Active Directory DNS Single Label Names


Hey everyone, Ace again. Let’s discuss this issue. I hardly see this issue any more, because it was a previously prevalent when Active Directory was introduced, since there were some confusion about AD domain naming, and many IT admins used NT4’s domain naming guidelines. Man of us are now familiar with AD’s naming convention, and have more than likely renamed or rebuilt their AD domains. However, there are still some installations with this issue. 

How did it happen? Many reasons, such as lack of research on AD’s DNS requirements, assumptions, or a simple typo when originally upgrading from NT4 or promoting your new AD domain. It doesn’t matter now, because you were brought here to find out what to do with it.

I hope you find this blog informative on this issue and what to do about it.

First, let’s discuss a little background on the necessary components at play…


First, let’s discuss the FQDN. What is an FQDN? It stands for “Fully Qualified Domain Name.” It is multi-level, or hierarchal, such as:

What is a Single Label DNS Domain name?
The name is reminiscent of the legacy style NT4 domain NetBIOS domain names, such as:


Unfortunately, since this does not work with DNS, and Active Directory relies on DNS, therefore, it does not work with Active Directory. Stay with me. I’ll explain…


DNS is a hierarchal database. Some call it a “tree” with a root (the ‘com’ or ‘net’, etc, name), then the trunk (the ‘domain’ portion of it), and the branches (such as www, servername, etc). The Root domain name, such as com, edu, net, etc, is also known as the TLD (Tope Level Domain name).

Basically you can look at a DNS domain name as having multiple levels separated by periods. The minimal requirment for an FQDN domain name, such as, is two levels. Then of course are your resource names, such as www, servername, or even child domain names under it.

Notice with a single label name there is only one name for the domain, or one level? Don’t get this confused with the NetBIOS domain name, that we were familiar with in the NT4 days. AD supports the NetBIOS domain name as well, but only as a NetBIOS domain name. It’s one of the domain names chosen when a machine is promoted into a domain controller for a brand new domain in a brand new forest. NT4 wasn’t reliant nor did it use DNS for NT4 domains. However, AD is reliant, therefore it must follow DNS naming rules.

Unfortunately the old NT4 style names are not hierarchal because there is only one level.
Since AD requires and relies on DNS, and DNS is a hierarchal database, a single label name does not follow any sort of hierarchy. DNS fails with single label names. Windows 2008, Windows 2003, XP and Vista have problems resolving single label names because it does not follow the proper format for a DNS domain name, such as, etc.

Also, Windows 2000 SP4 and all newer machines have problems querying single label names. It’s explained below by Alan Woods. Because clients query DNS for AD resources (domain controller locations and other services), they may have difficulty finding resources.

How did it happen? As I said earlier, it doesn’t matter now, because you were brought here to find out what to do with it.

Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain (or any AD upgrade or installation):

Single Label Name Explanation

Another variation of the Single Label Name explanation that I had provided in a response to a post in the DNS and/or AD newsgroups at one time:

The issue is the single label name. Locally at HQ, it’s using NetBIOS to join, however remotely, it’s relying on DNS. DNS queries do not work properly with single label names on Windows 2000 SP4 and all newer machines.

Period. Why? good question. It’s based on the fact DNS is hierarchal. Hierarchal meaning it must have multi levels, a minimum of two levels.

The TLD (top level domain) is the root name, such as the com, net, etc., names. The client side resolver service algorithm (which is governed by the DHCP Client service which must be running on all machines, static or not),
relies on that name for the basis to find the second level name (the name “domain” in, etc.). If the name is a single label name, it thinks THAT name is the TLD.

Therefore it then hits the Internet Root servers to find how owns and is authoritative for that TLD.Such as when looking up It queries for the COM portion, which the roots return the nameservers responsible for the COM servers, then it queries for the servers responsible for zone.

If it’s a single label, the query ends there, and it won’t go further. However what is funny (sic) is that even though the single label name is being hosted locally in DNS, it will NOT query locally first, because it believes it is a TLD, therefore goes through the normal resolution (recursion and devolution) process, which causes excessive query traffic to the internet Root servers.

How to fix it? Good question. Glad you’ve asked.

  1. The preferred “fix” (in a one line summary), is to install a fresh new domain properly named and use ADMT to migrate user, group and computer accounts into the new domain from the current domain.
  2. An alternative is to perform a domain rename, (difficulty depends on the operating system and which version of Exchange is installed).
  3. As a temporary resort, you can use the patch or band aid registry fix to force resolution and registration that is mentioned in the following link. This must be applied to every machine. Unfortunately it must be done on every machine in the domain, including the DCs, member servers, workstations and laptops.

Information About Configuring Windows 2000 for Domains with Single-Label DNS Names:

Single Label Names and being a better Internet Neighbor

The following was posted by Microsoft’s Alan Woods in 2004:

Single label names, from Alan Woods, [MSFT], posted:

—– Original Message —–
From: “Alan Wood” [MSFT]
Newsgroups: microsoft.public.win2000.dns
Sent: Wednesday, January 07, 2004 1:25 PM
Subject: Re: Single label DNS

Hi Roger,

We really would prefer to use FQDN over Single labled. There are
alot of other issues that you can run into when using a Single labeled
domain name with other AD integrated products. Exchange would be a great
example. Also note that the DNR (DNS RESOLVER) was and is designed to
Devolve DNS requests to the LAST 2 names.

Example: Single Labeled domain .domainA
then, you add additional domains on the forest.

If a client in the domain Child2 wants to resolve a name in domainA
Example. Host.DomainA and uses the following to connect to a share
\\host then it is not going to resolve. WHY, because the resolver is
first going to query for first for Host.Child2.child1.domainA, then it
next try HOST.Child1.domainA at that point the Devolution process is
DONE. We only go to the LAST 2 Domain Names.

Also note that if you have a single labeled domain name it causes excess
DNS traffic on the ROOT HINTS servers and being all Good Internet Community
users we definitely do not want to do that.   NOTE that in Windows 2003,
you get a big Pop UP Error Message when trying to create a single labeled
name telling you DON’T DO IT.  It will still allow you to do it, but you
will still be required to make the registry changes, which is really not

Microsoft is seriously asking you to NOT do this.  We will support you but
it the end results could be limiting as an end results depending on the
services you are using.

Thank you,

Alan Wood[MSFT]


Related Articles – Even though they seem old, they STILL APPLY!!!

Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003:

DNS and AD (Windows 2000 & 2003) FAQ:

Naming conventions in Active Directory for computers, domains, sites, and OUs (Good article on DNS and other names)



I hope this helps!

Published 10/15/2016

Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP – Directory Services

clip_image0023 clip_image0043 clip_image0063 clip_image0083 clip_image0103 clip_image0123 clip_image0143 clip_image0163

Complete List of Technical Blogs:

This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Event ID 5774



In general, these events indicates that the machine is unable to register its records with the DNS serverSleeping half-moon it’s configured.

Possible causes:

  • An ISP’s DNS server, or the router’s IP address, is set to be used as a DNS server in NIC properties.
  • The AD zone is configured to not allow dynamic updates.
  • If the 1st DNS entry is in another site, a firewall may be blocking necessary traffic.
  • Altered default security settings on the zone.
  • Altered default security settings in AD.
  • Altered default security settings on C: drive or C:\Windows folder.
  • Antivirus not configured to allow domain communications and services exceptions. See the antivirus vendor documentation on how to configure DCs for exclusions.
  • If the zone is set to Secure Only, possible Kerberos authentication errors will prevent registration. Causes of Kerberos errors can be numerous including misconfigured time service and antivirus exclusion, using an ISP’s DNS, third party installed firewalls or AV, and more.

Note on Firewalls

Active Directory communications require over 29 ports to be allowed, plus the ephemeral ports, and differ among operating system versions:

  • Windows 2003, Windows XP and older: UDP 1024 – 5000
  • Windows 2008, Windows Vista, & newer: UDP 49152 – 65536

DNS updates require TCP 53 & UDP 53, not just TCP 53.
It can be extremely challenging to configure a firewall for AD communications/ General rule of thumb is to just allow all traffic between locations.

Here’s a good list of the ports:

Active Directory Firewall Ports – Let’s Try To Make This Simple (RODC, too)

If you need to control the ports AD uses across a firewall:

Active Directory Replication over Firewalls

Paul Bergson’s Blog on AD Replication and Firewall Ports

Restricting Active Directory replication traffic and client RPC …Restricting Active Directory replication traffic and client RPC traffic to a … unique port, and you restart the Netlogon service on the domain controller. …

How to restrict FRS replication traffic to a specific static port – How to restrict FRS replication traffic to a specific static port … Windows 2000-based domain controllers and servers use FRS to replicate system policy …


You can run the following tests on AD to ensure there are no errors:

  • DCDIAG /V /C /D /E /s:yourDCName > c:\dcdiag.log
  • Netdiag.exe /v > c:\netdiag.log (Run only on each Windows 2003 or older DCs, not 2008 or 2008 R2)
  • repadmin.exe /showrepl dc* /verbose /all /intersite > c:\repl.txt
  • ntfrsutl ds > c:\sysvol.log

Possible solutions:

  1. On the machine logging the above event, in their TCP/IP configuration, make sure they’re not configured for the same DNS server for both Primary and Secondary.
  2. The following registry value is incorrect: “SiteCoverage” under:    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
        This value typically should equal the domain name.
  3. You can try to flip the zone types to reset default settings.
    1. Change the zone type from Active Directory integrated to “Standard Primary”, then stop & start DNS.
    2. Then stop & start the netlogon service on the child DC & verify that the records are registered.
    3. If verified, then change the zone type back to Active Directory integrated and verify that the DC no longer records the Event log errors when the netlogon service is stopped & started.
  4. Make sure the machine logging the above event is pointing to a DNS server that support Dynamic updates and is hosting a zone for the domain (i.e. make sure it’s not pointing to the ISPs DNS server).
  5. Verify if there is no manually created CNAME, A or other record) for the same hostname. If there is, it will prevent the DCs from dynamically registering its host and you need to remove the manually created record.
  6. In a Parent – Child delegated scenario, and Event ID 5774 was logged on the domain controllers in the child domain:
        On the parent DNS servers, there is a delegation for the child DNS servers. The child DNS servers have forwarders up to the parent DNS servers.
        Cause and Fix:
        On the Security tab in the delegations, check if  “Authenticated Users” is missing.
        Added “Authenticated Users” and enabled Full Control.


Domain Controller Generates a Netlogon Error Event ID 5774

A DNS Update is recorded as failed: Event ID 5774, 1196, or 1578
This problem occurs when you use a third-party server application for DNS resolution. This includes SCCM causing false alarms, and cluster resources not initiating using a third party DNS server.
Hotfix available for Windows Server 2008 R2 or Windows 7.

Event ID: 5774 Source: NETLOGON

Other References:

Technet thread: “Event 5774, NETLOGON” Friday, November 20, 2009

Technet thread: “Netlogon event 5774” Tuesday, February 01, 2011



I hope this helps with figuring out and fixing an Event ID 5774. 

Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP – Directory Services
Complete List of Technical Blogs:

This posting is provided AS-IS with no warranties or guarantees and confers no rights.

How to Recover a Journal Wrap Error (JRNL_WRAP_ERROR) and a Corrupted FRS SYSVOL from a Good DC – What option do I use, D4 or D2? What’s the Difference between D4 and D2?

Original: 11/21/2013
Updated 8/30/2014


Ace here again. I’ working on updating all of my blogs. If you see any inconsistencies, please let email me and let me know.


Are you seeing Event ID 13508, 13568, and anything else related to SYSVOL, JRNL_WRAPS, or NTFRS?

Note – I will not address Event ID 2042 or 1864. That’s an issue with replication not working beyond the AD tombstone. If you are seeing them, you’re best bet is to forcedemote the machine, run a metadata cleanup, and re-promote it, and make sure you configure your firewall and/or AV to allow replication traffic or stop using the ISP’s or router as a DNS address, or disable IP routing and WINS Proxy, to prevent this in the future. And while you’re at it bump up your AD tombstone to 180 days,

As for the NTFRS, after talking to numerous folks whether directly assisting a customer, or through the TechNet forums, there seems to be some confusion associated with how to handle Journal Wrap errors, what caused them, and what are the differences between the D2 and D4 options. I’ll try to quell this confusion in this blog, as well as provide an easy step-step and providing an explanation for the steps, to get out of this error. Note: The steps are from Microsoft KB290762. I just thought to further break it down so a layman will understand them.

Reference KB: Using the BurFlags registry key to reinitialize File Replication Service Replica Sets

For Windows 2008/2008 R2/2012/2012 R2 with DFSR

Follow this KB to fix it:

How to force an authoritative and non-authoritative synchronization for DFSR-replicated SYSVOL (like “D4/D2” for FRS)

Backing Up and Restoring an FRS-Replicated SYSVOL Folder 

What Caused the Journal Wrap?

First you have to ask yourself, what caused this error on my DC? What did I do to get here? In a nutshell, JRNL_WRAPS are caused by SYSVOL corruption.

The usual culprit can be a number of things:

  • Abrupt shutdown/restart. I don’t usually see this unless there are power issues in the building with not power protection or UPS battery system.
  • Disk errors – corrupted sectors. This is a common issue with a DC on older hardware.
  • AV not configured to exclude SYSVOL, NTDS and the AD processes. This is the typical culprit I’ve seen in many cases.

Ok, So what do I have to do to fix this?

To get yourself out of this quandary, it’s rather simple. Yea, you might say yea, right, this is not so simple, but it really isn’t that hard. It just requires a little understanding of what you have to do, which is all it’s doing is simply copying a good SYSVOL folder and subfolders from a good DC to the bad DC (the one with the errors.

Basically, you first choose which DC is the good DC to be your “source” DC for the SYSVOL folder. Then you you stop the NTFRS service on all DCs. Yes, NTFRS must to be stopped on all DCs to perform this. Then set the registry key on the good DC and the bad DC. That’s it. The process will take care of itself and reset the keys back to default after it’s done.

  • If you only have one DC, such as an SBS server, and SYSVOL  appears ok, or restore just the SYSVOL from a backup. Then just follow the “Specific” steps I’ve outlined below.
  • If more than one DC, but not that many where you can’t shutdown the NTFRS on all of them, such as if you have 40 DCs, pick and choose the best one and set Burflags to D2 on the bad and D4 on the good.
  • If there are numerous DCs, such as a large infrastructure, simply run dcpromo /forcedemote the DC with the error, run a metadata cleanup, then re-promote to a DC back into the domain. If you unplug the DC and run a metadata cleanup, then you will have to rebuild the DC from scratch. The forcedemote switch removes the AD binaries off the machine allowing you to re-promote it.


To summarize:

You have two choices as to a restore from a good DC using FRS:

  1. D2 is set on the bad DC: Non-Authoritative restore: Use the D2 option on the DC with the empty SYSVOL folder, or the SYSVOL folder with the incorrect data. This way it will get a copy of the current SYSVOL and other folders from the good DC that you set the BurFlags D4 option on.
  2. D4 is set on the good DC: Authoritative restore: Use the BurFlags D4 option on the DC that has a copy of the current policies and scripts folder (a good, not corrupted folder).


The BurFlags option – D4 or D2? What do I use?

The steps refer to changing a registry setting called the BurFlags value. If the BurFlags key does not exist, simply create it. It’s a DWORD key.

More importantly, it references change the BurFlags to one of two options: D4 or D2. Therefore, before going further, I would like to squelch the confusion on what the D2 and D4 settings mean:

D2/D4 – Which is which?

  • D2, also known as a Nonauthoritative mode restore – this gets set on the DC with the bad or corrupted SYSVOL
  • D4, also known as an Authoritative mode restore – use this on the DC with the good copy of SYSVOL.
  • You must shut the NTFRS service down on ALL DCs while you’re doing this until instructed to start it.
  • You’ll probably want to copy the current SYSVOL structure on the good DC to another folder as a backup prior to doing this.

The D2 option on the bad DC will do two things:

  1. Copies the current stuff in the SYSVOL folder and puts it in a folder called “Pre-existing.” That folder is exactly what it says it is, it is your current data. This way if you have to revert back to it, you can use the data in this folder.
  2. Then it replicates (copies) good data from the GOOD DC (D4) to the bad guy (D2).

Once again, simply put:

  • The BurFlags D4 setting is “the Source DC” that you want to copy its good SYSVOL folder from, to the bad DC.
  • The bad DC BurFlags is set to D2, which tells it to pull from the source DC, the one you set D4 on.


Here are the steps summarized:

  1. For an Authoritative Restore you must stop the NTFRS services on all of your DCs
  2. In the registry location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process
    1. Set the BurFlags setting to HEX “D4” on a known DC that has a good SYSVOL (or at this time restore SYSVOL data from backup then set the Burflag to D4)
    2. Then start NTFRS on this  server.
    3. You may want to rename the old folders with .old extensions prior to restoring good data.
  3. Clean up the folders on all the remaining servers (Policies, Scripts, etc) – renamed them with .old extensions.
  4. Set the BurFlags to D2 on all remaining servers and then start NTFRS.
  5. Wait for FRS to replicate.
  6. Clean up the .old stuff if things look good.
  7. If the “D4” won’t solve the problem try the “D2” value.


So circling back, to fix this and make it work, just copy the contents of SYSVOL to another location, then follow the KB, which simply states you must stop the NTFR service on ALL DCs. Then pick a good one to be the “Source DC.”

Of course, as I’ve stated above, if you have a large number of DCs, the best bet is to forcedemote the bad DC, run a metadata cleanup to remove its reference from AD, then re-promote it.

If you have a small number of DCs, and if you have a good DC and a bad DC, on the good DC, you would set the BurFlags to D4, and on the BAD DC you would set the Burflags to D2.

Example run:

In the example below, if you set BurFlags to D4 on a single domain controller and set BurFlags to D2 on all other domain controllers in that domain, you can rebuild the SYSVOL from the D4 DC (the source DC).

I’ve also heard of admins manually copying the SYSVOL folder, then set the BurFlags options as mentioned, which works too. But no, I haven’t tested it. That would be for a lab on another day. 🙂

Authoritative Restore Example

Use the BurFlags D4 option on the DC that has a copy of the current policies and scripts folder (a good, not corrupted folder).

  1. Stop the FRS service on all DCs. To do this to all DCs from one DC, you can download PSEXEC and run “psexec \\otherDC net stop ntfrs” one at a time for each DC.
  2. On a good DC that you want to be the source, run regedit and go to the following key:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
    In the right pane, double-click “BurFlags.” (or Rt-click, Edit DWORD)
       Type D4 and then click OK.
  3. On the bad DC, run regedit and go to the following key:   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
       In the right pane, double-click “BurFlags.” (or Rt-click, Edit DWORD)
       Type D2 and then click OK.
  4. Quit Registry Editor, and then switch to the Command Prompt (which you still have opened).
  5. On the good DC, start the FRS service, or in a command prompt, type in “net start ntfrs” and hit <enter>
  6. On the bad DC, start the FRS service, or in a command prompt, type in “net start ntfrs” and hit <enter>
  7. On the bad DC, check the Sysvol folder to see if it started populating.
  8. Check for EventID 13565 which shows the process started
  9. Check for EventID 13516, which shows it’s complete
  10. Start FRS on the other DCs.

The following occurs after running the steps above after you start the FRS service (NTFRS):

  • The value for BurFlags registry key returns to 0.
  • Files in the reinitialized FRS folders are moved to a <var>Pre-existing</var> folder.
  • An event 13565 is logged to signal that a nonauthoritative restore is started.
  • The FRS database is rebuilt.
  • The member replicates (copies) the SYSVOL folder from the GOOD DC.
  • The reinitialized computer runs a full replication of the affected replica sets when the relevant replication schedule begins.
  • When the process is complete, an event 13516 is logged to signal that FRS is operational. If the event is not logged, there is a problem with the FRS configuration.
    Note: The placement of files in the <var>Pre-existing</var> folder on reinitialized members is a safeguard in FRS designed to prevent accidental data loss. You can copy this stuff back if it didn’t work, but I have not yet seen when this has not worked!


I hope this helps cleaning up your FRS and SYSVOL replication issues.

Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP – Directory Services
Complete List of Technical Blogs:

This blog is provided AS-IS with no warranties or guarantees and confers no rights.

Why do we ask for an ipconfig /all, when we try to help diagnose AD issues?

Ace Fekay, MCT, MVP, MCSE 2012/Cloud, MCITP EA, MCTS Windows 2008/R2, Exchange 2007 & 2010, Exchange 2010 Enterprise Administrator, MCSE 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP: Directory Services
Active Directory, Exchange and Windows Infrastructure Engineer

Ace here again. Yea, I had to post a blog about this because many people ask, why do you want that? Just for the IP address??

Nope. Not just for the IP.

Good question.

There is quite a bit of information that an ipconfig /all provides us configuration data as a precursor for a diagnosis. Sometimes the ipconfig /all results will help us fix it, but not always.

Many admins are reluctant to provide this sort of information citing security reasons.

In some cases, I sympathize and agree, but in many cases, security really isn’t much of a concern, because for one, your internal IP range is a private range, and two, you can substitute your actual internal domain name with something more generic, such as substituting “microsoft.local” with “mydomain.local. You should also substitute your DC names using something generic, such as dc-01. dc-02, etc. But definitely keep track of the substituted DC names if we have additional questions regarding them.

Let’s take a look at each value in an ipconfig /all

Believe it or not, the results of an ipconfig /all has numerous information that helps us get an inside view of a DC’s basic network configuration, as well as basic service configuration.

Let’s break it down:

C:\>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : company-dc-01  

  • Name is under 15 characters – good for NetBIOS compatibility. Not a huge concern for many compani
  • Possibly indicates more than one DC based on the –01 portion of the name

Primary Dns Suffix  . . . . . . . : 

  • The AD DNS Domain name is not a single label name.
  • In some cases, we’ll also ask for the name in ADUC. If the name in ADUC does no match this name, then it’s a Disjointed Namespace condition).
  • Node Type . . . . . . . . . . . . : Hybrid   

    • If Hybrid is set, it tells me that WINS is in use.
    • Hybrid mode, specifically 0x8 (as you would set a WINS server Hybrid mode in DHCP Option 046), tells the client side resolver to use WINS first when attempting to resolve a single name query, and if it can’t resolve it, to then try a broadcast to resolve it. Of course, this is only after DNS resolution fails, since DNS is used first anyway, where the client side resolver will suffix the Search Suffix when attempting to resolve it as a DNS hostname query.
    • If the Node Type is set to “Unknown,” then no big deal. It just means that WINS is not being used, and the resolver service will use broadcast for a  single name resolution.
    • IP Routing Enabled. . . . . . . . : No

      • Means RRAS is not installed
      • If set to Yes, it means RRAS is installed, and it will interfere with AD communications on this DC. 

      WINS Proxy Enabled. . . . . . . . : No  

      • On a DC, “No” is what we want to see.
      • If set to Yes, then it means “Enable broadcast name resolution” is checked under General tab in RRAS properties.
        • If this is set to Yes, and there is only one NIC. it could mean either:
        • RRAS is installed only for VPN use
        • RRAS was disabled, but the setting stuck
      • Either way, if it is set to Yes, it will cause problems with AD communications.

      DNS Suffix Search List. . . . . . :

      • This is what the client side resolver will use when attempting to resolve a single name query. For example, if I run nslookup against a single name such as computer1, the resolver will suffix to it, resulting in a query of
      • If there are multiple domains in the forest, such as a parent and child domain, or multiple child domains, then each domain must be configured with a search suffix for all other domains in order to be able to resolve everything in the forest. This is also true for additional Trees in the forest.
      • The in this example, was devolved from the Primary DNS Suffix.
        • If the Primary DNS suffix has multiple levels, such as, then the resolver will devolve it to show search suffixes of,, and
        • However, if is the parent root domain, if using Windows 2008 or newer, it will only devolve to Windows 2000 and 2003 devolved all levels, which led to some confusion.

      Ethernet adapter Team 1:

      • Obviously this interface is a team.

      Connection-specific DNS Suffix  . :

      • If this is a DHCP client, and DHCP Option 015 is configured with a domain suffix, then it will populate this value. It’s used for a specific interface that gets this configuration, such as if it is a wireless, then that value will populate the wireless connection, but not the wired connection, and will be used as suffix for identification and DNS registration only for that interface, but it is not used as a search suffix.

      Description . . . . . . . . . . . : BASP Virtual Adapter

      • This is the vendor brand name of the adapter

      Physical Address. . . . . . . . . : 00-18-8B-47-F0-D1

      • This is the MAC address of this adapter or Team.

      DHCP Enabled. . . . . . . . . . . : No

      • This means the NIC has a static configuration.

      IP address, mask and subnet

         IP Address. . . . . . . . . . . . :
         Subnet Mask . . . . . . . . . . . :
         Default Gateway . . . . . . . . . :

      • In the above three values, we make sure the IP address and mask are on the same subnet as an ipconfig /all of another machine, if one was provided. You would be surprised how many times we’ve seen subnets mis-configured with an incorrect subnet mask. 

      DNS Servers . . . . . . . . . . . :

      • What we look for with DNS address, is only to specify the internal DNS servers hosting the AD zone. If an external DNS addresses are specified, or your router’s DNS address is specified (for example,, then you should expect to see numerous problems. This is because your machine is sending the external DNS servers or your router a query whenever it tries to login, authenticate, find domain resources, etc. The external DNS servers or your router, does not have an answer when queried for internal resources. It’s the same as me asking the first person I see walking by out front of my house, “Where’s that beer that was in my refrigerator last night?” Besides the person not having an answer, he’ll probably give me a funny or dirty look. Your DNS server and DC won’t give you a funny look, but you’ll probably get some sort of error and your machine will fail to find your AD domain.
      • The addresses you see listed in this example are showing that it is pointing to a partner DC as the first entry, and itself as the second entry.
        • You may also find in some configuration the loopback as the second entry. This is ok, too. DCPROMO puts in the loopback. Matter of fact, if you were to run the AD BPA, one of the things it looks for is the loopback as the second entry. You can leave it there if you like, or you can change it to the IP of itself, but if you do, just ignore the BPA’s warnings, if you were to run it again.

      Primary WINS Server . . . . . . . :

      • This tells me the server is running WINS. Why? Because it is pointing to itself, as it should be for a WINS server.
      • If a WINS server is pointing to any other WINS servers, it will cause numerous problems with WINS record ownership.

      NetBIOS over Tcpip. . . . . . . . : Enabled

      • Of course this one is obvious. But here’s one for you. If you have NetBIOS disabled, but you are using WINS, what’s the point??

      Active Directory FSMO Roles Explained

      Original Publication 1/16/2011
      Updated 11/20/2014
      by Ace Fekay

      Ace here again. I’ve updated this blog to just clean it up a bit, but as for the technical information about FSMOs, not much as changed. If you see anything that you feel is inaccurate, by all means please contact me.


      This blog contains some quoted material from the Microsoft Official Curriculum (MOC) 6425B Course

      Course 6425C: Configuring and Troubleshooting Windows Server 2008 R2 Active Directory Domain Services

      If interested in taking this course, please see the following link to find a training center near you:

      Find Microsoft Training

      Key Points

      In any replicated database, some changes must be performed by one and only one replica because they are impractical to perform in a multimaster fashion.

      Active Directory is no exception. A limited number of operations are not permitted to
      occur at different places at the same time and must be the responsibility of only
      one domain controller in a domain or forest. These operations, and the domain
      controllers that perform them, are referred to by a variety of terms:

      • Operations masters
      • Operations master roles
      • Single master roles
      • Operations tokens
      • Flexible single master operations (FSMOs)

      Regardless of the term used, the idea is the same. One domain controller performs
      a function, and while it does, no other domain controller performs that function.

      All Active Directory domain controllers are capable of performing single master
      operations. The domain controller that actually performs a single master operation is the
      domain controller that currently holds the operation’s token, or the “role holder.”.

      An operation token, and thus the role, can be transferred easily to another domain
      controller without a reboot.

      To reduce the risk of single points of failure, the operations tokens can be
      distributed among multiple DCs.

      AD DS contains five operations master roles. Two roles are performed for the
      entire forest, and two roles are performed by three roles for each domain.

      Forest Roles (two roles):

      • Domain naming
      • Schema

      Domain Roles (three roles):

      • Relative identifier (RID)
      • Infrastructure
      • PDC Emulator

      In a forest with a single domain, there are, therefore, five operations masters. In a forest with two domains, there are eight operations masters because the three domain master roles are implemented separately in each of the two domains.

      Forest-Wide Operations Master Roles

      The schema master and the domain naming master must be unique in the forest.
      Each role is performed by only one domain controller in the entire forest.

      Domain Naming Master Role:

      The domain naming role is used when adding or removing domains in the forest. When you add or remove a domain, the domain naming master must beaccessible, or the operation will fail.

      Schema Master Role:

      The domain controller holding the schema master role is responsible for making any changes to the forest’s schema. All other DCs hold read-only replicas of the schema. If you want to modify the schema or install an application that modifies the schema, it is recommended you do so on the domain controller holding the schema master role. Otherwise, changes you request must be sent to the schema master to be written into the schema.

      Domain-Wide Operations Master Roles

      Each domain maintains three single master operations: RID, Infrastructure, and PDC Emulator. Each role is performed by only one domain controller in the domain.

      RID Master Role

      The RID master plays an integral part in the generation of security identifiers
      (SIDs) for security principals such as users, groups, and computers. The SID of a
      security principal must be unique. Because any domain controller can create
      accounts, and therefore, SIDs, a mechanism is necessary to ensure that the SIDs
      generated by a DC are unique. Active Directory domain controllers generate SIDs
      by assigning a unique RID to the domain SID. The RID master for the domain
      allocates pools of unique RIDs to each domain controller in the domain. Thus,
      each domain controller can be confident that the SIDs it generates are unique.


      The RID master role is like DHCP for SIDs. If you are familiar with the concept that
      you allocate a scope of IP addresses for the Dynamic Host Configuration Protocol (DHCP) server to assign to clients, you can draw a parallel to the RID master, which allocates pools of RIDs to domain controllers for the creation of SIDs.

      Infrastructure Master Role

      In a multidomain environment, it’s common for an object to reference objects in other domains. For example, a group can include members from another domain.

      Its multivalued member attribute contains the distinguished names of each
      member. If the member in the other domain is moved or renamed, the infrastructure master of the group’s domain updates the group’s member attribute accordingly.

      Note: The infrastructure master. You can think of the infrastructure master as a tracking device for group members from other domains. When those members are renamed or moved in the other domain, the infrastructure master identifies the change and makes appropriate changes to group memberships so that the memberships are kept up to date.

      Also note: This role only pertains in a multi-domain forest. The infrastructure master if running on the same DC as a GC, will conflict and cause the infrastructure master role to fail its intended purpose. One way to eliminate any issues with the Infrastructure Master Role & GC conflict is to simply make all DCs a GC. More info on this can be found in the following link:

      Global Catalog and FSMO Infrastructure Master Relationship

      PDC Emulator Role

      The PDC Emulator role performs multiple, crucial functions for a domain:

      • Emulates a Primary Domain Controller (PDC) for backward compatibility
      In the days of Windows NT® 4.0 domains, only the PDC could make changes
      to the directory. Previous tools, utilities, and clients written to support
      Windows NT 4.0 are unaware that all Active Directory domain controllers can
      write to the directory, so such tools request a connection to the PDC. The
      domain controller with the PDC emulator role registers itself as a PDC so that
      down-level applications can locate a writable domain controller. Such
      applications are less common now that Active Directory is nearly 10 years old,
      and if your enterprise includes such applications, work to upgrade them for
      full Active Directory compatibility.

      • Participates in special password update handling for the domain
      When a user’s password is reset or changed, the domain controller that makes
      the change replicates the change immediately to the PDC emulator. This
      special replication ensures that the domain controllers know about the new
      password as quickly as possible. If a user attempts to log on immediately after
      changing passwords, the domain controller responding to the user’s logon
      request might not know about the new password. Before it rejects the logon
      attempt, that domain controller forwards the authentication request to a PDC
      emulator, which verifies that the new password is correct and instructs the
      domain controller to accept the logon request. This function means that any
      time a user enters an incorrect password, the authentication is forwarded to
      the PDC emulator for a second opinion. The PDC emulator, therefore, should
      be highly accessible to all clients in the domain. It should be a well-connected,
      high-performance DC.

      • Manages Group Policy updates within a domain
      If a Group Policy object (GPO) is modified on two DCs at approximately the
      same time, there could be conflicts between the two versions that could not be
      reconciled as the GPO replicates. To avoid this situation, the PDC emulator
      acts as the focal point for all Group Policy changes. When you open a GPO in
      the Group Policy Management Editor (GPME), the GPME binds to the domain
      controller performing the PDC emulator role. Therefore, all changes to GPOs
      are made on the PDC emulator by default.

      • Provides a master time source for the domain
      Active Directory, Kerberos, File Replication Service (FRS), and DFS-R each rely
      on timestamps, so synchronizing the time across all systems in a domain is
      crucial. The PDC emulator in the forest root domain is the time master for the
      entire forest, by default. The PDC emulator in each domain synchronizes its
      time with the forest root PDC emulator. Other domain controllers in the
      domain synchronize their clocks against that domain’s PDC emulator. All
      other domain members synchronize their time with their preferred domain
      controller. This hierarchical structure of time synchronization, all implemented
      through the Win32Time service, ensures consistency of time. Universal
      Coordinated Time (UTC) is synchronized, and the time displayed to users is
      adjusted based on the time zone setting of the computer.

      Note: Change the time service only one way. It is highly recommended to allow Windows to maintain its native, default time synchronization mechanisms. The only change you should make is to configure the PDC emulator of the forest root domain to synchronize with an extra time source. If you do not specify a time source for the PDC emulator, the System event log will contain errors reminding you to do so. See the following link and the articles it refers to, for more information.

      Configure the Windows Time service on the PDC emulator in the Forest Root Domain

      Configuring the Windows Time Service – A step by step with a Contingency Plan – This is a procedure I put together for an enterprise.

      Configuring the Windows Time Service for Windows Server, explanation of the time service hierarchy, and more

      Acts as the domain master browser
      When you open Network in Windows, you see a list of workgroups and
      domains, and when you open a workgroup or domain, you see a list of
      computers. These two lists, called browse lists, are created by the Browser
      service. In each network segment, a master browser creates the browse list: the
      lists of workgroups, domains, and servers in that segment. The domain master
      browser serves to merge the lists of each master browser so that browse clients
      can retrieve a comprehensive browse list.

      What happens when a FSMO Role Fails

      PDC Emulator failure

      The PDC Emulator is the operations master that will have the most immediate
      impact on normal operations and on users if it becomes unavailable. Fortunately,
      the PDC Emulator role can be seized to another domain controller and then
      transferred back to the original role holder when the system comes back online.

      Infrastructure master failure

      A failure of the infrastructure master will be noticeable to administrators but not to users. Because the master is responsible for updating the names of group members from other domains, it can appear as if group membership is incorrect although, as mentioned earlier in this lesson, membership is not actually affected. You can seize the infrastructure master role to another domain controller and then transfer it back to the previous role holder when that system comes online.

      RID master failure

      A failed RID master will eventually prevent domain controllers from creating new
      SIDs and, therefore, will prevent you from creating new accounts for users, groups,
      or computers. However, domain controllers receive a sizable pool of RIDs from the
      RID master, so unless you are generating numerous new accounts, you can often
      go for some time without the RID master online while it is being repaired. Seizing
      this role to another domain controller is a significant action. After the RID master
      role has been seized, the domain controller that had been performing the role
      cannot be brought back online.

      Schema master failure

      The schema master role is necessary only when schema modifications are being
      made, either directly by an administrator or by installing an Active Directory
      integrated application that changes the schema. At other times, the role is not
      necessary. It can remain offline indefinitely until schema changes are necessary.
      Seizing this role to another domain controller is a significant action. After the
      schema master role has been seized, the domain controller that had been
      performing the role cannot be brought back online.

      Domain naming master failure

      The domain naming master role is necessary only when you add a domain to the
      forest or remove a domain from a forest. Until such changes are required to your
      domain infrastructure, the domain naming master role can remain offline for an
      indefinite period of time. Seizing this role to another domain controller is a
      significant action. After the domain naming master role has been seized, the
      domain controller that had been performing the role cannot be brought back

      Recovering from FSMO Role Failures

      There are a number of steps that must be performed if any of the FSMO roles fail, and keep in mind, it’s not just based
      on the FSMO role failure itself, rather you must also take into account the DC, too, because it usually means the DC itself
      has failed, therefore the DC failure must be addressed.

      If a DC fails, then you must address the DC failure as a whole, and not just the FSMO roles. This is because the DC’s account is referenced in the AD database by other DCs, and it expects it to be there to contribute and work with replication, among other AD functions. Therefore you must clean out the DC’s reference from the AD database, which also includes seizing the roles it held to other DCs.

      This also includes the services a specific FSMO role held, such as the Time Service. This service runs on the PDC Emulator and must be moved to the new PDC Emulator you are seizing the role to.

      For more information, with a complete and specific step by step, including any services the DC held which was FSMO role specific, please see the following article for more information:

      Complete Step by Step to Remove an Orphaned Domain controller

      Monitoring DCs for failures

      Microsoft Monitoring Products

      There are a number of tools to monitor your domain controllers from native Windows event logs, to using SCOM.

      System Center Operations Manager 2007 (SCOM) – Platform MonitoringOct 6, 2010 … Take advantage of System Center Operations Manager 2007 for cross-platform monitoring, beta software and management packs.

      To learn how to use SCOM, Microsoft has a specific course just for this product. For more information on the course, please see:

      Microsoft Official Curriculum Course 50028B:
      Installing and Configuring System Center Operations Manager 2007

      Third Party Monitoring Tools

      There are also numerous third party monitoring utilities available such as the following list:

      Quest – Windows Management Solutions – Trust the Experts for Simplified Windows Management

      Network Monitor Software and Windows Development ToolsNetwork Monitor Tool site – Network Monitoring Tools for Windows, Linux, Unix and Novell.

      NetVision Audit for Active Directory – Monitoring Active Directory – Active Directory Reports – Easy Audit Reporting and Real-Time Monitoring

      Windows Monitoring, Windows Server Monitoring, Windows Application …Download Windows monitoring tool for Windows server monitoring, IIS Server, . … Monitor Windows CPU, disk, process monitoring, memory and ensure high …

      Windows Server Monitoring and Windows Event Log Management SoftwareDevelopers of Windows administration tools that monitor in real-time system performance, security logs, and event logs, and send automated, user-defined …

      Nagios Core – Monitoring Windows Machines:

      Network Management Software | Server Monitoring | WhatsUp GoldWhatsUp Gold is an award-winning network monitoring software, managing over 100000 networks worldwide. Download trials & free tools now!

      Comments, suggestions and corrections are welcomed!



      I hope this helps!

      Original Publication Date: 11/1/2011
      Updated 11/4/2014

      Ace Fekay
      MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
      Microsoft Certified Trainer
      Microsoft MVP – Directory Services

      clip_image00262[2] clip_image00462[2] clip_image00662[2] clip_image00862[2] clip_image01062[2] clip_image01262[2] clip_image01462[2]

      Complete List of Technical Blogs:

      This posting is provided AS-IS with no warranties or guarantees and confers no rights.