Re: DomainDNSZones child domain DNS entries missing

Refer to http://support.microsoft.com/kb/949257

hth
Marcin

"WayCoolkennel" <> wrote in message
news:...
>
> Trying to run /RODC and have a child domain that is failing. The error
> is
>
> LDAP API ldap_search_s finished, return code is 0xa
>
> Adprep could not contact a replica for partition
> DC=DomainDnsZones,DC=childdomain,DC=mydomain,DC=do main,DC=com.
>
> Error code: 0x0. Server extended error code: 0x0, Server error message:
> (null).
>
> Ok.. so I've read the KB (script to set the FSMO, this script fails
> with "a referral was returned" and I've read the similar thread here
> http://forums.techarena.in/server-dns/503672.htm .. I have determined
> that DomainDNSZones partition exists for the child domain. The child
> domain DNS is set to "Replicate to all DNS servers in the Forest" But
> there are no DomainDNSZones.childdomain.mydomain.domain.com DNS entries
> .
>
> The child domain is delegated in the root DNS.
>
> So.. I need to get the child domain to recreate the DNS entries .. but
> I cant seem to figure it out.
>
> I saw that someone suggested creating the domain "DomainDNSZones" then
> running Netdiag /v /fix
>
> Is this the correct procedure ?
>
> Thanks for any help !
>
> --Steve
>
>
> --
> WayCoolkennel
> ------------------------------------------------------------------------
> WayCoolkennel's Profile: http://forums.techarena.in/members/153308.htm
> View this thread: http://forums.techarena.in/server-dns/1273143.htm
>
> http://forums.techarena.in
>

"WayCoolkennel" <> wrote in message
news:...
>
> Thanks for the reply... but...
>
> As I stated in my OP.. I have attempted to use the fixfsmo.vbs and it
> returns an error.. right now that error is:
>
> fixfsmo.vbs(21, 5) (null): The specified domain either does not exist
> or could not be contacted.
>
> So I'm assuming that it cannot do a DNS lookup for something.. ?

A 'domain does not exist or cannot be contacted' is normally rooted with DNS
problems or DNS misconfigurations. How is your current DNS infrastructure
setup regarding the forest root domain and child domains, if any exist?

What zone replication scope are the _msdcs.yourdomain.local and the
yourdomain.local in?

Can you post an ipconfig /all of two of the DCs in your domain, please?

Have you ever had a DC that failed that you pulled off the network without
demoting it or performing a Metadata Cleanup? To make sure no DCs are still
in AD, please take a look at this following article that shows how to use
ntdsutil to see what's in the actual AD database, which you can use to
remove any data (DCs, domains, etc), that no longer belong.

It could also be due to a duplicate zone scope in AD. Please read the
following to find out if this is the case, and how to fix it.

Using ADSI Edit to Resolve Conflicting or Duplicate AD Integrated DNS zones
http://msmvps.com/blogs/acefekay/arc...dns-zones.aspx


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE & MCSA
2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

"WayCoolkennel" <> wrote in message
news:...
>
> A 'domain does not exist or cannot be contacted' is normally rooted with
> DNS
> problems or DNS misconfigurations. How is your current DNS infrastructure
> setup regarding the forest root domain and child domains, if any exist?
>
> What zone replication scope are the _msdcs.yourdomain.local and the
> yourdomain.local in?
>
> [/QUOTE Wrote:
>>
>>
>> All DNS servers in the forest. (See OP)
>>
>>
>>
>> > > > Can you post an ipconfig /all of two of the DCs in your domain,
>> > > > please?> >
>>
>> Uh.. no.. be glad to check the settings .. what are you looking for ?
>> Which DC's ? Root or the child domain ?
>>
>>
>>
>> > > > Have you ever had a DC that failed that you pulled off the network
>> > without
>> > demoting it or performing a Metadata Cleanup? To make sure no DCs are
>> > still
>> > in AD, please take a look at this following article that shows how to
>> > use
>> > ntdsutil to see what's in the actual AD database, which you can use to
>> > remove any data (DCs, domains, etc), that no longer belong.> >
>>
>>
>> Sure ... this was the first thing I checked. The DC's and Domain
>> are valid and the NDNC exists in AD.
>>
>> > > > It could also be due to a duplicate zone scope in AD. Please read
>> > > > the
>> > following to find out if this is the case, and how to fix it.
>> >
>> > Using ADSI Edit to Resolve Conflicting or Duplicate AD Integrated DNS
>> > zones
>> > http://msmvps.com/blogs/acefekay/archive/2009/09/02/using-adsi-edit-to-resolve-conflicting-or-duplicate-ad-integrated-dns-zones.aspx> >
>>
>> I'll have a look..
>>
>> Thanks,
>>
>> --Steve
>
>
> --
> WayCoolkennel


Ok, let's take a look at your original post. You said:

> [...] I have determined
> that DomainDNSZones partition exists for the child domain. The child
> domain DNS is set to "Replicate to all DNS servers in the Forest"
> But
> there are no DomainDNSZones.childdomain.mydomain.domain.com DNS entries

I can see why there are (or is?) no entries for the child domain in the
DomainDnsZones partition . If you have the zone set to the ForestDnsZones
partition, why would it exist in the DomainDnsZones partition?

>
> The child domain is delegated in the root DNS.

That explains it further. In a parent-child delegation, you delegate the
child zone from the parent zone to the child domain's DNS servers. In order
to properly do that, you need to change the parent zone (if not already set)
to DomainDnsZones partition, then create a zone on one (yes, just ONE of the
DCs or you will create a duplicate & conflicting zone scenario) of the child
domain DNS servers and put it in the DomainDnsZones partition. Then you go
back to one of the parent domain DNS servers, and create the delegation.

If you have the child zone in the ForestDnsZones partition, then that means
it exists on ALL DCs. Hence it now creates a duplicate or a conflict in the
parent zone. It sees the delegation, meaning to go ask elsewhere, yet it
exists in it's own context. Therefore, it does not know what to do with it,
hence a conflict.


>
> So.. I need to get the child domain to recreate the DNS entries .. but
> I cant seem to figure it out.

First, you make sure that each child zone (if you have more than one child)
are all set to DomainDnsZones partition, and make sure the parent zone is as
well, allow replication to occur, if it can, that is because tthe conflict
or dupe scenario in your case may cause a problem with replication. Also,
ALL machines in the child domain must ONLY use the child domain DNS servers,
not the parent.

Keep in mind, a delegation is just that, you are telling it that another DNS
server is handling the namespace. The forest wide replication with a
delegation is defeating that, as well as may be causing a dupe/conflict
issue.

>
> I saw that someone suggested creating the domain "DomainDNSZones" then
> running Netdiag /v /fix

Sure, that will fix general issues, but not a configuration issue.

I hope that was understandable.

Oh, in a parent child delegation, configure a Forwarder from all child DNS
servers (yes all) to the parent DNS, then from the parent DNS servers to the
ISP.

Ace