I am getting these two error in the DNS Event log (errors at end of question). I have confirmed I do have duplicate zones. I am wondering which ones to delete. The DomainDNSZone contains all of our DNS records but it does not have the _msdcs zone…. that is in the ForestDNSZone with the duplicates that are not in use.
3 Questions. I understand the advantages of having DNS in the ForestDNSZone.
so…
-
Why is DNS using the DomainDNSZone and is that acceptable considering _msdcs… is in the ForestDNSZone?
-
If so, should I just delete the DC=1.168.192.in-addr.arpa and DC=supernova.local from the ForestDNSZone? Or should I try to get those to be the ones in use? What are those steps? I understand how to delete. That is simple but if i must move zones some info would be appreaciated there.
-
Just to confirm. from my understanding. I can delete the two duplicates in the ForestDNSZone and leave the _msdcs.supernova.local as thats required there. This will resolve the erros I see.
Just fyi when I look in those folders from the ForestDNSZone they have just 2 and 1 entries respectively. So obviously not in use compared to the others. I am pretty sure I understand the steps to complete this. But if you would like to provide that info, bonus points!
Event Type: Warning
Event Source: DNS
Event Category: None
Event ID: 4515
Date: 1/4/2011
Time: 2:14:18 PM
User: N/A
Computer: STANLEY
Description:
The zone 1.168.192.in-addr.arpa was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible.
If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server.
If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict.
To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00 %..
AND
Event Type: Warning
Event Source: DNS
Event Category: None
Event ID: 4515
Date: 1/4/2011
Time: 2:14:18 PM
User: N/A
Computer: STANLEY
Description:
The zone supernova.local was previously loaded from the directory partition DomainDnsZones.supernova.local but another copy of the zone has been found in directory partition ForestDnsZones.supernova.local. The DNS Server will ignore this new copy of the zone. Please resolve this conflict as soon as possible.
If an administrator has moved this zone from one directory partition to another this may be a harmless transient condition. In this case, no action is necessary. The deletion of the original copy of the zone should soon replicate to this server.
If there are two copies of this zone in two different directory partitions but this is not a transient caused by a zone move operation then one of these copies should be deleted as soon as possible to resolve this conflict.
To change the replication scope of an application directory partition containing DNS zones and for more details on storing DNS zones in the application directory partitions, please see Help and Support.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 89 25 00 00 %..
UPDATE:
Suggestions to improve this question so I can get a response would be appreciated.
UPDATE 2:
Our AD consists of 3 DCs
Server at 192.168.1.100 is our Exchange and a DC(unfortunately) It is also our fileserver. OS:Server 2003 R2
Server Stanley.DOMAIN.LOCAL is our GC and holds the shcemas but I will be moving them to the DNS server soon. OS Server 2003 R2
The DNS Server at 192.168.1.103 is our new 2008 R2 Box. It now hosts DNS and DHCP and well is a GC and going to be the PDC once I transfer schemas over.
I wanted to get this DNS issue resolved first.
In an attempt I removed DNS from all other servers and it is only running on the new 2008 R2 box. I have not seen our 2008 R2 Server (Stanley) DNS log produce the event error since the 11th. Stanley used to be the DNS but it is now turned off. Could this be why I have not seen the error since then?
Here is the net diag. It was run on the exchange server as it is still 2003 R2.
NETDIAG:
....................................
Computer Name: SERVERNAME
DNS Host Name: SERVERNAME.DOMAINNAME.local
System info : Microsoft Windows Server 2003 R2 (Build 3790)
Processor : x86 Family 6 Model 15 Stepping 6, GenuineIntel
List of installed hotfixes :
KB2079403
KB2115168
KB2160329
KB2183461-IE8
KB2229593
KB2286198
KB923561
KB924667-v2
KB925398_WMP64
KB925876
KB925902-v2
KB926122
KB926139-v2
KB927891
KB929123
KB930178
KB932168
KB933854
KB936357
KB938127
KB941569
KB942830
KB942831
KB943055
KB943460
KB943729
KB944338-v2
KB944653
KB945553
KB946026
KB948496
KB950760
KB950762
KB950974
KB951066
KB951748
KB952004
KB952069
KB952954
KB953298
KB954155
KB954550-v5
KB955069
KB955759
KB956572
KB956744
KB956802
KB956803
KB956844
KB958469
KB958644
KB958869
KB959426
KB960225
KB960803
KB960859
KB961063
KB961118
KB961501
KB967715
KB967723
KB968389
KB968816
KB969059
KB969883
KB969947
KB970238
KB970430
KB970483
KB971032
KB971468
KB971513
KB971657
KB971737
KB971961
KB971961-IE8
KB972270
KB973037
KB973354
KB973507
KB973540
KB973687
KB973815
KB973825
KB973869
KB973904
KB973917-v2
KB974112
KB974318
KB974392
KB974571
KB975025
KB975254
KB975467
KB975560
KB975562
KB975713
KB976323
KB976662-IE8
KB977165-v2
KB977290
KB977816
KB977914
KB978037
KB978251
KB978262
KB978338
KB978542
KB978601
KB978695
KB978706
KB979306
KB979309
KB979482
KB979559
KB979683
KB979907
KB980182
KB980182-IE8
KB980195
KB980218
KB980232
KB980302-IE8
KB980436
KB981332-IE8
KB982214
KB982381-IE8
KB982666
Q147222
Netcard queries test . . . . . . . : Passed
Per interface results:
Adapter : Local Area Connection 2
Netcard queries test . . . : Passed
Host Name. . . . . . . . . : SERVERNAME
IP Address . . . . . . . . : 192.168.1.100
Subnet Mask. . . . . . . . : 255.255.255.0
Default Gateway. . . . . . : 192.168.1.1
Dns Servers. . . . . . . . : 192.168.1.103
AutoConfiguration results. . . . . . : Passed
Default gateway test . . . : Passed
NetBT name test. . . . . . : Passed
WINS service test. . . . . : Skipped
There are no WINS servers configured for this interface.
Global results:
Domain membership test . . . . . . : Passed
NetBT transports test. . . . . . . : Passed
List of NetBt transports currently configured:
NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
1 NetBt transport currently configured.
Autonet address test . . . . . . . : Passed
IP loopback ping test. . . . . . . : Passed
Default gateway test . . . . . . . : Passed
NetBT name test. . . . . . . . . . : Passed
Winsock test . . . . . . . . . . . : Passed
DNS test . . . . . . . . . . . . . : Passed
PASS - All the DNS entries for DC are registered on DNS server '192.168.1.103' and other DCs also have some of the names registered.
Redir and Browser test . . . . . . : Passed
List of NetBt transports currently bound to the Redir
NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
The redir is bound to 1 NetBt transport.
List of NetBt transports currently bound to the browser
NetBT_Tcpip_{9052E7E6-EBB2-43F2-857A-8CF43C9718B3}
The browser is bound to 1 NetBt transport.
DC discovery test. . . . . . . . . : Passed
DC list test . . . . . . . . . . . : Passed
Trust relationship test. . . . . . : Passed
Secure channel for domain 'SUPERNOVA' is to '\\stanley.DOMAINNAME.local'.
Kerberos test. . . . . . . . . . . : Passed
LDAP test. . . . . . . . . . . . . : Passed
Bindings test. . . . . . . . . . . : Passed
WAN configuration test . . . . . . : Skipped
No active remote access connections.
Modem diagnostics test . . . . . . : Passed
IP Security test . . . . . . . . . : Skipped
Note: run "netsh ipsec dynamic show /?" for more detailed information
The command completed successfullylution.
I also just ran a DC Diag on Weir. THis is the 2008 R2 box
It failed this test. Though Just looked into this a little more and realise its if I did not do adprep /rodcprep. Considering I am not planning on a RODC MS says this can be ignored.
Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=DOMAINAME,DC=local
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=DOMAINAME,DC=local
......................... WEIR failed test NCSecDesc
Best Answer
Sometimes this happens when changing the replication scope in the 2003 DNS snapin. What I would to to resolve this is:
Restart the DNS Server service on the one server.
Check the DNS log - all occurrences of EventID 4515 should be gone. If not make sure AD Integration is off and restart the service again until it starts without any 4515 warnings.
Enable AD integration. Remember to set the replication scope and turn on secure updates.**
Force AD replication to all DCs running DNS.
** NOTE If there are other zones on other DNS servers that are not replicated to the server you chose in step 1, stop the DNS Server service on the machine you've been working on, and repeat steps 1 through 5 for zones on a DNS server that hosts the remaining, conflicting zones.