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.

Alternate server name:
spam-l3
Failing DNS host name:
205743d0-7d99-43f5-b3da-20795394b20f._msdcs.domain.com

Event ID: 40960
The Security System detected an authentication error for the server LDAP/Localhost. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.
(0xc000005e)".

Event ID 5781:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'ForestDnsZones.chemspec.com.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).



Any help is greatly appreciated...I think I installed DNS when I installed 2003. I think in the past, during the dcpromo, dns was installed. Should matter though...DNS appears to be working as I can ping from the server in question to all the other DC's...

 

[elmurado]

have you tried rebooting more than once?

ID 5781:

http://support.microsoft.com/?kbid=311354

not sure if you've seen these already--sounds like you may have. how about backing dcpromo out and trying again?
What does the DNS entry for the new box say in the DNS server?
maybe delete it and re-enter it? What is the DNS server for the new box? Is it the only DNS server you have on the network? Why do you say you think you installed DNS when installing 2003? On which box?

 

[Larsdemo]

http://www.petri.co.il/active_directory_srv_records.htm

see if you have these record

lars

Network admin for worldwide freight forwarders company.
mcp mcsa\: Messaging mcse -2003

 

[Larsdemo]

enable dynamic update on the relevant DNS zones

Network admin for worldwide freight forwarders company.
mcp mcsa\: Messaging mcse -2003

 

[bdoub1eu]

Yes, I have rebooted probably 30 or so times...That is the only time I get the warnings is upon reboot.

Question: "What does the DNS entry for the new box say in the DNS server?"

Answer: The DNS entry is correct and shows the correct IP.

Question: "What is the DNS server for the new box?"
Answer: The Primary DNS is itself since it's a DC

Question: "Is this the only DNS server you have on the network?"

Answer: No, we have 4 other DC/DNS servers.

Question: "Why do you say you think you installed DNS when installing 2003?

Answer: I installed DNS during the install of 2003. During the DCPROMO process, DNS was configured...I didn't have to configure the zone after the server was promoted.

I looked at

http://www.petri.co.il/active_directory_srv_records.htm

and the records are there.

Dynamic updates are enabled on the DNS zone.

 

[bdoub1eu]

Could it be that the services aren't starting up correctly and in the right order or that the netlogon service is delayed?

Could it be that I am still in a mixed mode environment and still have a win2k DC/DNS server at this particular site?

 

[bdoub1eu]

I read this somewhere...

From a newsgroup post: "This can be caused if you have a single DC or two DCs and they point to themselves as the first entry in the DNS list in IP properties and the zone is AD Integrated. Reason could be that the DC has many services running on it (SQL, Exchange, etc.) or is a slower machine, and when the Netlogon service tries to register into the zone at boot time, AD is not quite initialized yet and so you get the error. You can either ignore it or change the zone to a Primary, or if you have multiple DCs, change the first entry to the partner and the second to itself".

 

[lilinho]

hi bdoub1eu , i'm with the same problem.. did you found same solution??