RE: [ActiveDir] Trying to run DCPromo and getting error 5171

[Rick Kingslan]

See comments inline below..... Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.microsoft.com/windowsxp/expertzone   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of steve Sent: Sunday, June 08, 2003 6:21 PM To: [EMAIL PROTECTED] A little more information:   S2.fanamats.com is the first DC holding all the FSMO roles. I was able to join S1 as a member server to fanmats domain. This is never been an issue, only when I try to promote it. Running Nslookup command it clearly states that it can’t see the domain controller, any suggestions? I also disable Netbios over TCP/IP.    [RTK]  Create a reverse lookup zone on your DNS for your subnet(s).  If you don't, you will see errors as NSLookup uses the reverse lookup zone to check the DNS server for accuracy by comparing IP address to FQDN.  It may report failure, but is a non-event.   BTW, disabling NetBIOS over TCP/IP is not going to aid in resolving the problem, except for just getting another protocol pout of the way.    Also, I ran both DCDaig and NLTest and once it finished it went away. Where does it store the results?   [RTK]  DCDiag and NLTest both must have their output written to a file.  They do not create a log file by default.  Hence, you will have to pipe the output to a file, for example:  DCDIAG /v > dcdiag.log   One more thing: I’m placing the server’s on a network that already has a Windows 2000 domain in place. “Millmats.com” Because new building isn’t ready yet and the going live date is July 1. To isolate problem, I took it off the network and now just have them connected between a hub.      [RTK]  Steve, all of this is great.  I also need you to pipe an IPCONFIG / ALL on both machines to a file.  EG:  ipconfig /all > s1.txt, then ipconfig /all > s2.txt   This will make a great start - and will likely provide what we need to resolve the problem.    Thanks, Steve Network Engineer ASE, CCNA, API, MCP 3.51” Server 3.51 was the hardest test I’ve ever taken” MCSE4.0 and MCP 2000         -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan Sent: Sunday, June 08, 2003 2:59 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] Trying to run DCPromo and getting error 5171   Steve,   On the first DC (I suspect this where your DNS is), have you checked and determined that the AD DNS zones have been created?  If you install the support tools from the Server CD on the first DC, when you run DCDiag and NLTest, is everything (well nearly so - one or two things will fail..) successful?   As to network - are both of these DCs on the same network or separated onto different subnets?  And, you state that you can ping by name.....  Is this machine name, or FQDN - and for which machine from where?   Using nslookup from the second DC, can you resolve and lookup, say the _msdcs.<domain name> zone?   The problem is clearly DNS related - either it's not resolving correctly or it's not being reached.  If the zones are not registered on the DNS server, stop then start the NETLOGON service. for the first DC.   Also, how do your event logs look on the first DC?  DS, DNS, NTFRS?  Everything look good?  Anything out of the ordinary in the System or App logs?   Let us know what you find out!   Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.microsoft.com/windowsxp/expertzone     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of steve Sent: Sunday, June 08, 2003 1:14 PM To: [EMAIL PROTECTED] Environment: 2 new servers   Servers Configuration: Windows 2000 as workgroup. Ran DcPromo on the server1. Verified that DNS was setup correctly, can ping server by name. Not using WINS.   Problem: Can’t make second Server a DC.   Error message: When running DcPromo on second server, I receive the same error message. The link below explains my error message.   http://www.microsoft.com/windows2000/dns/tshoot/     Thanks, Steve