Exchange Server Sees Only 1 GC

Friday, November 06, 2009 8:26 PMexad

0
Sign In to Vote

Hi all,

We have a secondary domain controller that is also set up as a GC. When I look in the ESM's properties I only see the PDC as the GC. I set the topology logging to maximum and this is what I got:

Process MAD.EXE (PID=3112). DSAccess has discovered the following servers with the following characteristics:

(Server name | Roles | Reachability | Synchronized | GC capable | PDC | SACL right | Critical Data | Netlogon | OS Version)

In-site:

pdc.subdomain.domain.xy CDG 7 7 1 0 1 1 7 1

gc2.subdomain.domain.xy CDG 7 7 1 0 0 1 7 1

Out-of-site:

I have changed the server names but the server that isn't showing up in ESM is "gc2.subdomain.domain.xy" even though the log shows it. I'm unsure what the problem could be. Any insights on this issue would be great.

Thanks in advance!
- Reply
- Quote

Answers

Saturday, November 07, 2009 7:12 PMAndy DavidMVP

1
Sign In to Vote
Oh, I agree. In fact, I should have looked closer at the dsacess 2080 the OP posted earlier.

gc2.subdomain.domain.xy CDG 7 7 1 0 0 1 7 1

The DC doesnt have the SACL right.

Exad, here are some articles on how to troubleshoot that if a simple restart doesnt solve it:

http://support.microsoft.com/kb/316300
http://ntoskrnl.wordpress.com/2008/08/20/eventid-2080-dsaccess-sacl-right-fix/
http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/d57c4227-ab6b-4833-93b5-99616b52a2af
- Marked As Answer byJames-LuoMSFT, ModeratorTuesday, November 10, 2009 2:41 AM
- Reply
- Quote
Monday, November 09, 2009 12:36 PM--Vinod--

1
Sign In to Vote
I would go for /domainprep on the second GC so that it will fix Manage Auditing and Security Log.

and then replicate the changes between both GC'S

i would also try restarting the SA so that DSACCESS cache can pick both GC's
Vinod |CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|
- Marked As Answer byJames-LuoMSFT, ModeratorTuesday, November 10, 2009 2:40 AM
- Reply
- Quote

All Replies

Friday, November 06, 2009 8:45 PMRajnish R Sharma

0
Sign In to Vote
Both the GC's are in the same AD site where exchange is? Normally exchange will not pick up the GC which is in the other AD site. Are AD replications fine? If you try SET L command from command promt on the exchange what do you get.
Try to run exbpa and when it asks the DC name, punch in the gc2 over there and see the results of exbpa and paste it over here.
Raj
- Reply
- Quote
Friday, November 06, 2009 10:11 PMexad

0
Sign In to Vote
Yes, both the GC's are in the same AD site. The AD replications look fine to me. The SET L command shows the PDC server. What part of the exbpa output would you like me to attach here since it is a big file.

Thanks Raj!
- Reply
- Quote
Friday, November 06, 2009 10:45 PMAndy DavidMVP

0
Sign In to Vote
Exchange isnt installed on the PDC is it?
As for ExBpa, post any critical warnings.
- Reply
- Quote
Friday, November 06, 2009 11:33 PMexad

0
Sign In to Vote
Here are some of the warnings:
Items of severity Warning:
- Network interface driver file is more than two years old
- Storage driver is more than two years old
- Symantec Mail Security for Exchange update available
- Temporary file path optimization
- Virus scanning API (VSAPI) plain text scanning
Items of severity Best Practices:
- Application log size
- Consider setting 'TarpitTime'
- Single global catalog in toplogy
- BIOS update available
- Outlook connection range
- Reply
- Quote
Saturday, November 07, 2009 6:17 AMRajnish R Sharma

1
Sign In to Vote
Even exbpa is detecting single global catalog in the AD site. Try runnning dcdiag and net diag on the problematic domain controller. Check with replmon /showreps on the dc.

Also run the commands from nltest with dclist, dcname and dsgetsite.
Raj
- Reply
- Quote
Saturday, November 07, 2009 11:42 AM-Hari-

0
Sign In to Vote
Check your local DNS server for _gc (SRV) records..

Stop the firewall service on both the domain controllers and even exchange 2003

restart the new DC which has been promoted to GC once done restart the Exchange 2003 Server (take downtime time)
Hari Bylapudi
- Reply
- Quote
Saturday, November 07, 2009 3:47 PMAndy DavidMVP

0
Sign In to Vote
In addition to Hari's suggestion, I would check the event logs on that new GC.
- Reply
- Quote
Saturday, November 07, 2009 6:02 PMRich Matheisen [MVP]

0
Sign In to Vote
On Sat, 7-Nov-09 15:47:01 GMT, Andy David wrote:

>In addition to Hari's suggestion, I would check the event logs on that new GC.

Heck, I'd reboot the GC first. I didn't see any info on what O/S or SP
the GC is using and it used to be that a GC needed a reboot after it
was made a GC before it would show up.
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
- Reply
- Quote
Saturday, November 07, 2009 7:12 PMAndy DavidMVP

1
Sign In to Vote
Oh, I agree. In fact, I should have looked closer at the dsacess 2080 the OP posted earlier.

gc2.subdomain.domain.xy CDG 7 7 1 0 0 1 7 1

The DC doesnt have the SACL right.

Exad, here are some articles on how to troubleshoot that if a simple restart doesnt solve it:

http://support.microsoft.com/kb/316300
http://ntoskrnl.wordpress.com/2008/08/20/eventid-2080-dsaccess-sacl-right-fix/
http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/d57c4227-ab6b-4833-93b5-99616b52a2af
- Marked As Answer byJames-LuoMSFT, ModeratorTuesday, November 10, 2009 2:41 AM
- Reply
- Quote
Sunday, November 08, 2009 6:30 AMexad

0
Sign In to Vote
Hi all,

Thanks for all your help. When I ran the dsdiag command on the exchange server I saw the message about not having the proper security. In addition, I checked the DC gc2's "Manage Auditing and Security Log" and it does give the Exchange Enterprise Servers the permission. Since everything looks good except that the exchange server doesn't have the required privilege on the DC I feel that I should run the setup.exe command with the /domainprep flag (as described in Article 314294). Do you folks think that that is a good way to go about it? Since the exchange server is in production I hope it doesn't mess anything up?

Thanks once again!
- Reply
- Quote
Sunday, November 08, 2009 7:11 AMRajnish R Sharma

1
Sign In to Vote
I think that should be fine. Make sure you take a system state back up from the domain controller.
Raj
- Reply
- Quote
Sunday, November 08, 2009 9:42 PMexad

0
Sign In to Vote
Hi Raj,

Should I be running the setup command with the /domainprep switch on the exchange server or the DC gc2?

Thanks!
- Reply
- Quote
Sunday, November 08, 2009 9:57 PMAndy DavidMVP

0
Sign In to Vote
Did you check the 'read nTSecurityDescriptor" referenced in:
http://ntoskrnl.wordpress.com/2008/08/20/eventid-2080-dsaccess-sacl-right-fix/

Also check:
http://social.technet.microsoft.com/Forums/en/exchangesvrgeneral/thread/4cfab637-4d82-4c03-9362-5fa11777c70d
- Reply
- Quote
Sunday, November 08, 2009 10:17 PMRich Matheisen [MVP]

1
Sign In to Vote
On Sun, 8-Nov-09 21:42:13 GMT, exad wrote:

>Hi Raj,Should I be running the setup command with the /domainprep switch on the exchange server or the DC gc2?Thanks!

It doesn't matter, as long ss you're on a machine that's a member of
the domain you're preparing.

But I don't know if /domainprep will fix your problem. If it doesn't,
this may be the more appropriate reference:
http://support.microsoft.com/kb/328662
---
Rich Matheisen
MCSE+I, Exchange MVP
--- Rich Matheisen MCSE+I, Exchange MVP
- Reply
- Quote
Monday, November 09, 2009 12:36 PM--Vinod--

1
Sign In to Vote
I would go for /domainprep on the second GC so that it will fix Manage Auditing and Security Log.

and then replicate the changes between both GC'S

i would also try restarting the SA so that DSACCESS cache can pick both GC's
Vinod |CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|
- Marked As Answer byJames-LuoMSFT, ModeratorTuesday, November 10, 2009 2:40 AM
- Reply
- Quote
Monday, November 09, 2009 5:09 PMexad

0
Sign In to Vote
Thanks to all of you as now my exchange server sees both GCs.
- Reply
- Quote
Monday, November 09, 2009 7:11 PMAndy DavidMVP

0
Sign In to Vote
Glad you got it working!
- Reply
- Quote