Fixing DNS Event ID: 4000 and 4007 “The DNS server was unable to open Active Directory” errors and Exchange ECP / The LDAP Server is unavailable
Recently we had “Patch Monday” – unusual since we usually patch on Fridays (in case something goes wrong we have weekend ahead), but this one time was good opportunity since there was some infrastructure work and we had planed downtime and we took the opportunity to patch.
Unfortunately something went very wrong. First after rebooting one of the Exchange servers I got following error:
Exchange ECP / The LDAP Server is unavailable
“Topology Provider couldn’t find the Microsoft Exchange Active Directory”
In logs event id 2142 MSExchangeADTopology was logged with error “Topology discovery failed”
At first I thought it was a bad patch, but soon after that still unpatched Exchange
reported errors.
Errors obviously point to AD. I looked at domain controller since it also was updated. Immediately after logging onto DC I was greeted with unpleasant surprise.
After opening DNS console “Access Denied” message appeared.
DNS was unreachable.
On DC following events were logged:
Microsoft-Windows-DNS-Server-Service Event ID 4000
The description for Event ID ( 4000 ) in Source ( Microsoft-Windows-DNS-Server-Service ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.
If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding s
Microsoft-Windows-DNS-Server-Service Event ID 4007
The description for Event ID ( 4007 ) in Source ( Microsoft-Windows-DNS-Server-Service ) cannot be found. Either the component that raises this event is not installed on your local computer, or the installation is corrupted. You can install or repair the component on the local computer, or contact the component manufacturer for a newer version.
If the event was saved from another computer or forwarded from a remote computer, you might have to include display information with the events when saving them or when setting up the forwarding
According to Microsoft / https://support.microsoft.com/en-us/help/2751452/dns-zones-do-not-load–event-4000–4007 this happens in two cases:
This happens when that particular DC/DNS server has lost its Secure channel with itself or PDC.
This can also happen in a single DC environment where that DC/DNS server holds all the FSMO roles and is pointing to itself as Primary DNS server.
I’m still not sure why this happened in my case, but here are steps that resolved this problem for me
Stop KDC (Kerberos Key Distribution Center) Service in Service Console on DC that doesn’t work.
Run command prompt with elevated priviledges (as Administrator) and enter following command
netdom resetpwd /server:DC.domain.local /userd:Domain\domain_admin /passwordd:*(change dc.domain.local with fqdn of your DC, and DOMAIN\domain_admin with your domain and admin account)
You will be prompted for the password. Enter domain admin password that you use for that account.
Once command is executed restart the server.
DNS zones after that worked for me and Exchange Servers were fine.