Issues creating Active Directory entries and vservers

[NetappGuy7]

Hi,

Unfortunately, the issues are rather layered. Recently, we started receiving the following message:

CENCOLO-02: None of the LSA servers configured for Vserver X are currently accessible via the network. Run vserver cifs domain discovered-servers show to see the list of discovered servers. Also, check EMS event log to see the possible cause of errors on these servers. Alert Received on: Wed Jul 12 2023 12:14 PM.

We weren't sure how to address this, so we started deleting and recreating the Active Directory entries in order to address this. However, we ran into another issue attempting to do so:

In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient privileges to
add computers to the "OU=Census, OU=Servers" container within the "STATCAN.CA" domain.

Enter the user name: (username)

Enter the password:

Error: Machine account creation procedure failed
[ 0 ms] Trying to create machine account 'X' in
'STATCAN.CA' for Vserver 'X'
**[ 6015] FAILURE: Unable to contact DNS to discover domain
** controllers.
[ 6015] Unable to connect to any (0) domain controllers.
[ 9021] Unable to contact DNS to discover domain controllers.
[ 15031] No servers available for MS_LDAP_AD, vserver: 37, domain:
STATCAN.CA.

Error: command failed: Failed to create the Active Directory machine account "X". Reason: SecD Error: no server available.

It seems to be a DNS issue, and when we checked, we were treated with this:

cencolo::> vserver services name-service dns check -vserver X
Name Server
Vserver Name Server Status Status Details
------------- --------------- ------------ --------------------------
X down Operation timed out.
10.X.X.X
X down Operation timed out.
10.X.X.X
2 entries were displayed.

Please advise!

[Ontapforrum]

Please check the following 2 kbs:

https://kb.netapp.com/onprem/ontap/da/NAS/FAILURE_Unable_to_contact_DNS_to_discover_domain_**_controllers_when_attempting_to_join_a_SVM_to_an_AD_domai...

https://kb.netapp.com/onprem/ontap/da/NAS/How_to_validate_and_update_Vserver_DNS_servers_in_ONTAP

[NetappGuy7]

Good morning

Thank you for the quick response. I've checked the solutions but they didn't solve the issue. 

Running the command suggested gives me this:

vserver services name-service dns check -vserver X Name Server

Vserver Name Server Status Status Details
------------- --------------- ------------ --------------------------
X 10.125.36.10 down Operation timed out.
X 10.125.36.11 down Operation timed out.
2 entries were displayed.

The DNS servers can be pinged... there's nothing wrong with them. But for whatever reason, we're at an impasse 

[Ontapforrum]

The output 'Operation timed out' clearly suggests SVM is unable to talk to DNS servers? When you says DNS server can be pinged ? From where are you pinging it? Could you show us the output.

Also, share the output of the following along with PING :

::> network interface show -vserver <cifs svm> -fields service-policy

::> network route show -vserver <cifs svm>

[NetappGuy7 · Accepted solution]

I apologize for the late reply, but it seems the issue is a result of this: 

SU530: [Impact Critical] NTLM authentication fails due to enforcement of Netlogon RPC sealing (Microsoft CVE-2022-38023) - NetApp Knowledge Base

Thank you very much for your support, but I know what needs to be done now. A software update is in order.

Than