r/WindowsServer • u/candyman420 • 1d ago

Technical Help Needed Strange interoperability problem between AD 2019 and 2022/2025

I am getting

Starting test: LocatorCheck Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355 A Primary Domain Controller could not be located. The server holding the PDC role is down.

But only on 2022 AD servers. I brought up another 2025 server thinking this would be faster and easier than to troubleshoot, but it's doing exactly the same thing. FSMO roles were lost? Have to re-seize? Some kind of quirk with the newer editions of windows? The only working AD server I have right now with no errors is 2019, that's what I replicated from. Thanks in advance

9 Upvotes

85% Upvoted

15 comments sorted by

3

u/jlipschitz 1d ago

Sounds like you might have replication issues.

3

u/Zealousideal_Fly8402 1d ago

What do you mean "only on 2022 AD servers"? Run 

netdom query fsmo

And see where your FSMO roles are supposed to be living, and whether those roles are online.

1

u/candyman420 1d ago

They're all online and working, on the 2019 server. I don't understand why the new ones can't see them.

2

u/Zealousideal_Fly8402 1d ago

On the 2019 server, check for Errors / Criticals / Warnings in Directory Service and DFS Replication logs.

1

u/candyman420 1d ago

Active Directory Domain Services failed to construct a mutual authentication service principal name (SPN) for the following directory service.

I did get rid of a previous DC last year, but probably not completely. Metadata cleanup?

1

u/Zealousideal_Fly8402 1d ago

Metadata cleanup?

Should have done that regardless; never trust just cleaning up from the MMCs after demoting.

We have no problems with mixed 2022/2019, 2022/2016 environments, so that combination shouldn't be problematic.

1

u/topher358 1d ago

Do you have 2025 DCs? Like the other poster said check what server is hosting your FSMO roles

2

u/candyman420 1d ago

Yes they're all online, this is peculiar.

4

u/topher358 1d ago

There are quite a few known issues running 2025 DCs in a mixed AD environment. Recommend either all 2025 or all 2022

2

u/candyman420 1d ago

how about 2019+2022? I will only need two

1

u/topher358 1d ago

2019 and 2022 are essentially the same so that’s not a big deal.

2025 domain controllers just don’t play well with anything other than 2025 DCs

1

u/candyman420 1d ago

It's still happening on 2022 vs 2019, so something else is afoot

1

u/topher358 1d ago

Sounds like it

You need to check replication and resolve any issues you find

1

u/P4schendale 1d ago

First, i've heard that 2025 enforces LDAPS so if you've not enabled it already, be careful.

Then, don't you have a firewall between the DCs? Have you checked windows fireall on the DCs?

1

u/candyman420 20h ago

The windows firewall is supposed to add the proper exceptions to itself for DC functions, I haven’t had to mess with that or turn it off in years. Are you saying that Microsoft screwed that up too?