Directory Services forum

and i also checked domain replication with no error , according to below

http://social.technet.microsoft.com/wiki/contents/articles/11809.troubleshooting-ad-replication-error-1908-could-not-find-the-domain-controller-for-this-domain.aspx

i have a root forest named: farroot.com

and created a tree in the forest named: fartree.com

all domain controllers are DNS servers for its own domain.

and then i wanna create a new domain under fartree.com

but always fail.

i don't know what should i enter during the process. i tried all the combination , but all failed

i also tried the above-mentioned post and set the to-be-promoted server 's DNS to root DNS only to no use.

( i also ever tried the DNS of fartree.com )

0. at the initial pages, i used alternate credential of farroot\administrator

1. first step: type the name of any domain in the forest where you plan to install this domain controller

I entered fartree.com

2. second step: FQDN of the parent domain:/Single-label DNS name of the child domain：

I entered fartree.com / Branch

during the wizard is configuring process, it failed with several kinds of error message.

the likely one is "could not find the domain controller for this domain"

however ,i tried the network connection to all servers were OK.

I;m Charles Lee.

Let me give background on my environment

Small Business Server 2003 Standard & Windows 2008 Standard Terminal Server (no workstations) When users attempt to logon to the terminal server they get "Access Denied" right before they get to a desktop. If a user is part of the domain admin's they can login with no issues (this is how I discovered this issue, I was cleaning out the domain admin's group) I also get issues when trying to run anRSOP.msc from this machine & gpupdate /force as well. I tried adding a Windows 2008R2 machine to the domain and ran into the same issues when running the above commands.

This environment seems to be an upgrade from Server 2000 from what I can tell. I recently raised the domain/forest function levels to 2003.

I turned on Kerberos logging & enabled debugging. In my research it is possible this is a SPN issue, but I cannot view the SPN's attached to my LocalSystem account (Terminal Serv Licensing runs under this context) as this error is returned each time I check: FindDomainForAccount: DsGetDcNameWithAccountW failed!

I tried the following commands all with the result above:

setspn –L “Local System”
setspn –L “LocalSystem”
setspn –L LocalSystem

Now to my error logs, here are a couple entries from the SBS box event log:

Client Time:

Server Time: 18:15:0.0000 8/29/2013 Z

Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN

Extended Error:

Client Realm:

Client Name:

Server Realm: GU.LOCAL

Server Name: TermServLicensing

Target Name: TermServLicensing@GU.LOCAL

Error Text:

File: 9

Line: b22

Error Data is in record data.

A Kerberos Error Message was received:

on logon session

Client Time:

Server Time: 18:15:0.0000 8/29/2013 Z

Error Code: 0xd KDC_ERR_BADOPTION

Extended Error: 0xc00000bb KLIN(0)

Client Realm:

Client Name:

Server Realm: GU.LOCAL

Server Name: host/gu-sbs1.gu.local

Target Name: host/gu-sbs1.gu.local@GU.LOCAL

Error Text:

File: 9

Line: b22

Error Data is in record data.

Here is some of the Kerberos debug log file:

416.408> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x252ac6f, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536aa9, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536c71, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536d36, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536d57, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536d96, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536db7, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536dee, accepting 0:0x3e7

416.516> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2536e24, accepting 0:0x3e7

416.7296> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x2539dca, accepting 0:0x3e7

416.1148> Kerb-LSess: KerbCreateLogonSessionFromTicket NOT creating ASC logon session for 0:0x253ae5b, accepting 0:0x3e7

416.6988> Kerb-Error: Failed to create token: 0xc000006e. d:\nt\ds\security\protocols\kerberos\client2\krbtoken.cxx, line 2461