Our environment consists of Windows XP & few windows 7 client and 2003 servers. We have added a 2008 R2 DC in our 2003 environment (two 2003 DCs) and plan to add another soon.We plan to move all the roles to the 2008 R2 DCs and phase out the 2003 DCs. Currently we have started getting few warning in DNS & AD event logs on both 2008 R2 and 2003 domain. We want these issues resolved before introducing the other 2008 R2 domain in our environment and transferring the roles to 2008 R2 DC. Please review the events below:
Log Name: DNS Server-2008 R2
Source: Microsoft-Windows-DNS-Server-Service
Date: 12/12/2012 1:00:54 AM
Event ID: 4013
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: DMGDC1.dawn.com
Description:
The DNS server is waiting for Active Directory Domain Services (AD DS) to signal that the initial synchronization of the directory has been completed. The DNS server service cannot start until the initial synchronization is complete because critical DNS data
might not yet be replicated onto this domain controller. If events in the AD DS event log indicate that there is a problem with DNS name resolution, consider adding the IP address of another DNS server for this domain to the DNS server list in the Internet
Protocol properties of this computer. This event will be logged every two minutes until AD DS has signaled that the initial synchronization has successfully completed.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-DNS-Server-Service" Guid="{71A551F5-C893-4849-886B-B5EC8502641E}" EventSourceName="DNS" />
<EventID Qualifiers="32768">4013</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-12-11T20:00:54.000000000Z" />
<EventRecordID>33</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>DNS Server</Channel>
<Computer>DMGDC1.dawn.com</Computer>
<Security />
</System>
<EventData Name="DNS_EVENT_DS_OPEN_WAIT">
</EventData>
</Event>
DNS Server-2003
Event Type:Warning
Event Source:DNS
Event Category:None
Event ID:9999
Date:12/11/2012
Time:10:08:49 PM
User:N/A
Computer:DAWNHO
Description:
The DNS server has encountered numerous run-time events. To determine the initial cause of these run-time events, examine the DNS server event log entries that preceded these run-time events. The data is the number of events that have been suppressed in the
last 60 minute interval.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 16 00 00 00 ....
DNS Server-2003
Event Type:Warning
Event Source:DNS
Event Category:None
Event ID:4521
Date:12/12/2012
Time:10:44:49 AM
User:N/A
Computer:DAWNHO
Description:
The DNS server encountered error 9002 attempting to load zone . from Active Directory. The DNS server will attempt to load this zone again on the next timeout cycle. This can be caused by high Active Directory load and may be a transient condition.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
and in AD of 2008 R2 and 2003 (below)
Log Name: Directory Service-2008 R2
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/11/2012 6:22:06 PM
Event ID: 2886
Task Category: LDAP Interface
Level: Warning
Keywords: Classic
User: ANONYMOUS LOGON
Computer: DMGDC1.dawn.com
Description:
The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed
on a cleartext (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.
Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection, and will stop working if this configuration change is made. To assist in identifying these clients, if such binds occur this directory
server will log a summary event once every 24 hours indicating how many such binds occurred. You are encouraged to configure those clients to not use such binds. Once no such events are observed for an extended period, it is recommended
that you configure the server to reject such binds.
For more details and information on how to make this configuration change to the server, please see http://go.microsoft.com/fwlink/?LinkID=87923.
You can enable additional logging to log an event each time a client makes such a bind, including information on which client made the bind. To do so, please raise the setting for the "LDAP Interface Events" event logging category to level 2 or higher.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
<EventID Qualifiers="32768">2886</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>16</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2012-12-11T13:22:06.241712000Z" />
<EventRecordID>489</EventRecordID>
<Correlation />
<Execution ProcessID="532" ThreadID="704" />
<Channel>Directory Service</Channel>
<Computer>DMGDC1.dawn.com</Computer>
<Security UserID="S-1-5-7" />
</System>
<EventData>
</EventData>
</Event>
Directory Service-2003
Event Category:Knowledge Consistency Checker
Event ID:1925
Date:12/10/2012
Time:5:29:18 PM
User:NT AUTHORITY\ANONYMOUS LOGON
Computer:DAWNHO
Description:
The attempt to establish a replication link for the following writable directory partition failed.
Directory partition:
DC=dawn,DC=com
Source domain controller:
CN=NTDS Settings,CN=DMGDC1,CN=Servers,CN=DAWN-Karachi,CN=Sites,CN=Configuration,DC=dawn,DC=com
Source domain controller address:
97b88721-9ba3-496b-ae6a-b37e4928226d._msdcs.dawn.com
Intersite transport (if any):
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.
User Action
Verify if the source domain controller is accessible or network connectivity is available.
Additional Data
Error value:
8524 The DSA operation is unable to proceed because of a DNS lookup failure.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
==========================================================================
how do we correct these issues before moving forward with our plan
Regards
Imran