At last, I have a chance to post a problem with MS AD / Domains :P

I'm using a Cisco 6509 router running Cat OS software.

Network is split into VLANs to minimise broadcast traffic and keep seperate non-linked traffic.

So there's a 192.168.194.0/24 vlan and a 192.168.193.0/24 vlan, both having gateways to allow them to access other vlans.

I have a win2k server box running as a domain and dns on 192.168.194.81

Any workstation on the 194 subnet can join the domain without any problems.

However, now, any workstation on the 193 subnet cannot join the domain - I get a domain cannot be found. All the network settings on the workstation are correct with proper gateway (192.168.19x.254) and dns is entered. It can resolve the IP address if I give the DNS name, but still can't "find" the domain.

Interestingly, if the machine is already on the domain, I can log on as a different user which will authenticate against the domain, even if the workstation is on a different subnet to the domain.

I suspect a routing problem, something like the router not forwarding some udp broadcast packets across VLANs, but it worked before and doesn't work now and I can't think of anything I've changed :confused:

any ideas chaps?

TIA

Dunno , but I've seen the same thing happen in the past and would be interested to know what's causing it.

Any replication problems on the servers?

Any replication problems on the servers?

:confused:

This may clarify things: I get the following message:

The domain name mydomain might be a NetBIOS domain name. If this is the case, verify that the domain name is properly registered with WINS.

If you are certain that the name is not a NetBIOS domain name, then the following information can help you troubleshoot your DNS configuration.

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain mydomain:

The error was: "DNS name does not exist."

(error code 0x0000232B RCODE_NAME_ERROR)

The query was for the SRV record for _ldap._tcp.dc._msdcs.mydomain

Common causes of this error include the following:

- The DNS SRV record is not registered in DNS.

- One or more of the following zones do not include delegation to its child zone:

mydomain

. (the root zone)

For information about correcting this problem, click Help.

I suggest you click Help

The client does a broadcast for the DC using some kind of netbios name, and your routers may not be passing it across. I'm not sure if it's UDP or TCP, but Ciscos typically have UDP broadcasts disabled unless you go and specifically enable it. As someone else said, maybe you should have a DC on both subnets?

Edit: you could try this

:confused:

Just me being dum. You only have one server dont you. doh.

Is their a SRV record in your DNS for your DC?

Sorry, I'm not used to all the M$ acronyns

So to be clear, we only have a PDC and no BDC. But then, if you don't have a BDC, can you have a PDC? Shouldn't it be labelled ODC for "Only domain controller" ?

Nick, yes, by default Cisco routers do not broadcast packets across VLANs. And although I had a little play with it the other day, I'm 99.9% sure I've reverted to the standard config which worked when I started adding workstations on different subnets to the domain.

I can post my Cisco config file and to be honest, it's pretty short (only a couple of hundred lines, mainly port setups) if someone wants to check it out.

My biggest gripe is I don't know what's causing the problem - whether it is a router setup thing or something else on the PDC or workstation of combo of both :(

edit

Is their a SRV record in your DNS for your DC?

I never knew what was meant by that. So the answer is probably "no", but then if it is "no", I don't see when it would have ever been "yes" and it did work last week

I never knew what was meant by that. So the answer is probably "no", but then if it is "no", I don't see when it would have ever been "yes" and it did work last week

Look at the DNS zone for that domain.

You should see various folders that have the service records in them as per this link http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/maintain/opsguide/part1/adogd10.mspx

But I suspect that they will all be there as they should be if it used to work.

Netdiag /fix on your domain controller will check that it's all as it should be

http://www.chicagotech.net/netdiag.htm

Oh , and on 2000/3 domains you don't have a PDC in the old NT4 sense , but you will have a PDC emulator which has some extra functions.

Well, I've found what was causing the problem, and I think it's another MS bug :P

Basically, our domain is of the form mydomain.company

So there's the company suffix to be added.

When you go to the Network Name bit of the computer properties and go to change it, there's a "More" button which allows you to register that suffix. So I did that, and rebooted as it asked. Once rebooted, go back to the domain/workgroup join screen and see the suffix is still there

Go to join the "mydomain" and cannot be found :thumbdwn:

Go to join the "mydomain.company" and I get asked for domin admin username and password

Soooo, even though you've setup a domain name suffix, it's actually ignored when you try and join a domain

Thanks M$ for not saying that anywhere whatsoever

At least, I'm up and running again :woot:

There are various checkboxes on the DNS tab of the TCP config dialog. One that looks apposite in this case is "Use this connection's suffix in DNS registration", also "append primary and connection specific DNS suffixes". You might try experimenting with those - sorry it's not a specific recommendation.

Yeah, I probably will Nick.

Interesting thing though is that I didn't need to enter the full dns name if in the same subnet, only when in a different one. :confused: