HELP ME PLEASE!!



I have a huge problem. I have a SBS 2003 PDC which held all the FSMO
roles, obviously, but was also a SQL Server. I added a second Server,
which is Server 2003 R2, with SQL server also installed, which was
promoted to a DC (but the NetLogon and SYSVOL never worked correctly and
only the PDC can authenticate users--but thats because of SBS if i'm not
mistaken??)

So anyway, I know you arent supposed to run SQL on your DC's, but in our
case it was just the best solution.

Here is the problem now. I need to replace the SBS server. Its coming
off-line completely. I have added a new DC to the domain, which is
server 2008 standard. Here is where I am at.

-I promoted the 2008 server to a domain controller successfully (well
except for the FRS issues)
-I installed SQL server on the new domain controller..and our front end
software which cost a lot of $$ to have done, so I cant go back and
start over)
-I tranferred all of the FSMO roles to the 2008 DC and followed all the
steps to make it my PDC.
-HOWEVER, because I cannot successfully replicate the NETLOGON and
SYSVOL shares, users cannot authenticate through the new PDC. event 1308
in FRS log, btw.
-I want to just get rid of the SBS server all together, but I cant
because when I try to demote it, it tells me it cannot establish an LDAP
connection to the new server....however, AD appears to have replicated,
I can make changes that replicate across all the DC's...but I cant get
the NETLOGON and SYSVOL shares to work right.

Is what I am trying to do even possible? Can you just drop a SBS server
off a domain and expect this to work? I looked into the SBS transition
pack...but I would rather not spend the money, especially since this
server is just coming off line completely.

THe biggest problem now, is that since I transferred the FSMO roles, the
only server that DOES authenticate users, keeps shutting down with a
violation of EULA event....because its no longer the PDC.

Please let me know what I have to do!! Can I simply upgrade the SBS
server software to Server 2003 R2? Will that fix these issues?

Thanks in advance for your help!


--
pcraig11
------------------------------------------------------------------------
pcraig11's Profile: http://forums.techarena.in/members/224993.htm
View this thread: http://forums.techarena.in/small-bus...er/1340886.htm

http://forums.techarena.in

First, on a technical level, there is no such thing as a "PDC" in an Active
Directory domain. That was an NT4 concept long since dead.

Secondly, you are mistaken that other servers could not authenticate because
of SBS. It *is* a requirement that SBS holds all FSMO roles, but those
roles are not related to authentication. They are only used internally by
AD to define certain delegated privileges (ridiculously oversimplified, but
not important for the purpose of this conversation.) The role that allows
authentication is called a "global catalog" server and there can be multiple
global catalog servers in a domain, so adding a second GC does *not* break
SBS licensing.

Finally, yes, you *can* add other DCs to an SBS domain, transfer roles, and
decommission the SBS server. You aren't yet there.

Here is what I'd do. Transfer the FSMO roles back to SBS. This should
hopefully get you back to a consistent state and SBS will stop shutting
down.

Then use the tools that windows makes available to address your AD issues.
netdiag, dcdiag, and the IT Health Scanner come to mind, as well as the SBS
BPA.

Once you've resolved all of those, your second DC issues will also be
resolved in the process. Then transferring the FSMO roles will be trivial
and the SBS server can be demoted with no issues.

-Cliff


"pcraig11" <pcraig11.4bl6xa@newsgroup> wrote in message
newscraig11.4bl6xa@newsgroup

>
> HELP ME PLEASE!!
>
> I have a huge problem. I have a SBS 2003 PDC which held all the FSMO
> roles, obviously, but was also a SQL Server. I added a second Server,
> which is Server 2003 R2, with SQL server also installed, which was
> promoted to a DC (but the NetLogon and SYSVOL never worked correctly and
> only the PDC can authenticate users--but thats because of SBS if i'm not
> mistaken??)
>
> So anyway, I know you arent supposed to run SQL on your DC's, but in our
> case it was just the best solution.
>
> Here is the problem now. I need to replace the SBS server. Its coming
> off-line completely. I have added a new DC to the domain, which is
> server 2008 standard. Here is where I am at.
>
> -I promoted the 2008 server to a domain controller successfully (well
> except for the FRS issues)
> -I installed SQL server on the new domain controller..and our front end
> software which cost a lot of $$ to have done, so I cant go back and
> start over)
> -I tranferred all of the FSMO roles to the 2008 DC and followed all the
> steps to make it my PDC.
> -HOWEVER, because I cannot successfully replicate the NETLOGON and
> SYSVOL shares, users cannot authenticate through the new PDC. event 1308
> in FRS log, btw.
> -I want to just get rid of the SBS server all together, but I cant
> because when I try to demote it, it tells me it cannot establish an LDAP
> connection to the new server....however, AD appears to have replicated,
> I can make changes that replicate across all the DC's...but I cant get
> the NETLOGON and SYSVOL shares to work right.
>
> Is what I am trying to do even possible? Can you just drop a SBS server
> off a domain and expect this to work? I looked into the SBS transition
> pack...but I would rather not spend the money, especially since this
> server is just coming off line completely.
>
> THe biggest problem now, is that since I transferred the FSMO roles, the
> only server that DOES authenticate users, keeps shutting down with a
> violation of EULA event....because its no longer the PDC.
>
> Please let me know what I have to do!! Can I simply upgrade the SBS
> server software to Server 2003 R2? Will that fix these issues?
>
> Thanks in advance for your help!
>
>
> --
> pcraig11
> ------------------------------------------------------------------------
> pcraig11's Profile: http://forums.techarena.in/members/224993.htm
> View this thread:
> http://forums.techarena.in/small-bus...er/1340886.htm
>
> http://forums.techarena.in
>

Thanks for the quick responses. I have disabled the Firewall on the new
server, and I will monitor the replication process. When I was
troubleshooting this issue before, I ran dcdiag and was getting a
Netlogon error, cant connect to the netlogon share...however, that was
before I disabled the firewall...so i will check again, and post
results. Also, I think I will heed your advice and bring the FSMO roles
back over to the SBS server for now. However, when it was set up that
way before, and I ran dcdiag and netdiag on the SBS server, I couldnt
find anything that would indicate an AD problem. Once I do tfr the roles
back, I will post the results of that DC diag also. Thanks again for the
help...I will post again today.

Thanks


--
pcraig11
------------------------------------------------------------------------
pcraig11's Profile: http://forums.techarena.in/members/224993.htm
View this thread: http://forums.techarena.in/small-bus...er/1340886.htm

http://forums.techarena.in