Установили новый контроллер домена на Windows 2012 R2, (режим работы домена 2008R2), при перезагрузке сервера появляется ошибка:
DNS-сервер обнаружил критическую ошибку Active Directory. Проверьте работоспособность Active Directory. Дополнительная отладочная информация об ошибке: «» (может отсутствовать). Данные о событии содержат сведения об ошибке.
Также почему-то данная ошибка журнале отображается так:
Тип события: Ошибка
Источник события: Microsoft-Windows-DNS-Server-Service
Категория события: Отсутствует
Код события: 4015
Дата: 16.01.2015
Время: 15:03:52
Пользователь: NT AUTHORITYСИСТЕМА
Компьютер: LPTDC4.lptrans.ru
Описание:
Не найдено описание для события с кодом ( 4015 ) в источнике ( Microsoft-Windows-DNS-Server-Service ). Либо вызывающий данное событие компонент не установлен на этот локальный компьютер, либо установка повреждена. Установите или восстановите
компонент на локальном компьютере либо обратитесь к производителю компонента за новой версией.
Если событие было сохранено с другого компьютера или переадресовано с удаленного компьютера, может потребоваться включить отображение сведений в события при их сохранении либо при установке подписки с переа .
Данные:
0000: 51 00 00 00 Q…
Может кто сталкивался с подобной проблемой, подскажет в чем дело?
PS: Также в логах присутвует такие предупреждения:
Глобальный список блокировки запросов является средством защиты от атак на сеть с помощью блокировки DNS-запросов от некоторых узлов с определенными именами. Это средство явилось причиной отказа DNS-сервера выполнить запрос
с кодом ОШИБКА ИМЕНИ для wpad.rusagrotrans.ru., ходя данные для этого DNS-имени существуют в базе данных DNS. Другие запросы во всех локальных управляющих зонах для других имен, начинающихся с меток, входящих в список блокировки, также
выполняться не будут, но при блокировке запросов события в журнал записываться не будут до перезапуска службы DNS-сервера на этом компьютере. Сведения об этом средстве и инструкции по его настройке см. в документации продукта.
Ниже приводится текущий глобальный список блокировки запросов(слишком длинный список для данного события может быть усечен):
wpad
isatap
Спасибо!
Event 4015 when running DNS on RODC can be resolved with this handy guide from our experts.
At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Services.
Let’s take a look at how our Support Team is ready to help customers with Event 4015 when running DNS on RODC.
How to fix Event 4015 when running DNS on RODC
Event 4015 often occurs when we run the Domain Name Service role on an RODC (Read-Only Domain Controller) in addition to a writable Domain Controller (hosting DNS) being inaccessible.
According to our Support Team, we can see the event logged on the RODC as seen below:
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: date time
Event ID: 4015
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computer_name
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is “00002095: SvcErr: DSID-03210A6A, problem 5012 (DIR_ERROR), data 16”. The event data contains the error.
After careful analysis, our Support Techs have come to the conclusion that when an RODC locates a writeable DNS server in order to perform ReplicateSingleObject (RSO), the DSGETDC function occurs with that the following flags:
DS_AVOID_SELF
DS_TRY_NEXTCLOSEST_SITE
DS_DIRECTORY_SERVICE_6_REQUIRED
DS_WRITEABLE_REQUIRED
Furthermore, after DC returns from the DSGETDC call, it utilizes the results to look for the NS record in DNS. In case DSGETDC call fails or is not able to locate the NS record of the DC from the DSGETDC, thereby logging error 4105. Additionally, here are two reasons, that may be the cause behind the 4105 error:
- No accessible writeable DC or none returned after DSGETDC call.
- A successful DSGETDC call, but the returned DC does not have the DNS Server Role installed or does not have an NS record in DNS.
Moreover, we can run the following command from RODC in order to check which DC comes back as a result of the DSGETDC call:
nltest /dsgetdc: DOMAIN.COM /WRITABLE /AVOIDSELF /TRY_NEXT_CLOSEST_SITE/DS_6
Here DOMAIN.COM is our domain name.
Fortunately, we can resolve this issue by ensuring there is a writeable DC accessible from the RODC, ensuring that the DNS Server role is installed on the DC in addition to the NS record in DNS for the writeable DC.
[Looking for a solution to another query? We are just a click away.]
Conclusion
In brief, our skilled Support Engineers at Bobcares demonstrated how to deal with Event 4015 when running DNS on RODC.
PREVENT YOUR SERVER FROM CRASHING!
Never again lose customers to poor server speed! Let us help you.
Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.
GET STARTED
Event ID 4015 — DNS Server Active Directory Integration
Originally published: November 13, 2007 at: http://technet.microsoft.com/en-us/library/cc735674(WS.10).aspx
Table of Contents
- Applies To
- Event Details
- Resolve
- Troubleshoot AD DS and restart the DNS Server service
- Verify
- Related Management Information
Applies To
Windows Server 2008
(This wiki page is part of a pilot program to remove topics such as this one from the TechNet and MSDN libraries and move them to the wiki.)
You can configure the DNS Server service to use Active Directory Domain Services (AD DS) to store zone data. This makes it possible for the DNS server to rely on directory replication, which enhances security, reliability, and ease of administration.
Event Details
Product: | Windows Operating System |
Event ID: | 4015 |
Source: | Microsoft-Windows-DNS-Server-Service |
Version: | 6.0 |
Symbolic Name: | DNS_EVENT_DS_INTERFACE_ERROR |
Message: | The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "%1". The event data contains the error. |
Resolve
Troubleshoot AD DS and restart the DNS Server service
The DNS Server service relies on Active Directory Domain Services (AD DS) to store and retrieve information for AD DS-integrated zones. This error indicates that AD DS is not responding to requests from the DNS Server service. Ensure that AD DS is functioning properly, troubleshoot any problems, and then restart the DNS Server service.
For information about troubleshooting AD DS, see Active Directory Troubleshooting Topics (http://go.microsoft.com/fwlink/?LinkId=95789).
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To restart the DNS Server service:
- On the DNS server, start Server Manager. To start Server Manager, click Start, click Administrative Tools, and then click Server Manager.
- In the console tree, expand Roles, expand DNS Server, and then expand DNS.
- Right-click the DNS server, click All Tasks, and then click Restart.
If the problem continues, restart the computer and then use Server Manager to confirm that the DNS Server service has started.
To restart the computer:
- Click Start, click the arrow next to the Lock button, and then click Restart.
To confirm that the DNS Server service has started:
- On the DNS server, start Server Manager.
- In the console tree, expand Roles, and then click DNS Server.
The System Services list shows the state of the DNS Server service.
Verify
Ensure that Event IDs 4523 and 4524 are being logged and that no events in the range 4000 to 4019 appear in the Domain Name System (DNS) event log.
Related Management Information
DNS Server Active Directory Integration (TechNet Library)
DNS Infrastructure (TechNet Library)
Hi
We have a 2008 functional level active drirectory running on two domain controllers — 2008 Standard and 2012 R2 Standard. DNS is active directory integrated and is installed on both DC’s. DHCP was installed on the 2008 DC, but was migrated over to the 2012
DC a few weeks ago as per the instructions here: http://www.brycematheson.io/how-to-migrate-dhcp-from-windows-server-2008-to-2012-2016/
We have a mix of static IP’s and dynamic IP’s. DHCP lease length is set to 8 hours.
After the migration I disabled the DHCP service on the 2008 server. A few hiccups occurred with mismatched DNS A and PTR records during thre next few days. After I cleaned those up I removed the DHCP role from the 2008 server.
About a week ago I noticed that while domain joined computers’ DNS records were fine, guest devices running Android and Apple OS, all of which were being assigned dynamic addresses had two PTR records — one current and one stale.
I deleted the stale records and did some research. I changed the DHCP IPv4 Advanced Properties so that conflict detection attempts was changed from 0 to 1, and created a dedicated AD account named DHCProtocol to use for DNS dynamic update registration credentials
and set its password to never expire.
I was looking at the DNS logs yesterday and noticed many 4015 events. Note that these events only occurr on the 2012 server which hosts the DHCP role:
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: 12/04/2018 13:14:04
Event ID: 4015
Task Category: None
Level: Error
Keywords: (131072)
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is «0000051B: AtrErr: DSID-030F22B2, #1:
0: 0000051B: DSID-030F22B2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor)». The event data contains the error.
There are other accounts listed with 4051, but these are machine-name$ accounts. The majority of the entries reference the user as DHCProtocol.
More research led to this article: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03366032. I restarted all our servers to install the lastest round of Windows Updates and hoped the restart might resolve the issue but the 4015 events continued
to be logged.
I set the diagnostic logging for Directory Access to 5 as per the hpe.com article. The next 4015 error (shown above) coincided with the following from the Directory Access log:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1175
Task Category: Directory Access
Level: Information
Keywords: Classic
User: SYSTEM
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local failed because a non-security related error occurred.
Immediately followed by:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1174
Task Category: Directory Access
Level: Information
Keywords: Classic
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) was successfully performed on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local.
Having got this far, I am not sure how to proceed. Can anyone help me with this, or to understand what is happening please?
Thanks.
Hi
We have a 2008 functional level active drirectory running on two domain controllers — 2008 Standard and 2012 R2 Standard. DNS is active directory integrated and is installed on both DC’s. DHCP was installed on the 2008 DC, but was migrated over to the 2012
DC a few weeks ago as per the instructions here: http://www.brycematheson.io/how-to-migrate-dhcp-from-windows-server-2008-to-2012-2016/
We have a mix of static IP’s and dynamic IP’s. DHCP lease length is set to 8 hours.
After the migration I disabled the DHCP service on the 2008 server. A few hiccups occurred with mismatched DNS A and PTR records during thre next few days. After I cleaned those up I removed the DHCP role from the 2008 server.
About a week ago I noticed that while domain joined computers’ DNS records were fine, guest devices running Android and Apple OS, all of which were being assigned dynamic addresses had two PTR records — one current and one stale.
I deleted the stale records and did some research. I changed the DHCP IPv4 Advanced Properties so that conflict detection attempts was changed from 0 to 1, and created a dedicated AD account named DHCProtocol to use for DNS dynamic update registration credentials
and set its password to never expire.
I was looking at the DNS logs yesterday and noticed many 4015 events. Note that these events only occurr on the 2012 server which hosts the DHCP role:
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: 12/04/2018 13:14:04
Event ID: 4015
Task Category: None
Level: Error
Keywords: (131072)
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is «0000051B: AtrErr: DSID-030F22B2, #1:
0: 0000051B: DSID-030F22B2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor)». The event data contains the error.
There are other accounts listed with 4051, but these are machine-name$ accounts. The majority of the entries reference the user as DHCProtocol.
More research led to this article: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03366032. I restarted all our servers to install the lastest round of Windows Updates and hoped the restart might resolve the issue but the 4015 events continued
to be logged.
I set the diagnostic logging for Directory Access to 5 as per the hpe.com article. The next 4015 error (shown above) coincided with the following from the Directory Access log:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1175
Task Category: Directory Access
Level: Information
Keywords: Classic
User: SYSTEM
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local failed because a non-security related error occurred.
Immediately followed by:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1174
Task Category: Directory Access
Level: Information
Keywords: Classic
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) was successfully performed on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local.
Having got this far, I am not sure how to proceed. Can anyone help me with this, or to understand what is happening please?
Thanks.
Содержание
- RODC logs DNS event 4015 every three minutes with error code 00002095
- Symptoms
- Cause
- Resolution
- More information
- Disclaimer
- RODC регистрирует событие DNS 4015 каждые три минуты с кодом ошибки 00002095
- Симптомы
- Причина
- Решение
- Дополнительные сведения
- Заявление об отказе от ответственности
- Event error 4015 dns
- Вопрос
- Event error 4015 dns
- Asked by:
- Question
- Event error 4015 dns
- Лучший отвечающий
- Вопрос
RODC logs DNS event 4015 every three minutes with error code 00002095
This article describes event ID 4015 that occurs when you run the Domain Name Service (DNS) role on a Read-Only Domain Controller (RODC) and a writable Domain Controller (hosting DNS) isn’t accessible.
Applies to: В Windows Server 2012 R2
Original KB number: В 969488
Symptoms
If we’re running the Domain Name Service (DNS) role on a Read-Only Domain Controller (RODC) and a writable Domain Controller (hosting DNS) isn’t accessible, we see the following event being logged on the RODC.
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: date time
Event ID: 4015
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computer_name
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is «00002095: SvcErr: DSID-03210A6A, problem 5012 (DIR_ERROR), data 16». The event data contains the error.
Cause
When a Read Only Domain Controller (RODC) locates a writeable DNS server to perform ReplicateSingleObject (RSO), it performs a DSGETDC function with the following flags set:
DS_AVOID_SELF
DS_TRY_NEXTCLOSEST_SITE
DS_DIRECTORY_SERVICE_6_REQUIRED
DS_WRITEABLE_REQUIRED
Once a DC is returned from the DSGETDC call, it uses the result to search for the NS record in DNS. If the DSGETDC call fails, or it fails to find the NS record of the DC returned from DSGETDC, the error 4105 will be logged.
Possible causes of the 4105 error:
No writeable DC is accessible, or none returned from DSGETDC call
The DSGETDC call was successful, but the DC returned doesn’t have the DNS Server Role installed, or doesn’t register an NS record in DNS.
The following command can be ran from the RODC to check which DC is returned from the DSGETDC call:
Where DOMAIN.COM is your domain name.
Resolution
To resolve either cause above, ensure that a writable DC is accessible from the RODC, that the DNS Server Role is installed on that DC, and that the NS record is registered in DNS for the writable DC.
More information
For more information about the DSGETDC function, see TechNet article:
Disclaimer
Microsoft and/or its suppliers make no representations or warranties about the suitability, reliability, or accuracy of the information contained in the documents and related graphics published on this website (the «materials») for any purpose. The materials may include technical inaccuracies or typographical errors and may be revised at any time without notice.
To the maximum extent permitted by applicable law, Microsoft and/or its suppliers disclaim and exclude all representations, warranties, and conditions whether express, implied, or statutory, including but not limited to representations, warranties, or conditions of title, non-infringement, satisfactory condition or quality, merchantability and fitness for a particular purpose, with respect to the materials.
Источник
RODC регистрирует событие DNS 4015 каждые три минуты с кодом ошибки 00002095
В этой статье описывается событие с идентификатором 4015, которое происходит при запуске роли службы доменных имен (DNS) на контроллере домена Read-Only (RODC), а доступный для записи контроллер домена (размещение DNS) недоступен.
Применяется к: Windows Server 2012 R2
Исходный номер базы знаний: 969488
Симптомы
Если мы запускаем роль службы доменных имен (DNS) на контроллере домена Read-Only (RODC), а доступный для записи контроллер домена (размещение DNS) недоступен, мы видим следующее событие, регистрируемое в RODC.
Имя журнала: DNS-сервер
Источник: Microsoft-Windows-DNS-Server-Service
Дата: дата и время
Идентификатор события: 4015
Категория задач: нет
Уровень: ошибка
Ключевые слова: классическая
Пользователь: Н/А
Компьютер: имякомпьютера_
Описание:
На DNS-сервере произошла критическая ошибка из Active Directory. Убедитесь, что Active Directory работает правильно. Сведения об отладке расширенных ошибок (которые могут быть пустыми) — «00002095: SvcErr: DSID-03210A6A, проблема 5012 (DIR_ERROR), данные 16». Данные события содержат ошибку.
Причина
Когда контроллер домена только для чтения (RODC) находит доступный для записи DNS-сервер для выполнения replicateSingleObject (RSO), он выполняет функцию DSGETDC со следующими флагами:
DS_AVOID_SELF
DS_TRY_NEXTCLOSEST_SITE
DS_DIRECTORY_SERVICE_6_REQUIRED
DS_WRITEABLE_REQUIRED
После возвращения контроллера домена из вызова DSGETDC он использует результат для поиска записи NS в DNS. Если вызов DSGETDC завершается сбоем или не удается найти запись NS контроллера домена, возвращенную из DSGETDC, будет записана ошибка 4105.
Возможные причины ошибки 4105:
Контроллер домена, доступный для записи, недоступен или не возвращается при вызове DSGETDC
Вызов DSGETDC выполнен успешно, но возвращенный контроллер домена не установил роль DNS-сервера или не регистрирует запись NS в DNS.
Чтобы проверить, какой контроллер домена возвращается из вызова DSGETDC, можно выполнить следующую команду:
Где DOMAIN.COM находится ваше доменное имя.
Решение
Чтобы устранить описанные выше причины, убедитесь, что доступный для записи контроллер домена из контроллера домена, что роль DNS-сервера установлена на этом контроллере домена и что запись NS зарегистрирована в DNS для доступного для записи контроллера домена.
Дополнительные сведения
Дополнительные сведения о функции DSGETDC см. в статье TechNet:
Заявление об отказе от ответственности
Корпорация Майкрософт и (или) ее поставщики не делают никаких представлений или гарантий о пригодности, надежности или точности сведений, содержащихся в документах и связанных графических элементах, опубликованных на этом веб-сайте (материалы) для каких-либо целей. Эти материалы могут включать технические неточности или о типографические ошибки и могут быть изменены в любое время без предварительного уведомления.
В максимальной степени, разрешенной применимым законодательством, корпорация Майкрософт и (или) ее поставщики не допускают и исключают все представления, гарантии и условия, как явные, подразумеваемые, так и предусмотренные законом, включая, помимо прочего, представления, гарантии или условия заголовка, отсутствие нарушения прав, удовлетворительное условие или качество, товарную пригодность и пригодность для определенной цели в отношении материалов.
Источник
Event error 4015 dns
Вопрос
Установили новый контроллер домена на Windows 2012 R2, (режим работы домена 2008R2), при перезагрузке сервера появляется ошибка:
DNS-сервер обнаружил критическую ошибку Active Directory. Проверьте работоспособность Active Directory. Дополнительная отладочная информация об ошибке: «» (может отсутствовать). Данные о событии содержат сведения об ошибке.
Также почему-то данная ошибка журнале отображается так:
Тип события: Ошибка
Источник события: Microsoft-Windows-DNS-Server-Service
Категория события: Отсутствует
Код события: 4015
Дата: 16.01.2015
Время: 15:03:52
Пользователь: NT AUTHORITYСИСТЕМА
Компьютер: LPTDC4.lptrans.ru
Описание:
Не найдено описание для события с кодом ( 4015 ) в источнике ( Microsoft-Windows-DNS-Server-Service ). Либо вызывающий данное событие компонент не установлен на этот локальный компьютер, либо установка повреждена. Установите или восстановите компонент на локальном компьютере либо обратитесь к производителю компонента за новой версией.
Если событие было сохранено с другого компьютера или переадресовано с удаленного компьютера, может потребоваться включить отображение сведений в события при их сохранении либо при установке подписки с переа .
Данные:
0000: 51 00 00 00 Q.
Может кто сталкивался с подобной проблемой, подскажет в чем дело?
PS: Также в логах присутвует такие предупреждения:
Глобальный список блокировки запросов является средством защиты от атак на сеть с помощью блокировки DNS-запросов от некоторых узлов с определенными именами. Это средство явилось причиной отказа DNS-сервера выполнить запрос с кодом ОШИБКА ИМЕНИ для wpad.rusagrotrans.ru., ходя данные для этого DNS-имени существуют в базе данных DNS. Другие запросы во всех локальных управляющих зонах для других имен, начинающихся с меток, входящих в список блокировки, также выполняться не будут, но при блокировке запросов события в журнал записываться не будут до перезапуска службы DNS-сервера на этом компьютере. Сведения об этом средстве и инструкции по его настройке см. в документации продукта.
Ниже приводится текущий глобальный список блокировки запросов(слишком длинный список для данного события может быть усечен):
wpad
isatap
Источник
Event error 4015 dns
This forum has migrated to Microsoft Q&A. Visit Microsoft Q&A to post new questions.
Asked by:
Question
We have a 2008 functional level active drirectory running on two domain controllers — 2008 Standard and 2012 R2 Standard. DNS is active directory integrated and is installed on both DC’s. DHCP was installed on the 2008 DC, but was migrated over to the 2012 DC a few weeks ago as per the instructions here: http://www.brycematheson.io/how-to-migrate-dhcp-from-windows-server-2008-to-2012-2016/
We have a mix of static IP’s and dynamic IP’s. DHCP lease length is set to 8 hours.
After the migration I disabled the DHCP service on the 2008 server. A few hiccups occurred with mismatched DNS A and PTR records during thre next few days. After I cleaned those up I removed the DHCP role from the 2008 server.
About a week ago I noticed that while domain joined computers’ DNS records were fine, guest devices running Android and Apple OS, all of which were being assigned dynamic addresses had two PTR records — one current and one stale.
I deleted the stale records and did some research. I changed the DHCP IPv4 Advanced Properties so that conflict detection attempts was changed from 0 to 1, and created a dedicated AD account named DHCProtocol to use for DNS dynamic update registration credentials and set its password to never expire.
I was looking at the DNS logs yesterday and noticed many 4015 events. Note that these events only occurr on the 2012 server which hosts the DHCP role:
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: 12/04/2018 13:14:04
Event ID: 4015
Task Category: None
Level: Error
Keywords: (131072)
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is «0000051B: AtrErr: DSID-030F22B2, #1:
0: 0000051B: DSID-030F22B2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 20119 (nTSecurityDescriptor)». The event data contains the error.
There are other accounts listed with 4051, but these are machine-name$ accounts. The majority of the entries reference the user as DHCProtocol.
More research led to this article: https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03366032. I restarted all our servers to install the lastest round of Windows Updates and hoped the restart might resolve the issue but the 4015 events continued to be logged.
I set the diagnostic logging for Directory Access to 5 as per the hpe.com article. The next 4015 error (shown above) coincided with the following from the Directory Access log:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1175
Task Category: Directory Access
Level: Information
Keywords: Classic
User: SYSTEM
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local failed because a non-security related error occurred.
Immediately followed by:
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 12/04/2018 13:14:04
Event ID: 1174
Task Category: Directory Access
Level: Information
Keywords: Classic
User: HTLINCSDHCProtocol
Computer: Atlas.htlincs.local
Description:
Internal event: A privileged operation (rights required = 0x) was successfully performed on object DC=152,DC=0.168.192.in-addr.arpa,cn=MicrosoftDNS,DC=ForestDnsZones,DC=htlincs,DC=local.
Having got this far, I am not sure how to proceed. Can anyone help me with this, or to understand what is happening please?
Источник
Event error 4015 dns
Этот форум закрыт. Спасибо за участие!
Лучший отвечающий
Вопрос
При выключении сервера в Event Viewer регистрируются события:
Код: 4015
Источник: DNS
DNS-серверу обнаружил критическую ошибку Active Directory. Убедитесь, что Active Directory работает правильно. Расширенная информация об ошибке: «». Данные события содержат сведения об ошибке.
Дополнительные сведения можно найти в центре справки и поддержки, в «http://go.microsoft.com/fwlink/events.asp».
и сразу после этого 4 сообщения
Код 4004
Источник DNS
DNS-серверу не удалось загрузить зону, поскольку не удалось завершить перечисление служб зоны name.xy.local. Данный DNS-сервер настроен для получения и использования информации этой зоны из Active Directory. Проверьте, что Active Directory функционирует нормально и повторите перечисление зоны. Расширенная информация об ошибке: «». Данные события содержат сведения об ошибке.
Дополнительные сведения можно найти в центре справки и поддержки, в «http://go.microsoft.com/fwlink/events.asp».
Вместо «name» появляются имена зон прямого просмотра
Система: Windows 2003 Server R2 +SP2
Ошибка проявляется после каждой 2й перезагрузки.
Источник
Event 4015 when running DNS on RODC can be resolved with this handy guide from our experts.
At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Services.
Let’s take a look at how our Support Team is ready to help customers with Event 4015 when running DNS on RODC.
How to fix Event 4015 when running DNS on RODC
Event 4015 often occurs when we run the Domain Name Service role on an RODC (Read-Only Domain Controller) in addition to a writable Domain Controller (hosting DNS) being inaccessible.
According to our Support Team, we can see the event logged on the RODC as seen below:
Log Name: DNS Server
Source: Microsoft-Windows-DNS-Server-Service
Date: date time
Event ID: 4015
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: computer_name
Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is “00002095: SvcErr: DSID-03210A6A, problem 5012 (DIR_ERROR), data 16”. The event data contains the error.
After careful analysis, our Support Techs have come to the conclusion that when an RODC locates a writeable DNS server in order to perform ReplicateSingleObject (RSO), the DSGETDC function occurs with that the following flags:
DS_AVOID_SELF
DS_TRY_NEXTCLOSEST_SITE
DS_DIRECTORY_SERVICE_6_REQUIRED
DS_WRITEABLE_REQUIRED
Furthermore, after DC returns from the DSGETDC call, it utilizes the results to look for the NS record in DNS. In case DSGETDC call fails or is not able to locate the NS record of the DC from the DSGETDC, thereby logging error 4105. Additionally, here are two reasons, that may be the cause behind the 4105 error:
- No accessible writeable DC or none returned after DSGETDC call.
- A successful DSGETDC call, but the returned DC does not have the DNS Server Role installed or does not have an NS record in DNS.
Moreover, we can run the following command from RODC in order to check which DC comes back as a result of the DSGETDC call:
nltest /dsgetdc: DOMAIN.COM /WRITABLE /AVOIDSELF /TRY_NEXT_CLOSEST_SITE/DS_6
Here DOMAIN.COM is our domain name.
Fortunately, we can resolve this issue by ensuring there is a writeable DC accessible from the RODC, ensuring that the DNS Server role is installed on the DC in addition to the NS record in DNS for the writeable DC.
[Looking for a solution to another query? We are just a click away.]
Conclusion
In brief, our skilled Support Engineers at Bobcares demonstrated how to deal with Event 4015 when running DNS on RODC.
PREVENT YOUR SERVER FROM CRASHING!
Never again lose customers to poor server speed! Let us help you.
Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.
GET STARTED
I’ve recently installed a Windows Server 2012 domain controller in one of our branch offices; all seems to be running well but have noticed I keep getting a repeating DNS error which is very vague and I can’t find out what the problem is an how to fix:
«The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is «». The event data contains the error.»
The domain is a mixture of 2003, 2008 & 2012 dc/dns.
Does anyone know what the issue could be?
There are a lot of DNS errors
out there. Way too many, right?
You as a sysadmin know that for sure – DNS errors sometimes drive you crazy.
Here’s a list of the most common errors around DNS and the proven solution to them:
- DNS server error : DNS server isn’t responding
- PlayStation 4 DNS error NW-31253-4
- PlayStation 4 DNS error NW-31250-1
- PlayStation 4 DNS error NW-31254-5
- PlayStation 3 DNS error 80710101
- PlayStation 3 DNS error 8710102
- DNS error 4015
- DNS Lookup error
- Google Chrome DNS error
- DNS Token Mismatch error
- Internet Explorer DNS error
- DNS error 4013
- Fortigate DNS error
- DNS error 4000 and error 4007
- DNS Validation error 1004
- PlayStation Portable DNS error 80410410
- Xbox 360 DNS error
- Further common DNS error Codes
And you’ll find the solution to get rid of ALL DNS errors – forever: Test PRTG and get started within minutes!
1. DNS server error : DNS server isn’t responding
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
2. PlayStation 4 DNS error NW-31253-4
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
3. PlayStation 4 DNS error NW-31250-1
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
4. PlayStation 4 DNS error NW-31254-5
Quick fix
PS4 error code NW-31254-5 is an obscure error code that does not occur as often as the related error NW-31253-4, but often originates from a similar cause and can be corrected in the same way. An error message appears indicating that the DNS server’s response is delayed or unstable.
This error occurs because the DNS servers are not working or have been put in incorrectly. DNS servers are very important because they map domain names (e.g. playstation.com) to IP addresses. Without them, the devices cannot be online.
Best solution:
https://weakwifisolutions.com/fixing-ps4-error-nw-31254-5/
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
5. PlayStation 3 DNS error 80710101
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
6. PlayStation 3 DNS error 8710102
Quick fix
DNS Error 8071010102 is an error displayed on the PlayStation 3 when trying to connect to the Internet. It is a known problem for PlayStation users.
The answer is to disable universal plug-and-play on the router. Disabling universal plug-and-play on the router is done via the console interface.
Best solution:
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
7. DNS error 4015
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
8. DNS Lookup error
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
9. Google Chrome DNS error
Quick fix
The IP addresses of the websites you access on Google Chrome are stored by the Domain Name System or DNS. If you clear the Chrome browser’s DNS cache, you can fix host connection errors that occur when you browse the web on a Windows PC. Such Google Chrome failures may include ERR_TIMED_OUT or similar errors.
The purpose of DNS is to allow the PC to access the IP addresses of the websites, especially if the IP servers change. If you encounter a host error or DNS error while browsing Google Chrome, the DNS cache has to be cleared to fix the error.
Best solution:
https://www.howtogeek.com/197804/how-to-clear-the-google-chrome-dns-cache-on-windows/
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
10. DNS Token Mismatch error
Quick fix
This error refers to a timeout of a token generated by the WhatsMyDNS website that allows the visitor to use their search system. Thus, when an attempt is made to verify the DNS propagation of a domain, the token is used to perform the search.
The Token Mismatch error appears when the token generated by WhatsMyDNS has expired and is no longer valid when the lookup or search operation is performed. Therefore, the page throws the Token Mismatch error.
Best solution:
https://techglimpse.com/token-mismatch-dns-propagation-error/
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
11. Internet Explorer DNS error
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
12. DNS error 4013
Quick fix
The Domain controllers whose copy of Active Directory contains references to other domain controllers in the forest attempt to replicate all locally held directory partitions during Windows startup as part of an initial synchronization or init sync.
At the attempt to boot with the latest DNS zone contents, Microsoft DNS servers that host AD-integrated copies of DNS zones delay the start of the DNS service for several minutes after Windows starts, unless Active Directory has completed its initial synchronization during Windows startup. In the meantime, Active Directory is delayed from inbound replicating directory partitions until it can resolve the CNAME GUID of its source domain controller to an IP address on the DNS servers used by the destination domain controller for name resolution. The duration of the hang when preparing network connections depends on the number of locally held directory partitions located in the Active Directory copy of a domain controller. The most domain controllers have at least five partitions (schema, configuration, domain, forest-wide DNS application partition, domain-wide DNS application partition) and can experience a boot delay of 15-20 minutes. The boot delay increases by the existence of additional partitions.
The DNS event ID 4013 in the DNS event log signifies that the DNS service startup has been delayed due to inbound replication of Active Directory partitions had not yet occurred.
Best solution:
https://support.microsoft.com/en-us/help/2001093/troubleshoot-dns-event-id-4013-the-dns-server-was-unable-to-load-ad-in
More solutions:
https://serverfault.com/questions/406946/event-id-4013-the-dns-server-is-waiting-for-active-directory-domain-services
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
13. Fortigate DNS error
Quick fix
In v5.4. this log entry is an expected behavior.
FortiGate searches for invalid/failed DNS traffic and marks it as action=dns or in the GUI as Action Deny: DNS error. This happens if the DNS query is unsuccessful and returns a state other than NOERROR. The firewall action itself is allow/pass, so the bad response is still forwarded from the server back to the requesting client. The session is marked with the Deny: DNS Error message.
Examples of invalid DNS traffic could be UDP packets on port 53 that are not DNS traffic, packets that are too large or with a bad checksum. This error message should also be displayed for DNS traffic that causes an error, such as the request to or reply from an invalid DNS server.
Best solution:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD40788
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
14. DNS error 4000 and error 4007
Quick fix
There may be in a situation where one of the DNS servers in the environment displays a problem where the zones are not loaded on the DNS console and the event IDs 4000 and 4007 are logged in the DNS event logs.
Event ID 4000:
The DNS server is unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.
Event number 4007:
The DNS server is unable to open zone <zone> in the Active Directory from the application directory partition
<partition name>. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code.
If you try to open the DNS console, you will receive a pop-up labeled Access Denied. You see, the DNS server service is up and running.
If you try to perform an operation on the integrated AD zones with DNSCMD, you will receive Access Denied. This happens when this specific DC/DNS server has lost its secure channel with itself or the PDC. This can also happen in a single DC environment where this DC/DNS server carries all FSMO roles and points to itself as the primary DNS server.
Best solution:
https://support.microsoft.com/en-us/help/2751452/dns-zones-do-not-load-event-4000-4007
More solutions:
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
15. DNS validation error 1004
Quick fix
While working on the Cloudflare dashboard a Code 1004 error indicates that Cloudflare could not perform a requested action.
It is a different problmen than Error 1004: Host Not Configured to Serve Web Traffic or Error 1004: DNS is still propagating. These failures will appear to visitors to your website if the origin IP cannot be resolved through your DNS records.
Best solution:
https://community.cloudflare.com/t/community-tip-fixing-code-1004-dns-validation-error/46697
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
16. PlayStation Portable DNS error 80410410
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
17. Xbox 360 DNS error
Quick fix
The Xbox 360, like many other network devices, uses the DNS to translate Internet addresses into numeric IP addresses. If the console is not able to retrieve the values for the DNS, the Xbox 360 cannot properly connect to the Xbox Live network.
Best solution:
https://support.xbox.com/en-US/xbox-360/errors/error-code-8015100c
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
18. Further common DNS error codes
Quick fix
Typical WIN32 DNS return codes have been listed in the following table. These codes may appear in the SMTP debug log file if the DNS is either incorrectly configured or DNS errors are returned from the DNS server.
9001 |
DNS server unable to interpret format. |
9002 |
DNS server failure. |
9003 |
DNS name does not exist. |
9004 |
DNS request not supported by name server. |
9005 |
DNS operation refused. |
9006 |
DNS name that should not exist, does exist. |
9007 |
DNS RR set that ought not to exist, does exist. |
9008 |
DNS RR set that ought to exist, does not exist. |
9009 |
DNS server not authoritative for zone. |
9010 |
DNS name in update or prereq is not in zone. |
9016 |
DNS signature failed to verify. |
9017 |
DNS bad key. |
9018 |
DNS signature validity expired. |
9501 |
No records found for given DNS query |
9502 |
Bad DNS packet |
9503 |
No DNS packet 9504: DNS error, check rcode |
9505 |
Unsecured DNS packet |
1460 |
Timeout — This operation returned because the timeout period expired |
Best solution:
http://www.mailenable.com/documentation/10.0/enterprise/DNS_error_codes_and_descriptions.html
More solutions:
https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes—9000-11999-
Find out how to run a comprehensive DNS report for your domain:
https://mxtoolbox.com/dnscheck.aspx
https://www.uptrends.com/tools/dns
Proper fix
Having trouble with DNS errors? Switch to PRTG Network Monitor, the all-in-one DNS server monitoring tool. It checks the overall status of your DNS servers and provides you with detailed statistics.
With PRTG you will be notified in realtime if any DNS failures occur.
Learn more about DNS monitoring
Choose your solution: Bugfix or replacement
With PRTG you’ll never have to deal with
DNS errors again. Ever.
Trusted by 500,000 users and recognized
by industry analysts as a leader
“Fantastic network and infrastructure monitoring solution that is easy to deploy and easier still to use. Simply the best available.”
Read more reviews
“Software is absolutely perfect, Support is superior. Meets all needs and requirements, this is a must have solution if you are needing any form of monitoring.”
Read more reviews
“The tool excels at its primary focus of being a unified infrastructure management and network monitoring service.”
Read more reviews