Today I'm seeing several Security-Kerberos event id 4 messages on an SBS 2011 stand-alone server:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server COMPUTER1$. The target name used was RPCSS/COMPUTER2.mydomain.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Please ensure that the target SPN is registered on, and only registered on, the account used by the server. This error can also happen when the target service is using a different password for the target service account than what the Kerberos Key Distribution Center (KDC) has for the target service account. Please ensure that the service on the server and the KDC are both updated to use the current password. If the server name is not fully qualified, and the target domain (MYDOMAIN.LOCAL) is different from the client domain (MYDOMAIN.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
It would appear that the IP address for COMPUTER1$ in the DNS, is actually being used by COMPUTER2... so try to find the IP address for COMPUTER2...
Open Administrator Tools -> DNS
Navigate to DNS->servername->Forward Lookup Zones->mydomain.local
Order by the Data column... which may contain mostly IP addresses
Look down the Data column for duplicated IP addresses. In my case COMPUTER1 and COMPUTER2 had the IP address 192.168.0.15
Run a CMD window (Windows Key+R->type 'cmd'->OK) and type: ping -a 192.168.0.15 (or whatever the duplicate IP address. Also you can run nbtstat -A 192.168.0.15 ... this resolved to COMPUTER2...
In the DNS Forward Lookup Zones for mydomain.local, I deleted anything with an IP address of 192.168.0.15 that was not COMPUTER2 - one of them was COMPUTER1.
That should prevent this error message appearing again.
For each of these computers I was also seeing a DistributedCOM Event Id 10009
DCOM was unable to communicate with the computer COMPUTER1.mydomain.local using any of the configured protocols.
These appear every 30 minutes since the last reboot. But not in the last 90 minutes since I deleted duplicate forward lookup entries... Problem solved? Now to figure out why the server locked us all out earlier today... WSUS overgrowth on C drive is the first contender... the SSDB is 22 GB....
Showing posts with label DNS. Show all posts
Showing posts with label DNS. Show all posts
Friday, 24 July 2015
Saturday, 20 November 2010
Macs - Entourage - Split DNS - SBS2003 - Cisco 1841
Here's a question...
In this client's domain, there are a couple of servers. Both SBS2003. It is set up with an internal mydomain.local address.
The server has an external name - mail.mydomain.com.
The Macs have been set up with WebDAV and Entourage... and point to mail.mydomain.com... so on the SBS2003 DNS Server, mail.mydomain.com has to be defined as the 192.168.0.2 address of the server. If it is not then the request for mail.mydomain.com is forwarded off to external DNS servers, which returns the address of the external interface of the Cisco 1841 router...
Clients on the outside can see mail.mydomain.com ... but they often open a VPN connection to the Cisco 1841 router... the router gives them a DNS of something.. it's own DNS proxy perhaps?
So the client has a network connection somewhere in the world... with DNS local to that ISP... they connect to the VPN and are given an IP address of 192.168.0.x ... and DNS is something...
but they can no longer connect to mail.mydomain.com ...
Is there an easy answer? My only answer so far is to look up CCNA courses nearby... :) The company who should look after this router want £NNN for a solution they can't guarantee will work... And it's not a client we want to mess around with... it has to work or not.
In this client's domain, there are a couple of servers. Both SBS2003. It is set up with an internal mydomain.local address.
The server has an external name - mail.mydomain.com.
The Macs have been set up with WebDAV and Entourage... and point to mail.mydomain.com... so on the SBS2003 DNS Server, mail.mydomain.com has to be defined as the 192.168.0.2 address of the server. If it is not then the request for mail.mydomain.com is forwarded off to external DNS servers, which returns the address of the external interface of the Cisco 1841 router...
Clients on the outside can see mail.mydomain.com ... but they often open a VPN connection to the Cisco 1841 router... the router gives them a DNS of something.. it's own DNS proxy perhaps?
So the client has a network connection somewhere in the world... with DNS local to that ISP... they connect to the VPN and are given an IP address of 192.168.0.x ... and DNS is something...
but they can no longer connect to mail.mydomain.com ...
Is there an easy answer? My only answer so far is to look up CCNA courses nearby... :) The company who should look after this router want £NNN for a solution they can't guarantee will work... And it's not a client we want to mess around with... it has to work or not.
Sunday, 14 November 2010
SBS2008 and the mysterious DNS drops: Resolved
I finally managed to get onto the router... a Draytek Vigor 2900... I looked through all the settings and found nothing timing out.
Looking through the Ethernet log... I could see one PC calling up numerous destinations on the internet, TCP/UDP port 16650 and destination in the 50,000s... 57874.?
I found out the PC name on the network and connected via Explorer to the admin share to look at Program Files and see if there were any nefarious software installed...
BitTorrent... oh dear... Dates of the files appear to match the times of the DNS dropping out.
I was called at the time, their DNS has been down for 2 hours whilst I was investigating. So I blocked all traffic from that PC's IP address to the internet. Immediately I could browse to www.google.com on the server.
My colleague gets a call from one member of staff... everyone's internet has come back except hers... he let her know we'd look into it...
So I blocked all traffic up from 1024 to 65535 from that IP address... at least she'll get mail, DNS, web surfing... but I think she might have a few more problems... downloading large files on company ISP.. killing an online application used by others that is the vital for the company... furthermore the size of the files over only 25 days could have had their ISP block all further traffic... Business Usage Policies n all that...
The router was still showing DNS calls to the internet... the Forwards were working.. but because of all the heavy torrent traffic, all DNS calls were timing out. The DNS Forwarding has a timeout of 3 or 5 seconds.
BitTorrent is known to kill a connection when it's not been limited in the torrent app...
So restarting the DNS Server on the SBS2008 box was simply killing the torrent connection and then it would all start going again .. and perhaps the only reason it's starting getting worse is because the user's PC was set to go directly via the router? SBS2008 was limiting the Torrent connections.. once it was out of the picture the torrent was allowed to keep the connection killed and restarting the DNS Server no longer had a lasting effect.
Staff should be kept aware of the company's internet policy... and some should know better.
The answer is always so simple in retrospect.
Friday, 12 November 2010
SBS2008 and the mysterious DNS drops
I've been asked to look into an install of SBS2008 which is occasionally failing to forward DNS requests from clients. Apparently there are two workarounds. 1) A registry change and 2) set up forwarders to DNS servers... My colleague couldn't remember the details...
Hmm.. Google: 945 results from EggHeadCafe alone for SBS2008 DNS. 118 in the past year. 22 in the past month. None in the last week... so it's a dying topic...?
Is XP losing its binding to the DNS Servers in DNS? Is SBS2008 failing to forward the request? There are some Mac OSX... is Mac OSX losing its binding to DNS?
Restarting DNS solves it... so DHCP is not a problem and the problem can't be on the client-side because restarting DNS on the server wouldn't fix it. All clients are affected.
Event Log... DNS.. the Event ID sequence 3,2,4 (DNS Shutdown/Start/Ready) have occurred frequently over the last few days, and every 2 or 3 days for at least a month back... That has to be a manual action, doesn't it?
Apparently a user is restarting the DNS service... and has been for some time... I've gone through the log and noted into Excel the date and time when the user has restarted the DNS Service... then convert that into a simple dot chart...
The clumping is occurring with 2 day intervals between the events... except the last clump which is occurring more frequently because of a 'fix' put in place specifically to correct this... it's a weird clumping... 2 days later the users experience the same fault but about 30 mins later in the day. It recurs 2 days and 30 minutes after restarting DNS? That would equate roughly to a TTL, somewhere, of 2900 (rather than 2880)...?
These events occur between 09:30 and 20:10 purely because no-one is around to restart the DNS outside of those times.
FRS (File Repl. Svc) reported space issues (almost daily) on C drive between 23rd Oct and 1st Nov... but there are about 30gb free on C drive now... Shadow Copies is using its maximum of 10gb...
(Note if space is an issue then DNS might be prevented from working properly...)
Event Source: NETLOGON ID: 5781
Description:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.mydomain.local.' failed.
Possible causes of failure include:
- TCP/IP properties of network connections contain wrong IP addresses of the preferred and alternate DNS servers
- Specified preferred and alternate DNS servers are not running
- DNS server(s) primary for the records to be registered is not running
- Preferred or alternate DNS servers are configured with wrong root hints
- Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration
There's one of these for each DnsZone... and these appear when the DNS service starts up on the SBS2008 server. But they occur when the service starts so they are related but not a cause. They occur simply because the NETLOGON service doesn't receive a 'Success' signal back from the DNS Server that owns the zones of the records that are being registered. The zones in question are owned by this server? So this server is not responding to itself?
I've just discovered a utility called DNSLint.exe from Microsoft via (I won't repeat it here):
http://www.computerperformance.co.uk/w2k3/services/DNS_dnslint.htm
Hmm.. DNSLint on 2008? I have no DVD to hand... DNS Tools:
http://technet.microsoft.com/en-us/library/dd197560(WS.10).aspx
ok.. back to error 5781 - it appears that this only occurs when the DNS service starts because the server's DNS on its own network connection is pointing towards itself... and since the DNS service hasn't yet begun, it can't register on that server... so I'm going to ignore that ... you can make the NetLogon service depend on the DNS service... http://support.microsoft.com/kb/259277 but it'll try and re-register 5 minutes later anyway.
After some searching around I've found a couple of root-server addresses in Root Hints that are using IP addresses for l.root-server.net. from 2 years ago... maybe the tech at Microsoft who put SBS 2008 together didn't know? Resolve all the Root servers to check...
Also I switched off DNS from listening on IPv6 interfaces for DNS requests... nothing IPv6 on the network... if so I'll find out tomorrow.
I also found a registry entry in HKLM\Systems\CurrentControlSet\Services\DNS\Parameters... called MaxCacheTtl... the MS KB (http://support.microsoft.com/kb/968372) says it's MaxCacheTTL ... does it make a difference? I could get ProcessSpy running to see if DNS Server on SBS2008 is making calls for MaxCacheTTL or Ttl... it's set to 172800 seconds = 2880 minutes... which is the timeout value I questionned earlier... (2900 minutes = 2 days and 20 minutes) ... what about the 20mins? It's 2 days and 20 mins between restarts of DNS... so that's 2 days for the TTL and 20 minutes for the users to realise something is wrong and restart DNS again...
Is this TTL value killing the DNS? Can it? We'll find out tomorrow... or in 2 days time... Then we'll find out if it's a problem with AVG or not.. :) or perhaps it's the router...
Hmm.. Google: 945 results from EggHeadCafe alone for SBS2008 DNS. 118 in the past year. 22 in the past month. None in the last week... so it's a dying topic...?
Is XP losing its binding to the DNS Servers in DNS? Is SBS2008 failing to forward the request? There are some Mac OSX... is Mac OSX losing its binding to DNS?
Restarting DNS solves it... so DHCP is not a problem and the problem can't be on the client-side because restarting DNS on the server wouldn't fix it. All clients are affected.
Event Log... DNS.. the Event ID sequence 3,2,4 (DNS Shutdown/Start/Ready) have occurred frequently over the last few days, and every 2 or 3 days for at least a month back... That has to be a manual action, doesn't it?
Apparently a user is restarting the DNS service... and has been for some time... I've gone through the log and noted into Excel the date and time when the user has restarted the DNS Service... then convert that into a simple dot chart...
The clumping is occurring with 2 day intervals between the events... except the last clump which is occurring more frequently because of a 'fix' put in place specifically to correct this... it's a weird clumping... 2 days later the users experience the same fault but about 30 mins later in the day. It recurs 2 days and 30 minutes after restarting DNS? That would equate roughly to a TTL, somewhere, of 2900 (rather than 2880)...?
These events occur between 09:30 and 20:10 purely because no-one is around to restart the DNS outside of those times.
FRS (File Repl. Svc) reported space issues (almost daily) on C drive between 23rd Oct and 1st Nov... but there are about 30gb free on C drive now... Shadow Copies is using its maximum of 10gb...
(Note if space is an issue then DNS might be prevented from working properly...)
Event Source: NETLOGON ID: 5781
Description:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.mydomain.local.' failed.
Possible causes of failure include:
- TCP/IP properties of network connections contain wrong IP addresses of the preferred and alternate DNS servers
- Specified preferred and alternate DNS servers are not running
- DNS server(s) primary for the records to be registered is not running
- Preferred or alternate DNS servers are configured with wrong root hints
- Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration
There's one of these for each DnsZone... and these appear when the DNS service starts up on the SBS2008 server. But they occur when the service starts so they are related but not a cause. They occur simply because the NETLOGON service doesn't receive a 'Success' signal back from the DNS Server that owns the zones of the records that are being registered. The zones in question are owned by this server? So this server is not responding to itself?
I've just discovered a utility called DNSLint.exe from Microsoft via (I won't repeat it here):
http://www.computerperformance.co.uk/w2k3/services/DNS_dnslint.htm
Hmm.. DNSLint on 2008? I have no DVD to hand... DNS Tools:
http://technet.microsoft.com/en-us/library/dd197560(WS.10).aspx
ok.. back to error 5781 - it appears that this only occurs when the DNS service starts because the server's DNS on its own network connection is pointing towards itself... and since the DNS service hasn't yet begun, it can't register on that server... so I'm going to ignore that ... you can make the NetLogon service depend on the DNS service... http://support.microsoft.com/kb/259277 but it'll try and re-register 5 minutes later anyway.
After some searching around I've found a couple of root-server addresses in Root Hints that are using IP addresses for l.root-server.net. from 2 years ago... maybe the tech at Microsoft who put SBS 2008 together didn't know? Resolve all the Root servers to check...
Also I switched off DNS from listening on IPv6 interfaces for DNS requests... nothing IPv6 on the network... if so I'll find out tomorrow.
I also found a registry entry in HKLM\Systems\CurrentControlSet\Services\DNS\Parameters... called MaxCacheTtl... the MS KB (http://support.microsoft.com/kb/968372) says it's MaxCacheTTL ... does it make a difference? I could get ProcessSpy running to see if DNS Server on SBS2008 is making calls for MaxCacheTTL or Ttl... it's set to 172800 seconds = 2880 minutes... which is the timeout value I questionned earlier... (2900 minutes = 2 days and 20 minutes) ... what about the 20mins? It's 2 days and 20 mins between restarts of DNS... so that's 2 days for the TTL and 20 minutes for the users to realise something is wrong and restart DNS again...
Is this TTL value killing the DNS? Can it? We'll find out tomorrow... or in 2 days time... Then we'll find out if it's a problem with AVG or not.. :) or perhaps it's the router...
Friday, 22 October 2010
Google is so slow...
I appear to be waiting too long for Google to return results .. or for the page to complete...
In the late evenings when searching for general images, all I see is a grid of grey boxes... Sometimes the page doesn't change... I have to hit Enter on the URL 1-4 times before the browser even appears to react... and after a few minutes of working with Google Maps tiles stop loading and the whole thing comes to a halt...
Switch to Bing / Yahoo / Multimap / Streetmap.co.uk and there's no problem...
Why is Google slowing down? It's not just me... I did have Chrome Dev installed.. so i removed it from my system completely and reinstalled... and I still have problems... It happens on my spare laptop... so it's not my computer... I no longer have any plugins because I clean-installed Chrome...
DNS? - On my router, I'm using Google DNS - 8.8.8.8 and 8.8.4.4
Everything we do on the internet requires some DNS lookup... I just ran Ping on a few DNS servers... checking the average of 20 pings... (all 0% loss)
For 8.8.8.8 and 8.8.4.4 Google DNS
Minimum = 31ms, Maximum = 33ms, Average = 31ms
Minimum = 30ms, Maximum = 32ms, Average = 30ms
For 208.67.222.222 OpenDNS
Minimum = 23ms, Maximum = 26ms, Average = 24ms
For 212.159.13.49 and 212.159.13.50: My ISP
Minimum = 24ms, Maximum = 31ms, Average = 24ms
Minimum = 25ms, Maximum = 34ms, Average = 26ms
Google DNS promises speed and other functionality... by comparison .. I don't see it.. and I reckon by other functionality - they mean they can track where I go and what I do... and improve Analytics for websites and which AdWords are targeted at me throughout the day...
Only 4 hours ago I also ran the DNS test.. but deleted the results... the average was 70ms with minimum ~50ms and max ~180ms... This was the same for Open DNS... and I didn't test my ISP in time. I was distracted by trying to work out whether I should move myself off the antique Broadband Package I am on and onto a new one... the up-to-date candidate package looks very similar - there's a very complicated hour versus service rate limiting chart to confuse me even further...
http://portal.plus.net/support/broadband/speed_guide/download_speeds.shtml#extraSpeeds
http://portal.plus.net/support/broadband/products/archive/bbyw/speed.shtml#Option2speeds
Looks like I'm on the better deal by a small margin...
I switched my DNS back to my ISP's name servers.... I don't think Google DNS is beneficial at all in the UK yet... Has it helped?
Things appear faster... but it's early morning .. and one of those things with IT that it's the experience over the full 24 hours that counts... whether there's an impact at the times at which I work throughout the day... and on the work I am doing (VPN, VNC, RDP, HTTP, HTTPS, etc...)
If it makes no difference then I'm going to try switching off Web History and other tracking components... and clearing my Google History out... if we can...
In the late evenings when searching for general images, all I see is a grid of grey boxes... Sometimes the page doesn't change... I have to hit Enter on the URL 1-4 times before the browser even appears to react... and after a few minutes of working with Google Maps tiles stop loading and the whole thing comes to a halt...
Switch to Bing / Yahoo / Multimap / Streetmap.co.uk and there's no problem...
Why is Google slowing down? It's not just me... I did have Chrome Dev installed.. so i removed it from my system completely and reinstalled... and I still have problems... It happens on my spare laptop... so it's not my computer... I no longer have any plugins because I clean-installed Chrome...
DNS? - On my router, I'm using Google DNS - 8.8.8.8 and 8.8.4.4
Everything we do on the internet requires some DNS lookup... I just ran Ping on a few DNS servers... checking the average of 20 pings... (all 0% loss)
For 8.8.8.8 and 8.8.4.4 Google DNS
Minimum = 31ms, Maximum = 33ms, Average = 31ms
Minimum = 30ms, Maximum = 32ms, Average = 30ms
For 208.67.222.222 OpenDNS
Minimum = 23ms, Maximum = 26ms, Average = 24ms
For 212.159.13.49 and 212.159.13.50: My ISP
Minimum = 24ms, Maximum = 31ms, Average = 24ms
Minimum = 25ms, Maximum = 34ms, Average = 26ms
Google DNS promises speed and other functionality... by comparison .. I don't see it.. and I reckon by other functionality - they mean they can track where I go and what I do... and improve Analytics for websites and which AdWords are targeted at me throughout the day...
Only 4 hours ago I also ran the DNS test.. but deleted the results... the average was 70ms with minimum ~50ms and max ~180ms... This was the same for Open DNS... and I didn't test my ISP in time. I was distracted by trying to work out whether I should move myself off the antique Broadband Package I am on and onto a new one... the up-to-date candidate package looks very similar - there's a very complicated hour versus service rate limiting chart to confuse me even further...
http://portal.plus.net/support/broadband/speed_guide/download_speeds.shtml#extraSpeeds
http://portal.plus.net/support/broadband/products/archive/bbyw/speed.shtml#Option2speeds
Looks like I'm on the better deal by a small margin...
I switched my DNS back to my ISP's name servers.... I don't think Google DNS is beneficial at all in the UK yet... Has it helped?
Things appear faster... but it's early morning .. and one of those things with IT that it's the experience over the full 24 hours that counts... whether there's an impact at the times at which I work throughout the day... and on the work I am doing (VPN, VNC, RDP, HTTP, HTTPS, etc...)
If it makes no difference then I'm going to try switching off Web History and other tracking components... and clearing my Google History out... if we can...
Subscribe to:
Posts (Atom)