0

In our office we have two servers and dozen workstations.

Our main server has AD and it is DC (Windows Server 2012 R2 Essentials). All of our workstations are connected to domain. Then we have secondary server (Windows Server 2012 R2 Foundation) which we use to test products in development and he was also connected to domain.

Few days ago when I was absent from work there was power issue and electricity was turned off for the few city blocks. Since we are very small office with no need for UPS, our servers were turned off. Now the secondary server is DELL server and has ability to turn itself on when electricity is available again and our main server (DC) needs to be manually turned on. Since that event I was not able to use RDC to connect on server (I still cant) even with local admin account. Today I spent entire day dealing with that problem but I focused on domain accounts since we use domain for easier user permission management. On main server I got this error "Kerberos target resolution error" on server list for secondary server. In event details there was a message to check if computer / server with specified name (Name of secondary server) is connected to network or available on network. After that I went to check network and there was mentioned server but when I tried to connect to it, another error message displayed "The trust relationship between this workstation and the primary domain failed". After that message I went to rejoin server back to domain since somewhere I have read that this occurs when DC is not available on system startup. Since secondary server starts automatically and main server with DC starts manually I concluded that that was the problem. I tried to restart secondary server but that didn't help. The same issues remained unsolved. Afterwards I disconnected server from domain (I joined him on TEMP workgroup), restarted server and then I tried to join him back to to domain. And now I'm stuck!

I enter right domain name and then dialog opens to enter username and password with permission to join the domain. I enter credentials for domain admin and error massage displays that username or password is incorrect.

Now I checked and user exists with that password. Also that user is member of domain admins. I use built in Administrator account from main server (Where DC is) that is built in Administrator account for domain. On other workstations I can normally rejoin domain without problems with that user and password.

What can I do to fix this problem?

Any help is appreciated since I'm stuck with this issue.

  • I assume you have tried to shutdown the secondary server, and started the primary server, and got it working before starting the secondary server again? You have done yourself a huge disservice by removing the secondary server from the domain. You have created the type of problem which likely will result in you recreating the domain on both servers. – Ramhound Nov 27 '17 at 15:37
  • Primary server was started when secondary server was running. Afterwards secondary server was restarted. Secondary server is not in domain right now. It's joined to TEMP workgroup. – Tony Hudo Nov 28 '17 at 9:01
2

You're running incompatible server editions

In other words, it's pointless to solve the problem you're having because there are technical and legal barriers that prevent this specific configuration from being used on an ongoing basis.

Windows Server 2012 R2 Essentials and Windows Server 2012 R2 Foundation edition cannot be joined to the same domain. Both of these editions of Windows Server must be installed at the root of their respective Active Directory domains and hold all of the FSMO roles. While it is possible to have them in the same domain for a short period (e.g. to migrate from one edition to the other), as explained below this will result in operational consequences if such a configuration continues to be used.

Limitations of Foundation and Essential editions

This TechNet article explains the relevant limitations for Server 2012/R2 Foundation:

Although most core features are the same, there are important limits in Windows Server 2012 Foundation versus other editions of Windows Server 2012 that you should be aware of before you deploy Windows Server 2012 Foundation....The following table provides a summary of key limits.

Domain requirements
Must be the root domain controller in a domain that has no trusts at the root of the forest. This condition is temporarily allowed for migrations, but if persistent, the system will be forced to restart.

This TechNet blog discusses limitations one must consider when deploying Windows Server 2012 R2 Essentials:

The Windows Server 2012 R2 Essentials once deployed, must be the domain controller at the root of the forest and domain, and must hold all the FSMO roles.

It appears these systems were somehow working before your unexpected power loss (see below for more about that), but the long and short of it is that trying to work back toward this configuration is a violation of the servers' Microsoft EULA and expected to result in loss of service once configured.

My advice: Hire a qualified Microsoft server professional to straighten out your configuration by obtaining the proper Windows Server editions and installing them correctly to meet the needs of your environment.


About that UPS you didn't have...

Since we are very small office with no need for UPS...

The need for power protection (line conditioning, surge suppression, battery-power, etc.) should factor in the cost of repairing possible problems caused by the incoming utility power, not the size of the environment. One should also consider what irreparable damage might be caused, such as loss of recently created data which has not yet been backed up offsite, or loss of employee productivity due to a down system. IMHO, no production server should ever be plugged directly into utility power.

  • Thanks for feedback. "as explained below this will result in operational consequences if such a configuration continues to be used" -> "but if persistent, the system will be forced to restart" This is not a production server. It is mainly used for testing products in development. We needed a machine on which 2 people can test products on the same time. There was warning message that server will restart in 10 days, and we are Ok with that as long it stays in the domain, like it was before. Also all of our machines are connected on surge protected extension cords. Meanwhile we bought UPS – Tony Hudo Nov 28 '17 at 7:42
  • @TonyHudo The Microsoft EULA doesn't make exceptions for non-production use. – Twisty Impersonator Nov 28 '17 at 13:29
  • Depending on who your customers are, you may be eligible for a Microsoft MSDN or Action Pack subscription, which includes server OS licenses for much less than retail pricing. Ask your Microsoft reseller for more information. – Twisty Impersonator Nov 28 '17 at 17:21
0

I've had issues connecting machines to domains before and it's nearly always stemmed from me having forgotten to configure the DNS settings to connect to the domain controller correctly.

Ensure that your secondary server has the right DNS configuration for your domain, an obvious one I know, but so obvious it's often overlooked.

  • Thanks for feedback. Yes DNS settings are identical on all machines. So that's not a problem. – Tony Hudo Nov 27 '17 at 16:25

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.