member computer choosing wrong domain controller from another site

hello,

i'm wondering if can me on this,

have "perimeternetwork" site in resides rodc , "default-first-site-name" site in resides 2 rw dc.

there member computer in "permieternetwork" site tries log in wrong dc "default-first-site-name" site,

ethernet adapter ethernet0:

   connection-specific dns suffix  . :
   ipv4 address. . . . . . . . . . . : 10.1.4.251(preferred)
   subnet mask . . . . . . . . . . . : 255.255.255.0
   default gateway . . . . . . . . . : 10.1.4.254
   dns servers . . . . . . . . . . . : 10.1.4.252
   netbios on tcpip. . . . . . . . : enabled

c:\users\a...z>set log
logonserver=\\dc1-dom1 <- wrong rwdc site

seems know site in,

c:\users\a...z>nltest /dsgetdc:a.local /account:dc1-ftp$
           dc: \\dc1-rodom1.a.local  <- rodc in same site, should used.
      address: \\10.1.4.252
     dom guid: f1606cd9-ca71-4828-90cd-b17ae3769bea
     dom name: a.local
  forest name: a.local
 dc site name: perimeternetwork
our site name: perimeternetwork
        flags: gc ds ldap kdc timeserv gtimeserv dns_dc dns_domain dns_forest close_site partial_s
ret ws ds_8 ds_9
command completed successfully

> _ldap._tcp.perimeternetwork._sites.dc._msdcs.a.local
server:  dc1-rodom1.a.local
address:  10.1.4.252

nslookup shows,

_ldap._tcp.perimeternetwork._sites.dc._msdcs.a.local srv service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc1-rodom1.a.local
dc1-rodom1.a.local   internet address = 10.1.4.252
>


under "perimeternetwork._sites.forestdnszones.a.local" there of dcs, i'm not sure it's ok!?

> _ldap._tcp.perimeternetwork._sites.forestdnszones.a.local
server:  dc1-rodom1.a.local
address:  10.1.4.252

_ldap._tcp.perimeternetwork._sites.forestdnszones.a.local    srv service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc1-dom2.a.local
_ldap._tcp.perimeternetwork._sites.forestdnszones.a.local    srv service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc1-dom1.a.local
_ldap._tcp.perimeternetwork._sites.forestdnszones.a.local    srv service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = dc1-rodom1.a.local
dc1-dom2.a.local     internet address = 10.1.3.250
dc1-dom1.a.local     internet address = 10.1.3.251
dc1-rodom1.a.local   internet address = 10.1.4.252
> _ldap._tcp.perimeternetwork._sites.dc._msdcs.a.local
server:  dc1-rodom1.a.local
address:  10.1.4.252

somehow can log in member computer, there ftp service running on not authenticate users.

appreciated!

hi; may not have issue @ all.  please ensure client's preferred dns server in nic tcp/ip properties points @ rodc in it's site, if rodc running dns.  regardless of whether remote site dc runs dns or not, please reboot problematic remote site client once more , check "set log" result again.  this bit of legacy command, needs "extra" reboot or 2 purge old dc name , "catch up" current name.  the more exact way check dc authenticated client check kerberos cache.  if client system windows 10, "called kdc" @ bottom of each kerberos ticket tell dc authenticated it.  one of tickets 1 allowed logon client machine.  you can check kerberos cache command:  

klist tickets

if infrastructure correct, after client machine reboot or two, "set log" result correlate "klist tickets" command result, latter being more accurate command kerberos default authentication protocol in active directory.  additionally, forestdnszones should return writeable active directory domain controllers running dns service, regardless of ad site location.

---

best regards, todd heron | active directory consultant

Windows Server  >  Directory Services