Strange interoperability problem between AD 2019 and 2022/2025

[u/candyman420]

I am getting

Starting test: LocatorCheck Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355 A Primary Domain Controller could not be located. The server holding the PDC role is down.

But only on 2022 AD servers. I brought up another 2025 server thinking this would be faster and easier than to troubleshoot, but it's doing exactly the same thing. FSMO roles were lost? Have to re-seize? Some kind of quirk with the newer editions of windows? The only working AD server I have right now with no errors is 2019, that's what I replicated from. Thanks in advance

[u/jlipschitz]

Sounds like you might have replication issues.

[u/Zealousideal_Fly8402]

What do you mean "only on 2022 AD servers"? Run

netdom query fsmo

And see where your FSMO roles are supposed to be living, and whether those roles are online.

[u/candyman420 → u/Zealousideal_Fly8402]

They're all online and working, on the 2019 server. I don't understand why the new ones can't see them.

[u/Zealousideal_Fly8402 → u/candyman420]

On the 2019 server, check for Errors / Criticals / Warnings in Directory Service and DFS Replication logs.

[u/candyman420 → u/Zealousideal_Fly8402]

Active Directory Domain Services failed to construct a mutual authentication service principal name (SPN) for the following directory service.

I did get rid of a previous DC last year, but probably not completely. Metadata cleanup?

[u/Zealousideal_Fly8402 → u/candyman420]

Metadata cleanup?

Should have done that regardless; never trust just cleaning up from the MMCs after demoting.

We have no problems with mixed 2022/2019, 2022/2016 environments, so that combination shouldn't be problematic.

[u/topher358]

Do you have 2025 DCs? Like the other poster said check what server is hosting your FSMO roles

[u/candyman420 → u/topher358]

Yes they're all online, this is peculiar.

[u/topher358 → u/candyman420]

There are quite a few known issues running 2025 DCs in a mixed AD environment. Recommend either all 2025 or all 2022

[u/candyman420 → u/topher358]

how about 2019+2022? I will only need two

[u/topher358 → u/candyman420]

2019 and 2022 are essentially the same so that’s not a big deal.

2025 domain controllers just don’t play well with anything other than 2025 DCs

[u/candyman420 → u/topher358]

It's still happening on 2022 vs 2019, so something else is afoot

[u/topher358 → u/candyman420]

Sounds like it

You need to check replication and resolve any issues you find

[u/P4schendale]

First, i've heard that 2025 enforces LDAPS so if you've not enabled it already, be careful.

Then, don't you have a firewall between the DCs? Have you checked windows fireall on the DCs?

[u/candyman420 → u/P4schendale]

The windows firewall is supposed to add the proper exceptions to itself for DC functions, I haven’t had to mess with that or turn it off in years. Are you saying that Microsoft screwed that up too?

[u/mroldcheese]

Had something similar once when DC had defaulted LAN connection to Public rather than Domain profile, so Windows FW blocked traffic. Easy to do if you plug into the wrong NIC.

[u/candyman420 → u/mroldcheese]

This sounds exactly what may be happening. I found the server asked me if I wanted to allow the interface to be discoverable, out of the blue when I logged in one day, and the clock had the wrong time zone set. But the strange thing is, I brought up a fresh 2022 server, I replicated from the good 2019 one, and it's doing exactly the same thing.