Takes 20 mins to login again after rebooting Master DC in Forest....

[Ceez]

Hello everyone, first time, long time.

I have a curious question in regards to rebooting our Master FSMO holder in our forest with 3 child domains and the network taking about 20 mins before anyone can log into it after a reboot of the FOREST MASTER.

Let me give you some info.
All servers running Server 2003 Enterprise, SP2 - R2

FOREST, three servers as follow:
1st server - 1st DC of the forest (lets call it MainSrvr) - holds all 5 roles
2nd & 3rd - hold no roles but are Global Catalog servers.

child domain 1 (accounting)
1st server - schema & domain held by MainSrvr, holds the PDC, RID & Infrastructure
2nd server - Global Cat. <-demoting in a few weeks

child domain 2 (broward)
1st server - schema & domain held by MainSrvr, holds the PDC & RID
2nd server - Infrastucture & Global Cat.

child domain 3 (new york) (single DC)
1st server - schema & domain held by MainSrvr, holds the PDC, RID & Infrastructure.


Now i've read to make sure that there are no replication issues. I've checked all my DC's and we are replication error free.

I've also read about the DNS IP Address of the DC's in all the domains. Our master DC has a DNS ip of itself. The other DC's have the primary of the Master DC and the 2nd IP of itself. Is that correct?

In DNS, well all our entries seem to be correct as to what I can see. I am not a DNS pro and some of those funky folder names well....scare me to say the least. But all our Dc's are listed with the correct IPs/names in forward and reverse lookup zones. If there's something you can suggest here would be great.

So when I reboot the master DC during a maintanance window it can take up to 20 mins for the network to kick in or resolve or start up. If I try to RDP to our master Dc I get the following:
unable to log in because "The Specified Domain Either Does Not Exist or Could Not Be Contacted".
Obviously the network is there, but no one's home.

I can log into the Master Dc from the console, but none of the net drives map from file servers, and if I try to log into any other server I get the same message....even a user in a workstation.

sorry for the lengthy post but figured I give as much info as possible.

Thanks for your input,

ceez

 

[technome]

For a starter....

"The other DC's have the primary of the Master DC and the 2nd IP of itself. Is that correct?"
I would make the other DCs, "preferred DNS server" looking to their own IPs, then the FSMO's as the alternate. In the reverse as you have, it will automatically cause a delay

Have you run DCDiag /v and NetDiag /v on all servers, when they are all up? what errors are you getting?
Anything in the event logs.

Treat yourself to Mark Minasi's Mastering Windows Server 2003 by Sybex


........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[58sniper]

Well, having the DCs looking to other servers is only the smallest of delays. But I agree - DCs with DNS installed should look to themselves for DNS first.

Make all of your DCs Global Catalogs.

How are your sites and services configured?

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Ceez]

thanks for the replies.

@technoome, sorry I posted that wrong...

EACH DC which is also a DNS server have their own IP set as the "Preffered DNS Server" and then the IP of the MASTER DC as their "Alternate DNS Server". The MASTER DC only has its own IP as the "Preferred DNS Server" and no Alternate.

Isnt making all DC's global cats a bad idea? Isnt that too much talking back and forth between the servers? If I am not mistaken that's what I've read. I've also read that if you have more than 1 DC in your forest to NOT make the 1st DC a GC and rather place that on a 2nd DC.

Thanks again.

 

[Ceez]

and all domains reside within a /22 network. Each of them have their own range, ie:

10.201.0.0/22 - Main Forest + child 1
10.201.4.0/22 - child 2
10.201.8.0/22 - not available
10.201.12.0/22 - child 3
10.201.16.0/22 - not available

 

[Ceez]

Isnt there an EDIT button on this forum?!?!?

16.0/22 IS being used. My bad.

 

[58sniper]

Isnt making all DC's global cats a bad idea? Isnt that too much talking back and forth between the servers? If I am not mistaken that's what I've read. I've also read that if you have more than 1 DC in your forest to NOT make the 1st DC a GC and rather place that on a 2nd DC.

Not in an environment your size. Login speed can be affected by not having GCs that can handle the traffic, or too far away.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[theravager]

http://support.microsoft.com/kb/817470

may help you

 

[GrimR]

see if this will helps

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23486935.html

 

[PaulGillespie]

I've seen similar situations in smaller sites. Resolved by giving the DC the dns server of another DNS server first then itself second.

 

[Ceez]

thanks everyone for your input and links. I will be reviewing those.

I will also be running the dcdiag, dnsdiag and netdiag tests on all my 7 DCs and post the findings.

thanks again,

ceez