RPC Enforcement issues on DNS, Active Directory and Certification Authority.

-

we facing problem of dns service not getting started on domain controllers. below error see on domain controller when try start dns service.

dns server error in event viewer:

the dns server waiting active directory domain services (ad ds) signal initial synchronization of directory has been completed. dns server service cannot start until initial synchronization complete because critical dns data might not yet replicated onto domain controller. if events in ad ds event log indicate there problem dns name resolution, consider adding ip address of dns server domain dns server list in internet protocol properties of computer. event logged every 2 minutes until ad ds has signaled initial synchronization has completed.

directory service error in event viewer:

active directory domain services not use following rpc protocol sequence.
 
rpc protocol sequence:
ncacn_ip_tcp
 
although rpc protocol sequence appears installed, active directory domain services cannot use protocol sequence communication.
 
additional data
error value:
87 parameter incorrect.

 

we started observing problem after adding rpc enforcement registry entries on our certification authorities , domain controllers.
after change made registry, replication between dns servers down, active directory services not getting started , ca machines not able see templates.

below parameters have added in registry.

1. ports: 5000-5255
2. portsinternetavailable: y
3. useinternetports: y

after seeing problem, have deleted these registry entries , rebooted dc , working fine. wanted find out there relation between rpc settings , problem of dns service not getting started.

also not sure why rpc enforcement required. did per 1 of documents available me :)

can 1 throw light on role of these rpc registry entries ?


thanks
vittal

m.s.vittal techmahindra ltd

i have never configured such registry neither required because refrain myself in configure such keys on dc, becasue difficult restrict on specific ports. required in older os versions os coming more secure encryption aes , enhanced kerberos protocol v5. have seen large environments , never find recommendation create such keys till now.

http://forums.techarena.in/active-directory/1143476.htm

i haven't seen recommendation in of new os till now, better rid of these entries. below article might give overview.

http://blogs.technet.com/b/networking/archive/2008/10/24/rpc-to-go-v-1.aspx

http://www.ehow.com/list_6734312_microsoft-rpc-protocols.html

http://support.microsoft.com/kb/325930

 

regards

awinish vishwakarma

my blog:  http://awinish.wordpress.com/

this posting provided as-is no warranties/guarantees , confers no rights.


Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

server manager error: ADAM.events.xml could not be enumerated.

-
firewall off isnt it. rerun ldap wizard:?  why?  will screw exchange server running on machine?  ldap wizard asks questions don't understand. please dont send generic links to: http://social.technet.microsoft.com/wiki/contents/articles/13444.windows-server-2012-server-manager-troubleshooting-guide-part-ii-troubleshoot-manageability-status-errors-in-server-manager.aspx thanks, john hi john, >> ok. server manager app. these questions refer this. nothing else 2.  do need create app dir or not?  this server manager, shouldnt done? (why did break in first place?) how check if app dir exists server manager or not. 3.  if "lightweight" implementation of anything, sure hate see "heavyweight" version. the waring events can't enumerated. , cause not completing configuration of ad lds. ad lds not related server manager. used provide flexible support directory-enabled applications. if not implementing such applications, remove role. her
Read more

Cannot access Anywhere Access using domain name?

-
after installing anywhere access in windows server 2012 essentials r2, cannot use anywhere access using setup domain name in wizard such remote.mydomain.com? if enter public ip address, example, 72.2.34.5 works. before set anywhere access, created a record pointing public address...pinged , worked...so not sure doing wrong?  is wizard supposed create record etc , make remote.mydomain.com work? if enter public ip address while on lan, takes me router webpage.  shouldn't work on lan if accessed via public ip? thank you, tim. the wizard can configure remote.microsoft_names.com  remote.remotewebaccess.com but cannot configure domains purchased outside wizard.  depends on how domain configured if wildcard.yourdomain.com should work  if try ping remote.your_domain.com afar , not give proper  public ip, need add record mariette said. much have record domain.com www.domain.com , if have website somewhere else www.domain.com , need remote.domain.com go box gr
Read more

WMI Failure: Unable to update Local Resource Group

-
Image
hi i have windows server 2008 r2 enterprise terminal services installed. this has been working fine, unable add new computers local computer groups policy on rd gateway manager i following error wmi failure: unable update local resource group  just confirm on , resource authorization policies then manage local computer groups hi hussain, posting in windows server forum. firstly please let know, did find particular event log issue? please ensure have configured rap settings correctly , set correct value , permissions rap.xml file , rapstore registry key. please check below thread more details. 1. wmi failure- unable create resource access policy (answered clarence) 2. event id 543 — rd gateway server configuration 3. event id 642 — rd gateway server availability hope helps! thanks, dharmesh Windows Server
Read more