Имеется 2 контроллера домена Windows Server 2003. На обоих контроллерах установлен DNS сервер и на обоих хранится Global Catalog. DHCP не поднят. Шлюз - отдельный компьютер с FreeBSD. Репликация между контроллерами проходит без проблем (проверено также через Active Directory Sites and Services). W32Time настроен на PDC. В настройках DNS обоих контроллеров домена указан DNS Forwarding на DNS провайдера. Вроде все работает, OU создаются без проблем, привязанная к ним Group Policy присваивается юзерам и т.д.
Проблема в следующем: при загрузке PDC система замирает на 5-6 минут на окне с Preparing Network Connections... После загрузки в Event Viewer следующие ошибки:
В Directory Service одно предупреждение:
Цитата Event ID - 2088, Source - NTDS Replication:
Active Directory could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.
Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory forest, including logon authentication or access to network resources.
You should immediately resolve this DNS configuration error so that this domain controller can resolve the IP address of the source domain controller using DNS.
Alternate server name:
имя_дополнительного_контроллера
Failing DNS host name:
39e24e13-8a29-4ed5-a409-b44218ac51fa._msdcs.имя_домена.local
NOTE: By default, only up to 10 DNS failures are shown for any given 12 hour period, even if more than 10 failures occur. To log all individual failure events, set the following diagnostics registry value to 1:
Registry Path:
HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics\22 DS RPC Client
User Action:
1) If the source domain controller is no longer functioning or its operating system has been reinstalled with a different computer name or NTDSDSA object GUID, remove the source domain controller's metadata with ntdsutil.exe, using the steps outlined in MSKB article 216498.
2) Confirm that the source domain controller is running Active directory and is accessible on the network by typing "net view \\" or "ping ".
3) Verify that the source domain controller is using a valid DNS server for DNS services, and that the source domain controller's host record and CNAME record are correctly registered, using the DNS Enhanced version of DCDIAG.EXE available on
http://www.microsoft.com/dns
dcdiag /test:dns
4) Verify that that this destination domain controller is using a valid DNS server for DNS services, by running the DNS Enhanced version of DCDIAG.EXE command on the console of the destination domain controller, as follows:
dcdiag /test:dns
5) For further analysis of DNS error failures see KB 824449:
http://support.microsoft.com/?kbid=824449
Additional Data
Error value:
11004 The requested name is valid, but no data of the requested type was found.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
.В System 3 предупреждения:
Цитата Event ID - 12, Source - W32Time:
Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
Цитата Event ID - 40960, Source - LSASRV:
The Security System detected an authentication error for the server ldap/имя_PDC.имя_домена.local. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.
(0xc000005e)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
.Цитата Event ID - 40960, Source - LSASRV:
The Security System detected an authentication error for the server LDAP/имя_PDC. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.
(0xc000005e)".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp
.Во время работы PDC никаких ошибок в Event Viewer не появляется... Что посоветуете?.. Спасибо заранее.