AD DC - Group Policy Event ID 1055

Question

I have a lot of event ids 1055 and others with a red mark in event viewer on a Windows 2008R2 Server configured as a DC (MyDC1.lan)

I ran a portqueryui and it tells me that the following ports are not listening and returns error code :

UDP Port 88        kerberos service
UDP Port 137     netbios-ns service
UDP Port 138    netbios-dgm service
TCP Port 139     netbios-ssn service
TCP Port 42     nameserver service

The DC was working fine (it is a test box) no changes as such were made, I only added a ZFS based storage device to AD but that shouldn't corrupt or cause this. THE DC has 2 NICs (ONE of them is Disabled).

DNS server on DC was working fine and my LAN clients were looking up through AD DNS, forwarders were fine, after a power-cut, it was working fine until two days ago, if i try to open DNS MMC it seems that it isn't able to find any DNS server etc. I can't join any PC to domain.

Any Ideas as to how can I resolve this without re-installing ? :-)

Will be grateful for your prompt response

Solution

Looks like you have a firewall related issue. Chances are you either have an issue with the inbuilt Windows Firewall or some 3rd party application you might have installed providing firewall functionality. See if your AV provides firewall functionality as some AV products include this.

If you want to rule out the inbuilt windows firewall as a possible cause, open wf.msc and disable each profile (domain, public and private). Choose the "Windows firewall with advanced security on local computer" entry on the far left and Choose properties from the actions menu on the far right. Then click on each profile tab and change the firewall state to off. You should also check to see if a 3rd party firewall is installed as the wf.msc steps only help rule out the windows firewall as a possible cause. This is your first troubleshooting step.

If disabling the firewall (be it window or 3rd party app related) helps, you need to go and check the rules configured to ensure all inbound/outbound traffic related to the domain controller is not blocked. The Windows Firewall configures role specific rules automatically at role install time so they may need to be investigated to ensure they are as expected and ensure the relevant profile is enabled for the NIC that is currently enabled.

Comments

[Mutahir]

thanks Maweeras for your input, I did checked and disabled Windows Firewall completely, uninstalled AV, still the issue persisted, we had a backup from which I restored the dc :-) - so it is sorted but will keep an eye according to your suggestions - Thanks again !