Secure channel lost - ERROR_NO_LOGON_SERVERS

Giorgio Busoni 1

Hi,
I have a single production server with several VM running. 2 VM are DC, there are other VM for other services, and one VM actus as a router between internal network and extenal, with 2 ethernet connections, running RRAS and DHCP server.
I have communication problems between this machine and the DCs. One month ago I had to de-join and re-join it to the domain, because it lost the secure channel and the DHCP stopped working. To add it back to the domain, I had to disable the external network connection, otherwise it would give error. After disableing the external connection, it joined, and I re-enabled the external connection. However, it looks like that when the external connection is enabled, it is unable to communicate with DCs.
When I try to run "nltest /query" the error "1311 0x51f ERROR_NO_LOGON_SERVERS"

I should mention that time ago the network had a second site, with 2 DC there as well, and that this machine was running a site to site VPN. Later on we had a machine failure on the other site, and the site was abandoned, had to remove the 2 DCs with nsutil. SO it might be that it is trying to connect to those DCs, even if they have been removed from AD, and even though its IP is on the local site?

Anonymous

2022-09-12T01:00:04.387+00:00

So the only issue is the router VM? Why does router VM need to be domain joined?
Giorgio Busoni 1 Reputation point

2022-09-12T01:31:40.84+00:00

yes, only that VM, and only recently, cause it worked well for 6+ years. The router is domain joined cause it's also running DHCP and VPN server

5 answers

Anonymous

2022-09-12T01:35:46.343+00:00

Simplest solution may be to stand up a new one for replacement.
Please sign in to rate this answer.
Anonymous

2022-09-12T12:40:37.737+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Giorgio Busoni 1 Reputation point

2022-09-12T13:05:33.677+00:00

well I was hoping to try to fix the problem rather than replacing the machine, that requires quite some time
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Anonymous

2022-09-12T13:10:30.423+00:00

Its a virtual machine right? Replacing it seems like the simplest / quickest solution. Having a single windows instance that does VPN, the routing role and DHCP server may be problematic. If you can't stand up a new one (or more) for replacement then I'd suggest starting a case here with product support.
https://support.microsoft.com/hub/4343728/support-for-business

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Anonymous

2022-09-17T13:21:39.373+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--

Giorgio Busoni 1 Reputation point

2022-09-19T03:05:54.253+00:00

Hi,
What would be the suggested configuration? Is running router on one machine and VPN+DHCP on another better?
I am actually dismissing the VM with the WSUS server, so I could move there the DHCP and VPN, and leave the router maschine unjoined. But, I think that to be able to move the DHCP I will need to rejoin the machine, at least for some time, right?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Limitless Technology 39,591

Hello there,

Check the port requirements, Active Directory and Active Directory Domain Services Port Requirements

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd772723(v=ws.10)?redirectedfrom=MSDN

It would be great if you can share the output for ipconfig /all and dcdiag /v.

This issue could also occur because the Netlogon secure channel is a special case for RPC Endpoint Mapper. It can be used to authenticate RPC Endpoint Mapper itself. In some cases, the Netlogon secure channel is not honored, and this causes a deadlock that takes time to resolve.

You can look into this article https://support.microsoft.com/en-us/topic/lost-secure-channel-takes-a-long-time-to-be-reestablished-when-rpc-endpoint-mapper-is-secured-on-windows-server-2012-domain-controllers-c0f84698-91a1-aa4f-f211-d7f735e60ee3

I hope this information helps. If you have any questions please let me know and I will be glad to help you out.

-------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

Giorgio Busoni 1 Reputation point

2022-09-19T03:29:42.863+00:00
Hi, thanks for your reply. The thing that I do not understand is that, the configuration, as I said, has been working for so many years, and nobody changed anything, so my guess would be some update broke something.

Regarding the ports, that articles cites DC to DC connections, not client to DC? And refers to windows 2003/2008/2012? Is it ok? Anyway, the windows firewall on the router machine is set as
Domain network: protected network connections - internal connection is unckecked, externa connection is checked)
Public network: protected network connections - both connections are checked
So, as the internal connection is in the domain, it should basically have the firewall disabled, right?
Looking at the network center, indeed it lists the internal connection as domain, and the external connection as public (not authenticate). I am not sure what the (not authenticated) means in this case.
In any case, the domain profile basically allows all windows services, while the public profile explicitly blocks nearly everything

Regarding the output of those commands, I am having trouble trying to transfer the output of the command from the affected machine (looks like it is unable to connect to any windows share on the network...is this a symptom of the problem?), but here is the output of the DC

dcdiag /v

in the attachment due to message size limitation

Giorgio Busoni 1

ipconfig /all (on DC)  
  
Configurazione IP di Windows  
  
   Nome host . . . . . . . . . . . . . . : DC1  
   Suffisso DNS primario . . . . . . . . : busoni.local  
   Tipo nodo . . . . . . . . . . . . . . : Ibrido  
   Routing IP abilitato. . . . . . . . . : No  
   Proxy WINS abilitato . . . . . . . .  : No  
   Elenco di ricerca suffissi DNS. . . . : busoni.local  
  
Scheda Ethernet Ethernet:  
  
   Suffisso DNS specifico per connessione: busoni.local  
   Descrizione . . . . . . . . . . . . . : Scheda di rete Hyper-V Microsoft  
   Indirizzo fisico. . . . . . . . . . . : 00-15-5D-01-27-00  
   DHCP abilitato. . . . . . . . . . . . : No  
   Configurazione automatica abilitata   : S   
   Indirizzo IPv4. . . . . . . . . . . . : 192.168.1.200(Preferenziale)   
   Subnet mask . . . . . . . . . . . . . : 255.255.255.0  
   Gateway predefinito . . . . . . . . . : 192.168.1.1  
   Server DNS . . . . . . . . . . . . .  : 192.168.1.200  
                                           192.168.1.201  
   Server WINS primario . . . . . . . .  : 192.168.1.1  
   NetBIOS su TCP/IP . . . . . . . . . . : Attivato

Giorgio Busoni 1

Please note the the errors in the log related to replication relate to the old DCs in the dismissed site that were recently removed, in the hope to fix this problem. Replication is indeed working well

repadmin /showreps  
Livorno\DC1  
  
Opzioni DSA: IS_GC   
  
Opzioni sito: (none)  
  
GUID oggetto DSA: XXX  
  
ID chiamata DSA: XXX  
  
  
  
==== ROUTER ADIACENTI IN INGRESSO ==============================  
  
  
  
DC=busoni,DC=local  
  
    Livorno\DC3 tramite RPC  
  
        GUID oggetto DSA: XXX  
  
        Ultimo tentativo in data 2022-09-19 04:12:42 riuscito.  
  
  
  
CN=Configuration,DC=busoni,DC=local  
  
    Livorno\DC3 tramite RPC  
  
        GUID oggetto DSA: XXX  
  
        Ultimo tentativo in data 2022-09-19 03:51:32 riuscito.[242240-dcdiag.txt][1]  
  
  
  
CN=Schema,CN=Configuration,DC=busoni,DC=local  
  
    Livorno\DC3 tramite RPC  
  
        GUID oggetto DSA: XXX  
  
        Ultimo tentativo in data 2022-09-19 03:51:32 riuscito.  
  
  
  
DC=DomainDnsZones,DC=busoni,DC=local  
  
    Livorno\DC3 tramite RPC  
  
        GUID oggetto DSA: XXX  
  
        Ultimo tentativo in data 2022-09-19 03:51:32 riuscito.  
  
  
  
DC=ForestDnsZones,DC=busoni,DC=local  
  
    Livorno\DC3 tramite RPC  
  
        GUID oggetto DSA: XXX  
  
        Ultimo tentativo in data 2022-09-19 04:11:54 riuscito.

Giorgio Busoni 1

 ipconfig /all (router VM, copied by hand)  
      
  
Configurazione IP di Windows  
  
   Nome host . . . . . . . . . . . . . . : GATE1  
   Suffisso DNS primario . . . . . . . . : busoni.local  
   Tipo nodo . . . . . . . . . . . . . . : Ibrido  
   Routing IP abilitato. . . . . . . . . : S  
   Proxy WINS abilitato . . . . . . . .  : No  
   Elenco di ricerca suffissi DNS. . . . : busoni.local  
  
Scheda Ethernet Ethernet INT:  
  
   Suffisso DNS specifico per connessione: busoni.local  
   Descrizione . . . . . . . . . . . . . : Scheda di rete Hyper-V Microsoft #2  
   Indirizzo fisico. . . . . . . . . . . : 00-15-5D-01-27-03  
   DHCP abilitato. . . . . . . . . . . . : No  
   Configurazione automatica abilitata   : Si  
   Indirizzo IPv4. . . . . . . . . . . . : 192.168.1.1(Preferenziale)   
   Subnet mask . . . . . . . . . . . . . : 255.255.255.0  
   Gateway predefinito . . . . . . . . . :   
   Server DNS . . . . . . . . . . . . .  : 192.168.1.200  
                                           192.168.1.201  
   Server WINS primario . . . . . . . .  : 192.168.1.200  
   NetBIOS su TCP/IP . . . . . . . . . . : Attivato

continues in next post

Giorgio Busoni 1

Scheda Ethernet Ethernet EXT:  
  
   Suffisso DNS specifico per connessione: busoni.local  
   Descrizione . . . . . . . . . . . . . : Scheda di rete Hyper-V Microsoft  
   Indirizzo fisico. . . . . . . . . . . : 00-15-5D-01-27-04  
   DHCP abilitato. . . . . . . . . . . . : No  
   Configurazione automatica abilitata   : Si  
   Indirizzo IPv4. . . . . . . . . . . . : 192.168.0.3(Preferenziale)   
   Subnet mask . . . . . . . . . . . . . : 255.255.255.0  
   Gateway predefinito . . . . . . . . . : 192.168.0.254  
   NetBIOS su TCP/IP . . . . . . . . . . : Disattivato

Giorgio Busoni 1 Reputation point

2022-09-19T03:46:37.577+00:00

one thing that I noted by running these commands is the, on the DC< the network connection is shown as unidentified network (public profile)
this should not be an issue, as all other machines are able to conenct, in fact on the DC the public profile is configured to basically allow everything (this was probably a workaround taken time ago for this issue of unidentified network)

Anonymous

2022-09-19T12:34:26.867+00:00

When NLA starts to detect the network location, the machine will contact a domain controller via port 389. If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile.
If the domain was not found or process failed, NLA will let you to determine which firewall profile will be used, private or public.

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Giorgio Busoni 1 Reputation point

2022-09-19T12:40:26.12+00:00

A domain controller does not query himself? And this happens only on boot? Does not try to detect it later on? I have 2 DC on the same host, the DC that boots first will not find any available DC on boot

Anonymous

2022-09-19T12:52:05.407+00:00

Please run;

Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\dc3.txt

then put unzipped text files up on OneDrive and share a link.

Anonymous

2022-09-24T13:23:06.043+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Anonymous

2022-09-19T12:37:17.807+00:00

to be able to move the DHCP I will need to rejoin the machine, at least for some time, right?

You could export / import DHCP scopes via PowerShell.
https://learn.microsoft.com/en-us/powershell/module/dhcpserver/export-dhcpserver?view=windowsserver2022-ps
https://learn.microsoft.com/en-us/powershell/module/dhcpserver/import-dhcpserver?view=windowsserver2022-ps

--please don't forget to upvote and Accept as answer if the reply is helpful--
Please sign in to rate this answer.
Anonymous

2022-09-22T12:50:45.773+00:00

Just checking if there's any progress or updates?

--please don't forget to upvote and Accept as answer if the reply is helpful--
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Secure channel lost - ERROR_NO_LOGON_SERVERS

5 answers

Your answer