I have two 2019 DCs in the domain, and one of them has apparently gone astray. Lots of symptoms, and malfunctions, but I am hopeful that fixing one fixes all. Let's call them Server 1 and 2. Server 1 seems to be the problem child.
On the server manger on either one, under all servers, each reports Kerberos Security error for the other one. Both are Hyper-V instances. However, on Server 1 I cannot run Group Policy - no RPC server even though the service is running, NSLOOKUP can't find server or domain information, and both DHCP and DNS seem to have issues (DHCP has failover configured between the two). DHCP has orange arrow over IPv4 on Server 2, yet it won't allow configuring to add Server 1. On Server 2, Group Policy and NSLOOKUP work fine. On Server 2, access to DHCP & DNS is fine for itself but fails to manage Server 1. On server 1, DNS appears but cannot manage Server 2. DHCP on Server 1 does not have a defined scope although it is supposed to replicate from Server 2.
I ran SETSPF -X on both servers and neither reported a duplicate.
I had backups pf the .vhdx files going back about a month, but restoring them did not fix things.
I also tried demoting Server 1, removing AD, DNS, and DHCP and then leaving the domain all of which seemed to work. However, when I tried reversing that, I was NOT able to rejoin the domain as it could not be found. I had set the DNS server to Server 2 on the NIC for Server 1 but still could not be found.
The other possible symptom is that some W10 machines are throwing off authentication errors, I think. I haven't had time to fully track that down, and I also assume that once I get Server 1 communicating to AD again things will fall into place.
I am at a bit of a loss on what to do now. How can I fix the Kerberos error.? I have some applications installed on Server 1 that have one time license permissions, so starting all over with a new server and just ignoring Server 1 is not a great option.
Thanks to all you gurus in advance.
