Windows Server - Windows 2008 AD

Asked By Bright Hu

25-Jan-10 12:34 PM

Hello, my domain controller is windows 2008 server, it used to work fine,
after a power outage at this weekend, I restarted it and checked it, it
seemed work fine, but about one hour later, all the other computers in this
domain could not contact with it although the computers can ping it
correct...finally I restarted it again, it worked about one hour later and
the same issue again, does anyone have an idea about it? thanks a lot!

25-Jan-10 02:32 PM

Howdie!

Bright Hu schrieb:

Any errors seen in the event viewer? Like services shutting down? Have
you watched the time on the box - is it correct (and stays correct)? Is
it just this DC? What exactly does "could not contact" mean? No rep
traffic between DCs? No DNS requests (nslookup)?

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
ANY advice you get on the Newsgroups should be tested thoroughly in your
lab.

25-Jan-10 02:57 PM

Hello Florian,

Thanks for your reply, I checked errors in event viewer, there is no error
about the AD, but some errors about the IIS, finally I stopped the WWW
service. The computers in this domain takes a long time to startup because
of logging into this domain, when I ping the DC server, the TTL < 1ms, it
looked good, but when I tried to access the shared folder on DC server, the
access was denied, this happened after the DC server running one hour
later...

Thanks,
Bright

25-Jan-10 03:45 PM

Bright,

Bright Hu schrieb:

At the time you get "Access denied" on a share, is there anything logged
in the Security Event log? Is the time correct on the DC? Does it differ
(noticeably) from other DCs or clients?

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
ANY advice you get on the Newsgroups should be tested thoroughly in your
lab.

25-Jan-10 04:37 PM

there is no security error, but I found the below warning occurred 3 times:

The security of this directory server can be significantly enhanced by
configuring the server to reject SASL (Negotiate,  Kerberos, NTLM, or
Digest) LDAP binds that do not request signing (integrity verification) and
LDAP simple binds that  are performed on a cleartext (non-SSL/TLS-encrypted)
connection.  Even if no clients are using such binds, configuring the server
to reject them will improve the security of this server.

Some clients may currently be relying on unsigned SASL binds or LDAP simple
binds over a non-SSL/TLS connection, and will stop working if this
configuration change is made.  To assist in identifying these clients, if
such binds occur this  directory server will log a summary event once every
24 hours indicating how many such binds  occurred.  You are encouraged to
configure those clients to not use such binds.  Once no such events are
observed  for an extended period, it is recommended that you configure the
server to reject such binds.

For more details and information on how to make this configuration change to
the server, please see http://go.microsoft.com/fwlink/?LinkID=87923.

You can enable additional logging to log an event each time a client makes
such a bind, including information on which client made the bind.  To do so,
please raise the setting for the "LDAP Interface Events" event logging
category to level 2 or higher.

25-Jan-10 07:29 PM

Hi Bright Hu,

Can you post the actual EventID# and Source names of the errors you have
posted their descriptions, please? That will help us look them up for you a
lot easier.

Also, please post an unedited ipconfig /all of your DCs and a sample
workstation. This will help us eliminate possible basic configuration
issues.

Thank you,

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services

If you feel this is an urgent issue and require immediate assistance, please
contact Microsoft PSS directly. Please check http://support.microsoft.com
for regional support phone numbers.

25-Jan-10 08:04 PM

below is the event# and source name:

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          2010/1/26 7:57:05
Event ID:      2886
Task Category: LDAP Interface
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      DCSERVER.eplating.com
Description:

Thanks,
Bright

26-Jan-10 12:26 AM

Hello Bright,

This is an interesting error, rather warning. Were any changes ever made in
the domain controller's GPO or the Domain Controllers Local Policy regarding
Ldap Signing settings, or possibly a Security Template applied to the DC(s)
to increase security?

Take a look at the following links. The first one has a suggestion for
settings to change, but first it would be helpful to know what changes, if
any, were made. The second one is Microsoft's KB explaining how to enable
Ldap Signing, and the third link explains it in much more detail.

EventID 2886:
http://eventid.net/display.asp?eventid=2886&eventno=9831&source=ActiveDirectory_DomainService&phase=1

How to enable LDAP signing in Windows Server 2008
http://support.microsoft.com/kb/935834

Client, service, and program incompatibilities that may occur when you
modify security settings and user rights assignments:
http://support.microsoft.com/kb/823659

Ace

26-Jan-10 08:56 AM

factly, this server is AD, DNS, DHCP, and it is set to automatically install
windows update, I did not change anything on this server but I checked that
there is windows updates installed automatically, so I wondered if there is
any update caused the problem, I am checking the post and going to take a
try. thanks.

Bright

26-Jan-10 10:14 AM

I do not believe an update would have changed these settings. It could also
be coincidental. See what updates were installed prior to the power outage
or this occuring. Post the update # please.

Ace

26-Jan-10 01:15 PM

Ace,

after a couple of hours struggle, I finally restarted the server and DNS,
DHCP service, and removed web server role, I found there is an DHCP error
indicated that the network interface has no static IPV4 address, originally
I assigned a static IP address but now it is changed to dynamic address...the
error description is The DHCP service is not servicing any DHCPv4 clients
because none of the active network interfaces have statically configured
IPv4 addresses, or there are no active interfaces with Event# 1041, I
assigned an static IP address again and changed some setting of DHCP to make
it work, now the issue was gone. it seemed the error was caused by DHCP but
I do not know why the static IP was changed to dynamic IP, and at this time
of restarting the server, there is still indication showed some updates were
installed and initialized at the startup.

thanks for all of your help and instruction.

Bright