{"id":4637,"date":"2026-09-15T11:30:06","date_gmt":"2026-09-15T08:30:06","guid":{"rendered":"https:\/\/www.ozgurguler.net\/blog\/?p=4637"},"modified":"2026-09-15T12:55:21","modified_gmt":"2026-09-15T09:55:21","slug":"dns-domain-controller-ve-ip-cakismasi-nasil-tespit-edilir","status":"publish","type":"post","link":"https:\/\/www.ozgurguler.net\/blog\/dns-domain-controller-ve-ip-cakismasi-nasil-tespit-edilir\/","title":{"rendered":"DNS, Domain Controller ve IP \u00c7ak\u0131\u015fmas\u0131 Nas\u0131l Tespit Edilir?"},"content":{"rendered":"<h4><strong>Windows Server Domain Giri\u015f Sorunu: DNS, Domain Controller ve IP \u00c7ak\u0131\u015fmas\u0131 Nas\u0131l Tespit Edilir?<\/strong><\/h4>\n<p><strong>Active Directory kullan\u0131lan Windows Server ortamlar\u0131nda baz\u0131 sorunlar ilk bak\u0131\u015fta kullan\u0131c\u0131 ad\u0131 veya parola problemi gibi g\u00f6r\u00fcnebilir. <\/strong><\/p>\n<p><strong>\u00d6rne\u011fin:<\/strong><\/p>\n<ul>\n<li><strong>Domain kullan\u0131c\u0131s\u0131 do\u011fru parolay\u0131 girdi\u011fi halde oturum a\u00e7amaz.<\/strong><\/li>\n<li><strong>\\\\DC yaz\u0131ld\u0131\u011f\u0131nda Windows tekrar kullan\u0131c\u0131 ad\u0131 ve parola ister.<\/strong><\/li>\n<li><strong>Daha \u00f6nce eri\u015filebilen a\u011f payla\u015f\u0131mlar\u0131na ula\u015f\u0131lamaz.<\/strong><\/li>\n<li><strong>gpupdate \/force ba\u015far\u0131s\u0131z olur.<\/strong><\/li>\n<li><strong>SYSVOL veya NETLOGON payla\u015f\u0131mlar\u0131na eri\u015filemez.<\/strong><\/li>\n<li><strong>nltest komutlar\u0131 1355 veya 1311 hatalar\u0131 verir.<\/strong><\/li>\n<li><strong>DNS sorgular\u0131 zaman a\u015f\u0131m\u0131na u\u011frar.<\/strong><\/li>\n<\/ul>\n<p><strong>Bu belirtiler g\u00f6r\u00fcld\u00fc\u011f\u00fcnde ilk akla gelenler genellikle Windows Update, Group Policy, NTLM, Kerberos veya kullan\u0131c\u0131 parolas\u0131d\u0131r. <\/strong><\/p>\n<p><strong>Oysa sorun \u00e7ok daha temel bir noktada &#8220;Domain Controller&#8217;a eri\u015fimde veya a\u011f yap\u0131land\u0131rmas\u0131nda&#8221;\u00a0 olabilir.<\/strong><\/p>\n<p><strong>Bu yaz\u0131da, Windows Server <span class=\"\">2016<\/span> ve \u00fczeri s\u00fcr\u00fcmlerde, Active Directory ortam\u0131nda ya\u015fanabilecek bu t\u00fcr bir problemi ad\u0131m ad\u0131m nas\u0131l te\u015fhis edebilece\u011fimizi inceleyece\u011fiz.<\/strong><\/p>\n<p><strong>\u00d6nemli: A\u015fa\u011f\u0131daki domain ve bilgisayar adlar\u0131 tamamen \u00f6rnektir. Ger\u00e7ek sistem bilgileri kullan\u0131lmam\u0131\u015ft\u0131r.<\/strong><\/p>\n<p><strong>\u00d6rnek Active Directory Yap\u0131s\u0131<\/strong><\/p>\n<table width=\"752\">\n<thead>\n<tr>\n<td><strong>Bile\u015fen<\/strong><\/td>\n<td><strong>\u00d6rnek De\u011fer<\/strong><\/td>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Domain<\/strong><\/td>\n<td><strong>DOMAIN.LOCAL<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>Domain Controller<\/strong><\/td>\n<td><strong>DC.DOMAIN.LOCAL \u2192 192.168.10.10<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>\u00dcye Sunucu<\/strong><\/td>\n<td><strong>SRV.DOMAIN.LOCAL \u2192 192.168.10.20<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>\u0130stemci<\/strong><\/td>\n<td><strong>PC01.DOMAIN.LOCAL \u2192 DHCP<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Ama\u00e7, ger\u00e7ek bir ortama ait bilgileri payla\u015fmadan ayn\u0131 sorunlar\u0131 ya\u015fayan sistem y\u00f6neticilerinin te\u015fhis ad\u0131mlar\u0131n\u0131 uygulayabilmesini sa\u011flamakt\u0131r.<\/strong><\/p>\n<p><strong>Not: Bu rehberde ge\u00e7en t\u00fcm komutlar, aksi belirtilmedik\u00e7e istemci \u00fczerinde ve y\u00f6netici yetkisiyle \u00e7al\u0131\u015ft\u0131r\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<ol>\n<li><strong> Sorunun Ger\u00e7ek Y\u00fcz\u00fc: Parola De\u011fil, \u0130leti\u015fim Zinciri<\/strong><\/li>\n<\/ol>\n<p><strong>Kullan\u0131c\u0131 do\u011fru parolay\u0131 girdi\u011fini s\u00f6yl\u00fcyor ancak Windows oturum a\u00e7m\u0131yorsa, <\/strong><\/p>\n<p><strong>do\u011frudan parolay\u0131 de\u011fi\u015ftirmek veya Group Policy \u00fczerinde de\u011fi\u015fiklik yapmak do\u011fru ilk ad\u0131m de\u011fildir.<\/strong><\/p>\n<p><strong>\u00d6ncelikle bilgisayar\u0131n Domain Controller&#8217;a ula\u015fabildi\u011fini kontrol etmek gerekir. <\/strong><\/p>\n<p><strong>\u00c7\u00fcnk\u00fc Windows&#8217;un domain hesab\u0131n\u0131 do\u011frulayabilmesi i\u00e7in temel olarak \u015fu ileti\u015fim zincirinin \u00e7al\u0131\u015fmas\u0131 gerekir:<\/strong><\/p>\n<p><strong>\u0130stemci \/ Sunucu<\/strong><\/p>\n<p><strong>\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u2502<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u25bc<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0 DNS<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2502<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u25bc<\/strong><\/p>\n<p><strong>Domain Controller<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2502<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u251c<\/strong><strong>\u2500\u2500 LDAP<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u251c<\/strong><strong>\u2500\u2500 Kerberos<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u251c<\/strong><strong>\u2500\u2500 Netlogon<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u251c<\/strong><strong>\u2500\u2500 SYSVOL<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2514\u2500\u2500 NETLOGON<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2502<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><strong>\u25bc<\/strong><\/p>\n<p><strong>Authentication \/ Group Policy<\/strong><\/p>\n<p><strong>Zincirin ba\u015f\u0131ndaki DNS veya a\u011f ileti\u015fimi bozuksa, kullan\u0131c\u0131 bunu yaln\u0131zca &#8220;\u015fifrem \u00e7al\u0131\u015fm\u0131yor&#8221; \u015feklinde g\u00f6rebilir. <\/strong><\/p>\n<p><strong>Bu nedenle bu rehberde izlenecek yol, katman katman daraltmakt\u0131r:<\/strong><\/p>\n<p><strong>Kullan\u0131c\u0131 \/ Oturum<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Domain Controller ke\u015ffi<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0 DNS<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0 A\u011f ba\u011flant\u0131s\u0131<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Secure Channel \/ Netlogon<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Kerberos \/ LDAP \/ SMB<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>SYSVOL \/ NETLOGON<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0 Group Policy<\/strong><\/p>\n<ol start=\"2\">\n<li>\n<h4><strong> \u0130stemci Taraf\u0131 Te\u015fhis Ad\u0131mlar\u0131<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>2.1 \u00d6nce &#8220;Ben Kimim, Hangi Domain&#8217;deyim?&#8221;<\/strong><\/p>\n<p><strong>Te\u015fhise ba\u015flamadan \u00f6nce istemcinin hangi kullan\u0131c\u0131yla, hangi domain alt\u0131nda ve hangi logon server \u00fczerinden oturum a\u00e7t\u0131\u011f\u0131n\u0131 kontrol etmek gerekir.<\/strong><\/p>\n<p><strong>cmd \u00fczerinde\u00a0<\/strong><\/p>\n<blockquote><p><strong>whoami<\/strong><\/p>\n<p><strong>echo %logonserver%<\/strong><\/p>\n<p><strong>echo %userdnsdomain%<\/strong><\/p><\/blockquote>\n<p><strong>whoami \u00e7\u0131kt\u0131s\u0131:<\/strong><\/p>\n<ul>\n<li><strong>DOMAIN\\kullaniciadi \u2192 kullan\u0131c\u0131 domain hesab\u0131yla oturum a\u00e7m\u0131\u015ft\u0131r.<\/strong><\/li>\n<li><strong>PC01\\kullaniciadi \u2192 kullan\u0131c\u0131 yerel bilgisayar hesab\u0131yla oturum a\u00e7m\u0131\u015ft\u0131r. <\/strong><strong>Bu durumda sonraki t\u00fcm domain testleri anlams\u0131zd\u0131r; \u00f6nce domain oturumu sorunu \u00e7\u00f6z\u00fclmelidir.<\/strong><\/li>\n<\/ul>\n<blockquote><p><strong>%logonserver% \u00e7\u0131kt\u0131s\u0131:<\/strong><\/p><\/blockquote>\n<ul>\n<li><strong>\\\\DC gibi bir de\u011fer d\u00f6ner. Bu, oturum a\u00e7ma an\u0131nda hangi logon server&#8217;\u0131n kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/strong><\/li>\n<\/ul>\n<p><strong>\u00d6nemli n\u00fcanslar:<\/strong><\/p>\n<ul>\n<li><strong>Bu de\u011fi\u015fken oturum a\u00e7ma an\u0131nda bir kez hesaplan\u0131r; oturum s\u0131ras\u0131nda DC de\u011fi\u015fse bile g\u00fcncellenmez<\/strong><\/li>\n<li class=\"ds-markdown-paragraph\"><code>%logonserver%<\/code> <strong><span class=\"\">yaln\u0131zca domain oturumlar\u0131nda<\/span><\/strong><span class=\"\"> dolu olur. Yerel hesapta bo\u015f d\u00f6ner.<\/span><\/li>\n<li class=\"ds-markdown-paragraph\"><span class=\"\">Kullan\u0131c\u0131 oturumu <\/span><strong><span class=\"\">sonland\u0131r\u0131p yeniden a\u00e7t\u0131\u011f\u0131nda<\/span><\/strong><span class=\"\"> g\u00fcncellenir.<\/span><\/li>\n<li class=\"ds-markdown-paragraph\"><span class=\"\">Baz\u0131 durumlarda (\u00f6rne\u011fin VPN ba\u011flant\u0131s\u0131 sonradan kuruldu\u011funda) <\/span><strong><span class=\"\">yanl\u0131\u015f DC<\/span><\/strong><span class=\"\"> g\u00f6sterebilir.<\/span><\/li>\n<\/ul>\n<p><strong>G\u00fcncel DC i\u00e7in nltest \/dsgetdc kullan\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>%userdnsdomain% \u00e7\u0131kt\u0131s\u0131:<\/strong><\/p>\n<blockquote><p>DC: \\\\DC.DOMAIN.LOCAL<br \/>\nAddress: \\\\192.168.10.10<br \/>\nDom Name: DOMAIN.LOCAL<br \/>\nForest Name: DOMAIN.LOCAL<br \/>\nDc Site Name: Default-First-Site-Name<br \/>\nOur Site Name: Default-First-Site-Name<br \/>\nFlags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST<br \/>\nThe command completed successfully<\/p><\/blockquote>\n<ul>\n<li><strong>DOMAIN.LOCAL d\u00f6nmelidir. Bo\u015f veya beklenmeyen bir domain ise domain \u00fcyeli\u011fi ve oturum a\u00e7ma durumu ayr\u0131ca kontrol edilmelidir.<\/strong><\/li>\n<\/ul>\n<p><strong>2.2 Domain Controller Bulunabiliyor mu?<\/strong><\/p>\n<p><strong>\u0130lk \u00f6nemli testlerden biri nltest komutudur:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>nltest \/dsgetdc:DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>Sorun ya\u015fanan durumda \u015fu tip bir hata g\u00f6r\u00fclebilir:<\/strong><\/p>\n<blockquote><p><strong>Getting DC name failed:<\/strong><\/p>\n<p><strong>Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN<\/strong><\/p><\/blockquote>\n<p><strong>Bu hata, bilgisayar\u0131n ilgili domain i\u00e7in kullan\u0131labilir bir Domain Controller ke\u015ffedemedi\u011fini g\u00f6sterir. Bu \u00e7\u0131kt\u0131 tek ba\u015f\u0131na kullan\u0131c\u0131 parolas\u0131n\u0131n yanl\u0131\u015f oldu\u011funu g\u00f6stermez. Tam tersine, \u00f6ncelikle DC ke\u015ffi, DNS ve a\u011f ba\u011flant\u0131s\u0131 ara\u015ft\u0131r\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>Ba\u015far\u0131l\u0131 bir sonu\u00e7ta buna benzer bilgiler g\u00f6r\u00fcl\u00fcr:<\/strong><\/p>\n<blockquote><p><strong>DC: \\\\DC.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Address: \\\\192.168.10.10<\/strong><\/p>\n<p><strong>Dom Name: DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Forest Name: DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Dc Site Name: Default-First-Site-Name<\/strong><\/p>\n<p><strong>Our Site Name: Default-First-Site-Name<\/strong><\/p>\n<p><strong>Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST<\/strong><\/p>\n<p><strong>The command completed successfully<\/strong><\/p><\/blockquote>\n<p><strong>\u00d6zellikle Dc Site Name: ve Our Site Name: sat\u0131rlar\u0131, istemci ile DC ayn\u0131 AD site&#8217;ta m\u0131 sorusunun cevab\u0131d\u0131r. Farkl\u0131ysa site\/link maliyeti yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f olabilir.<\/strong><\/p>\n<blockquote><p><span class=\"\">Ger\u00e7ek \u00e7\u0131kt\u0131da <\/span><strong><code>Dom Guid: xxxxxxxx-xxxx-...<\/code><\/strong><span class=\"\"> sat\u0131r\u0131 da vard\u0131r (DC ve Domain GUID&#8217;i). Bu sat\u0131r <\/span><strong><span class=\"\">iki DC&#8217;nin farkl\u0131 GUID d\u00f6nd\u00fcrmesi<\/span><\/strong><span class=\"\"> durumunda replikasyon sorununa i\u015faret edebilir.\u00a0<\/span><\/p><\/blockquote>\n<h4><strong>2.3 Domain Secure Channel Durumunu Kontrol Edin<\/strong><\/h4>\n<p><strong>Domain&#8217;e \u00fcye bilgisayar ile Active Directory aras\u0131ndaki bilgisayar hesab\u0131 ili\u015fkisi bozuldu\u011funda Secure Channel (g\u00fcven kanal\u0131) problemi ortaya \u00e7\u0131kabilir. \u0130ki komut vard\u0131r ve ikisi farkl\u0131 \u015feyler yapar:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>nltest \/sc_query:DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>nltest \/sc_verify:DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<ul>\n<li><strong>nltest \/sc_query \u2192 mevcut g\u00fcven kanal\u0131n\u0131n durumunu sorgular (hafif test).<\/strong><\/li>\n<li><strong>nltest \/sc_verify \u2192 g\u00fcven kanal\u0131n\u0131 aktif olarak do\u011frular (daha g\u00fc\u00e7l\u00fc test, DC ile ger\u00e7ek ileti\u015fim kurar).<\/strong><\/li>\n<\/ul>\n<p><strong>Sorun ya\u015fanan bir ortamda \u015fu tip bir hata g\u00f6r\u00fclebilir:<\/strong><\/p>\n<blockquote><p><strong>Trusted DC Connection Status<\/strong><\/p>\n<p><strong>Status = 1311 0x51f ERROR_NO_LOGON_SERVERS<\/strong><\/p><\/blockquote>\n<p><strong>ERROR_NO_LOGON_SERVERS, bilgisayar\u0131n domain \u00fczerinde kullan\u0131labilecek bir logon sunucusuna ula\u015famad\u0131\u011f\u0131n\u0131 g\u00f6sterir. Di\u011fer tipik hata kodlar\u0131:<\/strong><\/p>\n<ul>\n<li>\n<blockquote><p><strong>ERROR_ACCESS_DENIED (5) \u2192 bilgisayar hesab\u0131 parolas\u0131 e\u015fle\u015fmiyor<\/strong><\/p><\/blockquote>\n<\/li>\n<li>\n<blockquote><p><strong>ERROR_NO_TRUST_LSA_SECRET \u2192 LSA secret bozulmu\u015f<\/strong><\/p><\/blockquote>\n<\/li>\n<li>\n<blockquote><p><strong>ERROR_NO_TRUST_SAM_ACCOUNT \u2192 SAM hesab\u0131 bulunam\u0131yor<\/strong><\/p><\/blockquote>\n<\/li>\n<\/ul>\n<p><strong>Ba\u015far\u0131l\u0131 bir sonu\u00e7:<\/strong><\/p>\n<blockquote><p><strong>Trust Verification Status = 0 0x0 NERR_Success<\/strong><\/p><\/blockquote>\n<p><strong>Gerekirse PowerShell \u00fczerinden kontrol ve onar\u0131m:<\/strong><\/p>\n<blockquote><p><strong>Test-ComputerSecureChannel -Verbose<\/strong><\/p>\n<p><strong>Test-ComputerSecureChannel -Repair -Credential DOMAIN\\administrator<\/strong><\/p><\/blockquote>\n<p><strong>\u00d6nemli notlar:<\/strong><\/p>\n<ul>\n<li><strong>Bu komut istemci \u00fczerinde \u00e7al\u0131\u015ft\u0131r\u0131l\u0131r, DC \u00fczerinde de\u011fil.<\/strong><\/li>\n<li><strong>-Repair parametresi yerel makinenin bilgisayar hesab\u0131 parolas\u0131n\u0131 s\u0131f\u0131rlar.<\/strong><\/li>\n<li><strong>-Credential olarak verilen hesab\u0131n Domain Admin yetkisi olmal\u0131d\u0131r.<\/strong><\/li>\n<li><strong>Repair sonras\u0131 genellikle gpupdate \/force ile Group Policy tekrar test edilebilir. Gerekirse bilgisayar yeniden ba\u015flat\u0131labilir.<\/strong><\/li>\n<\/ul>\n<p><strong>\u00d6zellikle \u015fu durumlarda Secure Channel problemi g\u00f6r\u00fclebilir: VM snapshot geri d\u00f6n\u00fc\u015fleri, bilgisayar hesab\u0131n\u0131n AD \u00fczerinde de\u011fi\u015ftirilmesi, uzun s\u00fcre domain ba\u011flant\u0131s\u0131 olmamas\u0131, restore i\u015flemleri veya bilgisayar hesab\u0131 parolas\u0131n\u0131n e\u015fle\u015fmemesi.<\/strong><\/p>\n<h4 class=\"PDq2pG_selectionAnchorContainer\" dir=\"auto\" data-start=\"319\" data-end=\"350\"><span role=\"text\"><strong data-start=\"324\" data-end=\"350\">2.4 DNS Kontrol\u00fc Yap\u0131n<\/strong><\/span><\/h4>\n<p dir=\"auto\" data-start=\"352\" data-end=\"676\"><strong data-start=\"352\" data-end=\"676\">Active Directory ortamlar\u0131nda DNS, Domain Controller ke\u015ffi ve Active Directory servislerine eri\u015fim a\u00e7\u0131s\u0131ndan kritik bir bile\u015fendir. Bu nedenle DNS kontrol\u00fcnde yaln\u0131zca Domain Controller&#8217;\u0131n ad\u0131n\u0131n \u00e7\u00f6z\u00fcl\u00fcp \u00e7\u00f6z\u00fclmedi\u011fine de\u011fil, domain ve Active Directory&#8217;ye ait DNS kay\u0131tlar\u0131n\u0131n do\u011fru \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131na da bak\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"678\" data-end=\"774\"><strong data-start=\"678\" data-end=\"774\">\u00d6ncelikle Domain Controller&#8217;\u0131n tam ad\u0131 (FQDN) do\u011fru IP adresine \u00e7\u00f6z\u00fcl\u00fcyor mu kontrol edilir:<\/strong><\/p>\n<p dir=\"auto\" data-start=\"776\" data-end=\"792\"><strong data-start=\"776\" data-end=\"792\">cmd \u00fczerinde<\/strong><\/p>\n<blockquote>\n<p dir=\"auto\" data-start=\"796\" data-end=\"824\"><strong data-start=\"796\" data-end=\"824\">nslookup DC.DOMAIN.LOCAL<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"826\" data-end=\"838\"><strong data-start=\"826\" data-end=\"838\">\u00d6rne\u011fin:<\/strong><\/p>\n<blockquote data-start=\"840\" data-end=\"901\">\n<p dir=\"auto\" data-start=\"842\" data-end=\"901\"><strong data-start=\"842\" data-end=\"870\">Name: DC.DOMAIN.LOCAL<\/strong><br data-start=\"870\" data-end=\"873\" \/><strong data-start=\"875\" data-end=\"901\">Address: 192.168.10.10<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"903\" data-end=\"1013\"><strong data-start=\"903\" data-end=\"1013\">Burada \u00f6zellikle <code data-start=\"922\" data-end=\"931\">Address<\/code> sat\u0131r\u0131na dikkat edilir. Domain Controller i\u00e7in beklenen IP adresi g\u00f6r\u00fclmelidir.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"1015\" data-end=\"1067\"><strong data-start=\"1015\" data-end=\"1067\">Daha sonra domain ad\u0131n\u0131n kendisi sorgulanabilir:<\/strong><\/p>\n<p dir=\"auto\" data-start=\"1069\" data-end=\"1085\"><strong data-start=\"1069\" data-end=\"1085\">cmd \u00fczerinde<\/strong><\/p>\n<blockquote data-start=\"1087\" data-end=\"1114\">\n<p dir=\"auto\" data-start=\"1089\" data-end=\"1114\"><strong data-start=\"1089\" data-end=\"1114\">nslookup DOMAIN.LOCAL<\/strong><\/p>\n<\/blockquote>\n<p class=\"\" dir=\"auto\" data-start=\"1116\" data-end=\"1219\"><strong data-start=\"1116\" data-end=\"1219\">Bu test, domain ad\u0131n\u0131n DNS \u00fczerinden \u00e7\u00f6z\u00fcmlenip \u00e7\u00f6z\u00fcmlenmedi\u011fini kontrol etmek i\u00e7in kullan\u0131labilir.<\/strong><\/p>\n<p class=\"\" dir=\"auto\" data-start=\"1221\" data-end=\"1336\"><strong data-start=\"1221\" data-end=\"1336\">Belirli bir DNS sunucusunu do\u011frudan test etmek istenirse <code data-start=\"1280\" data-end=\"1290\">nslookup<\/code> i\u00e7erisinden DNS sunucusu da belirtilebilir:<\/strong><\/p>\n<p dir=\"auto\" data-start=\"1338\" data-end=\"1354\"><strong data-start=\"1338\" data-end=\"1354\">cmd \u00fczerinde<\/strong><\/p>\n<blockquote data-start=\"1356\" data-end=\"1370\">\n<p dir=\"auto\" data-start=\"1358\" data-end=\"1370\"><strong data-start=\"1358\" data-end=\"1370\">nslookup<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"1372\" data-end=\"1381\">Ard\u0131ndan:<\/p>\n<blockquote data-start=\"1383\" data-end=\"1409\">\n<p dir=\"auto\" data-start=\"1385\" data-end=\"1409\"><strong data-start=\"1385\" data-end=\"1409\">server 192.168.10.10<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"1411\" data-end=\"1417\">Sonra:<\/p>\n<blockquote data-start=\"1419\" data-end=\"1440\">\n<p dir=\"auto\" data-start=\"1421\" data-end=\"1440\"><strong data-start=\"1421\" data-end=\"1440\">DC.DOMAIN.LOCAL<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"1442\" data-end=\"1472\"><strong data-start=\"1442\" data-end=\"1472\">Test tamamland\u0131ktan sonra:<\/strong><\/p>\n<blockquote data-start=\"1474\" data-end=\"1484\">\n<p dir=\"auto\" data-start=\"1476\" data-end=\"1484\"><strong data-start=\"1476\" data-end=\"1484\">exit<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"1486\" data-end=\"1637\"><strong data-start=\"1486\" data-end=\"1637\">Bu y\u00f6ntem \u00f6zellikle birden fazla DNS sunucusunun bulundu\u011fu veya istemcinin hangi DNS sunucusunu kulland\u0131\u011f\u0131n\u0131n \u015f\u00fcpheli oldu\u011fu durumlarda faydal\u0131d\u0131r.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"1639\" data-end=\"1726\"><strong data-start=\"1639\" data-end=\"1726\">Bunun yan\u0131nda Active Directory&#8217;nin kulland\u0131\u011f\u0131 SRV kay\u0131tlar\u0131 da kontrol edilmelidir:<\/strong><\/p>\n<p dir=\"auto\" data-start=\"1728\" data-end=\"1744\"><strong data-start=\"1728\" data-end=\"1744\">cmd \u00fczerinde<\/strong><\/p>\n<blockquote data-start=\"1746\" data-end=\"1807\">\n<p dir=\"auto\" data-start=\"1748\" data-end=\"1807\"><strong data-start=\"1748\" data-end=\"1807\">nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN.LOCAL<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"1809\" data-end=\"2077\"><strong data-start=\"1809\" data-end=\"2077\">SRV kay\u0131tlar\u0131 \u00f6nemlidir \u00e7\u00fcnk\u00fc Active Directory ortam\u0131nda Domain Controller ke\u015ffi yaln\u0131zca <code data-start=\"1901\" data-end=\"1918\">DC.DOMAIN.LOCAL<\/code> gibi bir A kayd\u0131n\u0131n \u00e7\u00f6z\u00fclmesine ba\u011fl\u0131 de\u011fildir. \u0130stemciler, Active Directory servislerini bulabilmek i\u00e7in DNS \u00fczerindeki servis kay\u0131tlar\u0131ndan da yararlan\u0131r.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"2079\" data-end=\"2094\"><strong data-start=\"2079\" data-end=\"2094\">Bu nedenle;<\/strong><\/p>\n<blockquote data-start=\"2096\" data-end=\"2130\">\n<p dir=\"auto\" data-start=\"2098\" data-end=\"2130\"><strong data-start=\"2098\" data-end=\"2130\">DC.DOMAIN.LOCAL \u00e7\u00f6z\u00fcmleniyor<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"2132\" data-end=\"2163\"><strong data-start=\"2132\" data-end=\"2163\">sonucunu g\u00f6rmek tek ba\u015f\u0131na:<\/strong><\/p>\n<blockquote data-start=\"2165\" data-end=\"2211\">\n<p dir=\"auto\" data-start=\"2167\" data-end=\"2211\"><strong data-start=\"2167\" data-end=\"2211\">\u201cActive Directory DNS tamamen sa\u011fl\u0131kl\u0131.\u201d<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"2213\" data-end=\"2233\"><strong data-start=\"2213\" data-end=\"2233\">anlam\u0131na gelmez.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"2235\" data-end=\"2450\"><strong data-start=\"2235\" data-end=\"2450\">\u00d6rne\u011fin Domain Controller&#8217;\u0131n ad\u0131 do\u011fru IP adresine \u00e7\u00f6z\u00fcl\u00fcyor ancak gerekli SRV kay\u0131tlar\u0131 bulunam\u0131yorsa, istemci yine Domain Controller ke\u015ffi veya Active Directory servislerine eri\u015fim konusunda sorun ya\u015fayabilir.<\/strong><\/p>\n<p dir=\"auto\" data-start=\"2452\" data-end=\"2544\"><strong data-start=\"2452\" data-end=\"2544\">Bir di\u011fer \u00f6nemli nokta da <code data-start=\"2480\" data-end=\"2490\">nslookup<\/code> \u00e7\u0131kt\u0131s\u0131ndaki <code data-start=\"2504\" data-end=\"2521\">Server: UnKnown<\/code> ifadesidir. \u00d6rne\u011fin:<\/strong><\/p>\n<blockquote data-start=\"2546\" data-end=\"2670\">\n<p dir=\"auto\" data-start=\"2548\" data-end=\"2604\"><strong data-start=\"2548\" data-end=\"2570\">Server: UnKnown<\/strong><br data-start=\"2570\" data-end=\"2573\" \/><strong data-start=\"2575\" data-end=\"2602\">Address: 192.168.10.10<\/strong><\/p>\n<p dir=\"auto\" data-start=\"2609\" data-end=\"2670\"><strong data-start=\"2609\" data-end=\"2638\">Name: DC.DOMAIN.LOCAL<\/strong><br data-start=\"2638\" data-end=\"2641\" \/><strong data-start=\"2643\" data-end=\"2670\">Address: 192.168.10.10<\/strong><\/p>\n<\/blockquote>\n<p dir=\"auto\" data-start=\"2672\" data-end=\"2882\"><strong data-start=\"2672\" data-end=\"2882\">Buradaki <code data-start=\"2683\" data-end=\"2700\">Server: UnKnown<\/code> sat\u0131r\u0131 tek ba\u015f\u0131na DNS&#8217;in \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 g\u00f6stermez. Burada as\u0131l \u00f6nemli olan, sorgulanan <code data-start=\"2787\" data-end=\"2804\">DC.DOMAIN.LOCAL<\/code> ad\u0131n\u0131n beklenen IP adresine (<code data-start=\"2834\" data-end=\"2849\">192.168.10.10<\/code>) \u00e7\u00f6z\u00fcmlenip \u00e7\u00f6z\u00fcmlenmedi\u011fidir.<\/strong><\/p>\n<p class=\"\" dir=\"auto\" data-start=\"2884\" data-end=\"3112\"><strong data-start=\"2884\" data-end=\"3112\">Ancak DNS sunucusunun ad\u0131n\u0131n <code data-start=\"2915\" data-end=\"2924\">UnKnown<\/code> g\u00f6r\u00fcnmesi istenmeyen bir durumsa, DNS sunucusunun kendi PTR\/reverse DNS kayd\u0131 da ayr\u0131ca kontrol edilebilir. Bu nedenle bu sat\u0131r\u0131 do\u011frudan \u201cDNS bozuk\u201d \u015feklinde yorumlamak do\u011fru de\u011fildir.<\/strong><\/p>\n<h4><strong>2.5 Domain Controller&#8217;a A\u011f Eri\u015fimini Kontrol Edin<\/strong><\/h4>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>ping DC.DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>\u00d6rne\u011fin:<\/strong><\/p>\n<blockquote><p><strong>Pinging DC.DOMAIN.LOCAL [192.168.10.10]<\/strong><\/p><\/blockquote>\n<p><strong>g\u00f6r\u00fclmesi beklenir. Yanl\u0131\u015f bir IP adresi, beklenmeyen IPv6 adresi veya \u00e7\u00f6z\u00fcmlenemeyen bir isim g\u00f6r\u00fcl\u00fcyorsa DNS ve a\u011f yap\u0131land\u0131rmas\u0131 tekrar incelenmelidir.<\/strong><\/p>\n<p><strong>ping DC ile ping DC.DOMAIN.LOCAL aras\u0131ndaki fark: K\u0131sa isim \u00e7al\u0131\u015fm\u0131yor ancak FQDN \u00e7al\u0131\u015f\u0131yorsa DNS suffix yap\u0131land\u0131rmas\u0131 incelenmelidir. <\/strong><\/p>\n<p><strong>Bu durumda do\u011frudan &#8220;DC \u00e7al\u0131\u015fm\u0131yor&#8221; sonucuna varmak do\u011fru de\u011fildir.<\/strong><\/p>\n<p><strong>Ping ba\u015far\u0131l\u0131 olmas\u0131 Active Directory&#8217;nin sa\u011fl\u0131kl\u0131 oldu\u011funu tek ba\u015f\u0131na kan\u0131tlamaz. Ping yaln\u0131zca temel a\u011f eri\u015fimi hakk\u0131nda fikir verir.<\/strong><\/p>\n<h4><strong>2.6 SYSVOL ve NETLOGON Eri\u015fimini Kontrol Edin<\/strong><\/h4>\n<p><strong>Group Policy&#8217;nin \u00e7al\u0131\u015fabilmesi i\u00e7in SYSVOL eri\u015fimi \u00f6nemlidir. A\u015fa\u011f\u0131daki kontroller yap\u0131labilir:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>dir \\\\DOMAIN.LOCAL\\SYSVOL<\/strong><\/p>\n<p><strong>dir \\\\DOMAIN.LOCAL\\NETLOGON<\/strong><\/p>\n<p><strong>dir \\\\DC.DOMAIN.LOCAL\\SYSVOL<\/strong><\/p>\n<p><strong>dir \\\\DC.DOMAIN.LOCAL\\NETLOGON<\/strong><\/p><\/blockquote>\n<p><strong>Bu payla\u015f\u0131mlara eri\u015filemiyorsa Group Policy \u00fczerinde de\u011fi\u015fiklik yapmadan \u00f6nce Domain Controller, DNS, Netlogon ve SYSVOL taraf\u0131 ara\u015ft\u0131r\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>2.7 Group Policy Hatas\u0131n\u0131n Ger\u00e7ek Nedenini Ara\u015ft\u0131r\u0131n<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>gpupdate \/force<\/strong><\/p><\/blockquote>\n<p><strong>\u00d6rne\u011fin a\u015fa\u011f\u0131daki gibi bir hata al\u0131nabilir:<\/strong><\/p>\n<blockquote><p><strong>The processing of Group Policy failed.<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>Windows attempted to read the file<\/strong><\/p>\n<p><strong>\\\\DOMAIN.LOCAL\\sysvol\\DOMAIN.LOCAL\\Policies\\{GUID}\\gpt.ini<\/strong><\/p>\n<p><strong>from a domain controller and was not successful.<\/strong><\/p><\/blockquote>\n<p><strong>Bu durumda ilk bak\u0131\u015fta sorun Group Policy gibi g\u00f6r\u00fcn\u00fcr. Ancak gpt.ini dosyas\u0131na ula\u015f\u0131labilmesi i\u00e7in bilgisayar\u0131n \u00f6nce Domain Controller ve SYSVOL&#8217;a eri\u015febilmesi gerekir. Dolay\u0131s\u0131yla hata zinciri \u015f\u00f6yle olabilir:<\/strong><\/p>\n<p><strong>DNS \/ A\u011f<\/strong><\/p>\n<p><strong>\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Domain Controller eri\u015fimi<\/strong><\/p>\n<p><strong>\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>SYSVOL \/ NETLOGON<\/strong><\/p>\n<p><strong>\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Group Policy<\/strong><\/p>\n<p><strong>Bu nedenle Group Policy hatas\u0131 her zaman Group Policy&#8217;nin bozuk oldu\u011fu anlam\u0131na gelmez.<\/strong><\/p>\n<p><strong>Uygulanan Group Policy&#8217;leri g\u00f6rmek i\u00e7in:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>gpresult \/r<\/strong><\/p><\/blockquote>\n<p><strong>Bu \u00e7\u0131kt\u0131da \u00f6zellikle \u015fu bilgiler incelenir: domain bilgisi, bilgisayar bilgisi, uygulanan GPO&#8217;lar ve Group Policy&#8217;nin hangi Domain Controller \u00fczerinden al\u0131nd\u0131\u011f\u0131.<\/strong><\/p>\n<p><strong>\u00d6rne\u011fin:<\/strong><\/p>\n<blockquote><p><strong>Group Policy was applied from: <\/strong><strong>DC.DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>gibi bir sonu\u00e7, bilgisayar\u0131n Group Policy i\u015flemi s\u0131ras\u0131nda DC&#8217;ye ula\u015fabildi\u011fini g\u00f6steren \u00f6nemli bir bulgudur.<\/strong><\/p>\n<p><strong>\u00d6nemli n\u00fcans: <\/strong><\/p>\n<p><strong>gpresult \/r, \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131 kullan\u0131c\u0131 ve yetki ba\u011flam\u0131na g\u00f6re kullan\u0131c\u0131 ve bilgisayar taraf\u0131ndaki RSoP bilgilerini g\u00f6sterebilir.\u00a0<\/strong><\/p>\n<ul>\n<li>\n<p class=\"ds-markdown-paragraph\"><strong><span class=\"\">Y\u00f6netici CMD&#8217;de<\/span><\/strong><span class=\"\"> \u00e7al\u0131\u015ft\u0131r\u0131l\u0131rsa \u2192 <\/span><strong><span class=\"\">bilgisayar<\/span><\/strong><span class=\"\"> politikalar\u0131 \u00f6nce gelir<\/span><\/p>\n<\/li>\n<li>\n<p class=\"ds-markdown-paragraph\"><strong><span class=\"\">Normal CMD&#8217;de<\/span><\/strong><span class=\"\"> \u00e7al\u0131\u015ft\u0131r\u0131l\u0131rsa \u2192 <\/span><strong><span class=\"\">kullan\u0131c\u0131<\/span><\/strong><span class=\"\"> politikalar\u0131 \u00f6nce gelir<\/span><\/p>\n<\/li>\n<li>\n<p class=\"ds-markdown-paragraph\"><strong><span class=\"\">\u0130ki taraf\u0131 da g\u00f6rmek i\u00e7in<\/span><\/strong><span class=\"\"> ya y\u00f6netici CMD&#8217;de \u00e7al\u0131\u015ft\u0131r ya da <\/span><code>\/scope:computer<\/code><span class=\"\"> ve <\/span><code>\/scope:user<\/code><span class=\"\"> ile iki kez \u00e7al\u0131\u015ft\u0131r<\/span><\/p>\n<\/li>\n<\/ul>\n<h4><strong>2.8 Saat ve Kerberos Durumunu Kontrol Edin<\/strong><\/h4>\n<p><strong>Active Directory ortamlar\u0131nda zaman senkronizasyonu Kerberos a\u00e7\u0131s\u0131ndan kritiktir. \u0130stemci ile DC aras\u0131ndaki saat fark\u0131 5 dakikay\u0131 a\u015farsa kimlik do\u011frulama ba\u015far\u0131s\u0131z olabilir ve hata &#8220;parola yanl\u0131\u015f&#8221; gibi g\u00f6r\u00fcnebilir.<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>w32tm \/query \/status<\/strong><\/p>\n<p><strong>w32tm \/query \/source<\/strong><\/p>\n<p><strong>w32tm \/query \/configuration<\/strong><\/p>\n<p><strong>w32tm \/query \/status <\/strong><\/p><\/blockquote>\n<p><strong>\u00e7\u0131kt\u0131s\u0131nda neye bak\u0131l\u0131r:<\/strong><\/p>\n<ul>\n<li><strong>Source: \u2192 hangi zaman kayna\u011f\u0131 kullan\u0131l\u0131yor<\/strong><\/li>\n<li><strong>Phase Offset: \u2192 zaman kayna\u011f\u0131 ile istemci aras\u0131ndaki \u00f6l\u00e7\u00fclen zaman fark\u0131n\u0131 g\u00f6sterir. De\u011ferin s\u00fcrekli y\u00fcksek olmas\u0131 veya zaman senkronizasyonunun ba\u015far\u0131s\u0131z olmas\u0131 ayr\u0131ca ara\u015ft\u0131r\u0131lmal\u0131d\u0131r.<\/strong><\/li>\n<li><strong>Last Successful Sync Time: \u2192 son ba\u015far\u0131l\u0131 senkronizasyon<\/strong><\/li>\n<li><strong>Poll Interval: \u2192 yoklama aral\u0131\u011f\u0131<\/strong><\/li>\n<\/ul>\n<p><strong>w32tm \/query \/configuration \u00e7\u0131kt\u0131s\u0131nda neye bak\u0131l\u0131r: Domain ortam\u0131nda istemciler i\u00e7in beklenen de\u011fer:<\/strong><\/p>\n<blockquote><p><strong>Type: NT5DS<\/strong><\/p><\/blockquote>\n<p><strong>NTP veya NoSync g\u00f6r\u00fcn\u00fcyorsa yap\u0131land\u0131rma hatal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>\u00d6rne\u011fin:<\/strong><\/p>\n<blockquote><p><strong>Leap Indicator: 3<\/strong><\/p>\n<p><strong>Stratum: 0<\/strong><\/p>\n<p><strong>Source: Local CMOS Clock<\/strong><\/p><\/blockquote>\n<p><strong>gibi bir \u00e7\u0131kt\u0131 ayr\u0131ca ara\u015ft\u0131r\u0131lmas\u0131 gereken bir durumdur.<\/strong><\/p>\n<p><strong>Domain&#8217;deki t\u00fcm DC&#8217;leri kar\u015f\u0131la\u015ft\u0131rmak i\u00e7in:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>w32tm \/monitor \/domain:DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>Tek bir hedefe kar\u015f\u0131 s\u00fcrekli \u00f6l\u00e7\u00fcm i\u00e7in:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>w32tm \/stripchart \/computer:DC.DOMAIN.LOCAL \/samples:5<\/strong><\/p><\/blockquote>\n<p><strong>Bu komut Ctrl+C ile durdurulur.<\/strong><\/p>\n<p><strong>\u00d6nemli ayr\u0131m: Bir testte anormal sonu\u00e7 g\u00f6r\u00fclmesi, o sonucun mutlaka k\u00f6k neden oldu\u011fu anlam\u0131na gelmez. \u0130nceledi\u011fimiz \u00f6rnekte zaman senkronizasyonu ayr\u0131ca kontrol edilmesi gereken bir bulgu olsa da, problemin temelinde a\u011f taraf\u0131ndaki IP \u00e7ak\u0131\u015fmas\u0131 oldu\u011fu daha sonraki kontrollerle ortaya \u00e7\u0131km\u0131\u015ft\u0131r.<\/strong><\/p>\n<ol start=\"3\">\n<li>\n<h4><strong> A\u011f Katman\u0131: IP \u00c7ak\u0131\u015fmas\u0131 ve Nas\u0131l Ara\u015ft\u0131r\u0131l\u0131r?<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Bazen b\u00fct\u00fcn belirtilerin alt\u0131nda \u00e7ok daha basit bir problem bulunabilir: Domain Controller&#8217;\u0131n IP adresini ba\u015fka bir cihaz da kullan\u0131yor olabilir.<\/strong><\/p>\n<p><strong>\u00d6rne\u011fin DC&#8217;nin adresi 192.168.10.10 oldu\u011fu halde a\u011f \u00fczerinde ba\u015fka bir cihaz da ayn\u0131 IP&#8217;yi kullan\u0131yorsa, istemcilerin DC&#8217;ye g\u00f6nderdi\u011fi trafik tutars\u0131z hale gelir. Bu durumda:<\/strong><\/p>\n<ul>\n<li><strong>Domain Controller ke\u015ffi ba\u015far\u0131s\u0131z olabilir.<\/strong><\/li>\n<li><strong>DNS sorgular\u0131 zaman a\u015f\u0131m\u0131na u\u011frayabilir.<\/strong><\/li>\n<li><strong>Netlogon ba\u011flant\u0131lar\u0131 ba\u015far\u0131s\u0131z olabilir.<\/strong><\/li>\n<li><strong>Secure Channel kontrolleri hata verebilir.<\/strong><\/li>\n<li><strong>Kerberos do\u011frulamas\u0131 ba\u015far\u0131s\u0131z olabilir.<\/strong><\/li>\n<li><strong>SMB ba\u011flant\u0131lar\u0131 tekrar kullan\u0131c\u0131 ad\u0131 ve parola isteyebilir.<\/strong><\/li>\n<li><strong>SYSVOL&#8217;a eri\u015filemeyebilir.<\/strong><\/li>\n<li><strong>Group Policy uygulanamayabilir.<\/strong><\/li>\n<\/ul>\n<p><strong>Kullan\u0131c\u0131 ise b\u00fct\u00fcn bu sorunlar\u0131 tek bir mesajla ifade eder: &#8220;Domain \u015fifrem \u00e7al\u0131\u015fm\u0131yor.&#8221;<\/strong><\/p>\n<h4><strong>3.1 IP \u00c7ak\u0131\u015fmas\u0131 Nas\u0131l Ara\u015ft\u0131r\u0131l\u0131r?<\/strong><\/h4>\n<ol>\n<li>\n<h4><strong> ARP tablosunu kontrol edin:<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>arp -a<\/strong><\/p>\n<p><strong>arp -a | findstr 192.168.10.10<\/strong><\/p><\/blockquote>\n<p><strong>\u00d6nemli n\u00fcans: Tek bir arp -a \u00e7\u0131kt\u0131s\u0131nda ayn\u0131 IP i\u00e7in iki farkl\u0131 MAC g\u00f6r\u00fcnmesi nadirdir. <\/strong><\/p>\n<p><strong>Bu nedenle yaln\u0131zca tek bir arp -a \u00e7\u0131kt\u0131s\u0131na bakarak IP \u00e7ak\u0131\u015fmas\u0131 kesin olarak do\u011frulanmamal\u0131d\u0131r. \u015e\u00fcpheli durumda farkl\u0131 zamanlarda tekrar kontrol edilmeli ve m\u00fcmk\u00fcnse switch MAC tablosu veya DHCP kay\u0131tlar\u0131yla do\u011frulanmal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>\u00c7ak\u0131\u015fma genellikle zaman i\u00e7inde ARP tablosunun de\u011fi\u015fmesiyle ortaya \u00e7\u0131kar. Bu nedenle arp -a komutunu birka\u00e7 kez, birka\u00e7 dakika arayla \u00e7al\u0131\u015ft\u0131r\u0131n.<\/strong><\/p>\n<p><strong>\u00a0<\/strong><\/p>\n<ol start=\"2\">\n<li>\n<h4><strong> DC&#8217;nin kendi MAC adresini do\u011frulay\u0131n:<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>DC \u00fczerinde:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>getmac \/v<\/strong><\/p><\/blockquote>\n<ol start=\"3\">\n<li>\n<h4><strong> Event Viewer&#8217;da TCP\/IP \u00e7ak\u0131\u015fma kayd\u0131n\u0131 aray\u0131n:<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>DC \u00fczerinde Olay G\u00f6r\u00fcnt\u00fcleyicisi \u2192 Windows Logs \u2192 System alt\u0131nda Event ID 4198 veya 4199 (TCP\/IP \u00e7ak\u0131\u015fmas\u0131) kay\u0131tlar\u0131n\u0131 kontrol edin. Bu kay\u0131tlar, IP adresi \u00e7ak\u0131\u015fmas\u0131 \u015f\u00fcphesini g\u00fc\u00e7l\u00fc \u015fekilde destekleyen \u00f6nemli g\u00f6stergelerdir.<\/strong><\/p>\n<ol start=\"4\">\n<li>\n<h4><strong> Switch \u00fczerindeki MAC address table&#8217;\u0131 inceleyin:<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>\u00c7ak\u0131\u015fan cihaz\u0131n hangi switch portuna ba\u011fl\u0131 oldu\u011funu bulmak i\u00e7in switch&#8217;in MAC adres tablosunu kontrol edin:<\/strong><\/p>\n<blockquote><p><strong>show mac address-table | include &lt;MAC_adresi&gt;<\/strong><\/p><\/blockquote>\n<p><strong>Bu, \u00e7ak\u0131\u015fman\u0131n kayna\u011f\u0131n\u0131 fiziksel olarak bulman\u0131n en h\u0131zl\u0131 yoludur.<\/strong><\/p>\n<p><strong>3.2 DHCP ve Statik IP Plan\u0131<\/strong><\/p>\n<p><strong>DC gibi kritik sunucular\u0131n IP adresleri DHCP havuzuyla \u00e7ak\u0131\u015fmamal\u0131d\u0131r. \u00d6rne\u011fin:<\/strong><\/p>\n<blockquote><p><strong>DHCP Pool:<\/strong><\/p>\n<p><strong>192.168.10.100 &#8211; 192.168.10.200<\/strong><\/p><\/blockquote>\n<p><strong>\u00a0<\/strong><strong>Domain Controller:<\/strong><\/p>\n<p><strong>192.168.10.10<\/strong><\/p>\n<p><strong>gibi bir yap\u0131 daha sa\u011fl\u0131kl\u0131d\u0131r. Burada \u00f6nemli olan yaln\u0131zca IP&#8217;nin sabit olmas\u0131 de\u011fil, a\u011fdaki ba\u015fka hi\u00e7bir cihaz\u0131n ayn\u0131 IP&#8217;yi kullanmamas\u0131d\u0131r.<\/strong><\/p>\n<ol start=\"4\">\n<li>\n<h4><strong> D\u00fczeltme Sonras\u0131 Do\u011frulama<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Sorunun a\u011f taraf\u0131nda oldu\u011fu d\u00fc\u015f\u00fcn\u00fcl\u00fcyorsa yaln\u0131zca IP adresini de\u011fi\u015ftirmekle yetinmemek gerekir. Ayn\u0131 testleri tekrar \u00e7al\u0131\u015ft\u0131rmak, problemin ger\u00e7ekten ortadan kalk\u0131p kalkmad\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/strong><\/p>\n<div class=\"md-code-block md-code-block-dark\">\n<div class=\"md-code-block-banner-wrap\">\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\n<div class=\"_121d384\">\n<blockquote>\n<div class=\"d2a24f03\"><span style=\"font-family: Consolas, Monaco, monospace;\">ipconfig \/flushdns<\/span><\/div>\n<\/blockquote>\n<\/div>\n<\/div>\n<\/div>\n<blockquote>\n<pre>arp -d *<\/pre>\n<\/blockquote>\n<\/div>\n<p class=\"ds-markdown-paragraph\"><code>arp -d *<\/code><span class=\"\"> komutu <\/span><strong><span class=\"\">t\u00fcm ARP tablosunu temizler<\/span><\/strong><span class=\"\">. Bu, a\u011f \u00fczerindeki <\/span><strong><span class=\"\">di\u011fer cihazlarla olan ba\u011flant\u0131y\u0131 k\u0131sa s\u00fcreli\u011fine kesintiye u\u011fratabilir<\/span><\/strong><span class=\"\"> ve baz\u0131 ortamlarda (\u00f6zellikle \u00fcretim sunucular\u0131nda) istenmeyen sonu\u00e7lar do\u011furabilir.\u00a0<\/span><\/p>\n<blockquote>\n<p class=\"ds-markdown-paragraph\"><strong>4.1 DC Ke\u015ffi ve Secure Channel<\/strong><\/p>\n<\/blockquote>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>nltest \/dsgetdc:DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>nltest \/sc_verify:DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>Ba\u015far\u0131l\u0131 sonu\u00e7lar:<\/strong><\/p>\n<blockquote><p><strong>DC: \\\\DC.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Address: \\\\192.168.10.10<\/strong><\/p>\n<p><strong>Dom Name: DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Forest Name: DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>Trust Verification Status = 0 0x0 NERR_Success<\/strong><\/p><\/blockquote>\n<p><strong>Bu sonu\u00e7lar, DC&#8217;nin yeniden ke\u015ffedilebildi\u011fini ve bilgisayar ile domain aras\u0131ndaki g\u00fcven ili\u015fkisinin do\u011frulanabildi\u011fini g\u00f6sterir.<\/strong><\/p>\n<p><strong>4.2 DNS ve Ping Testleri<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>ipconfig \/flushdns<\/strong><\/p>\n<p><strong>arp -d *<\/strong><\/p>\n<p><strong>nslookup DC.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>ping DC.DOMAIN.LOCAL<\/strong><\/p><\/blockquote>\n<p><strong>DNS sorgusu ve ping ayn\u0131 IP adresini g\u00f6stermelidir:<\/strong><\/p>\n<p><strong>Pinging DC.DOMAIN.LOCAL [192.168.10.10]<\/strong><\/p>\n<p><strong>4.3 Group Policy Testi<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>gpupdate \/force<\/strong><\/p>\n<p><strong>gpresult \/r<\/strong><\/p><\/blockquote>\n<p><strong>E\u011fer daha \u00f6nce al\u0131nan SYSVOL veya gpt.ini hatas\u0131 ortadan kalkm\u0131\u015f ve Group Policy ba\u015far\u0131yla uygulanmaya ba\u015flam\u0131\u015fsa, ba\u015flang\u0131\u00e7ta g\u00f6r\u00fclen Group Policy probleminin asl\u0131nda altyap\u0131daki ba\u011flant\u0131 probleminden kaynakland\u0131\u011f\u0131 anla\u015f\u0131labilir.<\/strong><\/p>\n<ol start=\"5\">\n<li>\n<h4><strong> Domain Controller Taraf\u0131nda Sa\u011fl\u0131k Kontrolleri<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Sorun istemci taraf\u0131nda \u00e7\u00f6z\u00fclemiyorsa veya birden fazla bilgisayar ayn\u0131 problemi ya\u015f\u0131yorsa Domain Controller \u00fczerinde de kontroller yap\u0131lmal\u0131d\u0131r.<\/strong><\/p>\n<p><strong>\u00d6nemli: Bu komutlar DC \u00fczerinde ve y\u00f6netici yetkisiyle \u00e7al\u0131\u015ft\u0131r\u0131lmal\u0131d\u0131r. dcdiag tek ba\u015f\u0131na \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda \u00e7ok uzun s\u00fcrebilir ve baz\u0131 testler ba\u015far\u0131s\u0131z g\u00f6r\u00fcnse bile ortam sa\u011fl\u0131kl\u0131 olabilir. Bu nedenle \u00f6nce k\u0131smi testlerle ba\u015flamak daha verimlidir.<\/strong><\/p>\n<p><strong>K\u0131smi testler:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>dcdiag \/test:dns<\/strong><\/p>\n<p><strong>dcdiag \/test:advertising<\/strong><\/p>\n<p><strong>dcdiag \/test:netlogons<\/strong><\/p><\/blockquote>\n<p><strong>Bu testler, Domain Controller&#8217;\u0131n temel Active Directory servisleri a\u00e7\u0131s\u0131ndan incelenmesine yard\u0131mc\u0131 olur.<\/strong><\/p>\n<blockquote><p>dcdiag \/test:dns<br \/>\n&#8230;<br \/>\nTEST: Delegations (Del)<br \/>\n&#8230;<br \/>\n&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. DC passed test DNS<\/p><\/blockquote>\n<p><span class=\"\">her testin sonunda <\/span><code>passed<\/code><span class=\"\"> veya <\/span><code>failed<\/code><span class=\"\"> sat\u0131r\u0131 g\u00f6r\u00fcn\u00fcr<\/span><\/p>\n<p><strong>Replikasyon kontrol\u00fc (birden fazla DC olan ortamlarda):<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>repadmin \/replsummary<\/strong><\/p>\n<p><strong>repadmin \/showrepl<\/strong><\/p><\/blockquote>\n<ul>\n<li><strong>repadmin \/replsummary \u2192 t\u00fcm DC&#8217;ler aras\u0131 replikasyonun \u00f6zetini verir.<\/strong><\/li>\n<li><strong>repadmin \/showrepl \u2192 belirli bir DC&#8217;nin replikasyon detaylar\u0131n\u0131 verir.<\/strong><\/li>\n<\/ul>\n<p><strong>Tek Domain Controller bulunan bir ortamda repadmin kontrollerinin anlam\u0131 s\u0131n\u0131rl\u0131d\u0131r; bu komutlar \u00f6zellikle birden fazla DC bulunan yap\u0131larda \u00f6nem kazan\u0131r. \u00c7oklu DC ortamlar\u0131nda replikasyon sorunlar\u0131, AD verilerinin ve SYSVOL\/Group Policy yap\u0131s\u0131n\u0131n tutars\u0131z hale gelmesine neden olabilece\u011finden ayr\u0131ca kontrol edilmelidir.<\/strong><\/p>\n<ol start=\"6\">\n<li>\n<h4><strong> H\u0131zl\u0131 Referans: Komutlar ve Do\u011frulama S\u0131ras\u0131<\/strong><\/h4>\n<\/li>\n<\/ol>\n<h4><strong>6.1 \u0130stemci \/ \u00dcye Sunucu \u00dczerinde<\/strong><\/h4>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>whoami<\/strong><\/p>\n<p><strong>echo %logonserver%<\/strong><\/p>\n<p><strong>echo %userdnsdomain%<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>nltest \/dsgetdc:DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>nltest \/sc_query:DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>nltest \/sc_verify:DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>nslookup DC.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>ping DC.DOMAIN.LOCAL<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>ipconfig \/all<\/strong><\/p>\n<p><strong>arp -a<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>dir \\\\DOMAIN.LOCAL\\SYSVOL<\/strong><\/p>\n<p><strong>dir \\\\DOMAIN.LOCAL\\NETLOGON<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>gpupdate \/force<\/strong><\/p>\n<p><strong>gpresult \/r<\/strong><\/p>\n<p><strong>\u00a0<\/strong><strong>w32tm \/query \/status<\/strong><\/p>\n<p><strong>w32tm \/query \/source<\/strong><\/p>\n<p><strong>w32tm \/query \/configuration<\/strong><\/p><\/blockquote>\n<h4><strong>6.2 Domain Controller \u00dczerinde<\/strong><\/h4>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>dcdiag \/test:dns<\/strong><\/p>\n<p><strong>dcdiag \/test:advertising<\/strong><\/p>\n<p><strong>dcdiag \/test:netlogons<\/strong><\/p><\/blockquote>\n<p><strong>Birden fazla DC varsa:<\/strong><\/p>\n<p><strong>cmd \u00fczerinde<\/strong><\/p>\n<blockquote><p><strong>repadmin \/replsummary<\/strong><\/p>\n<p><strong>repadmin \/showrepl<\/strong><\/p><\/blockquote>\n<h4><strong>6.3 Komutlar\u0131n Ne S\u00f6yledi\u011fini Bilmek \u00d6nemlidir<\/strong><\/h4>\n<table width=\"752\">\n<thead>\n<tr>\n<td><strong>Kontrol<\/strong><\/td>\n<td><strong>Ne ara\u015ft\u0131r\u0131l\u0131r?<\/strong><\/td>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>whoami<\/strong><\/td>\n<td><strong>Kullan\u0131c\u0131 yerel mi, domain hesab\u0131 m\u0131?<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>%logonserver%<\/strong><\/td>\n<td><strong>Oturum a\u00e7ma an\u0131nda hangi DC kullan\u0131ld\u0131?<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>%userdnsdomain%<\/strong><\/td>\n<td><strong>Kullan\u0131c\u0131n\u0131n DNS domain&#8217;i<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nltest \/dsgetdc<\/strong><\/td>\n<td><strong>Domain Controller ke\u015ffi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nltest \/sc_query<\/strong><\/td>\n<td><strong>Secure Channel durumu (hafif)<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nltest \/sc_verify<\/strong><\/td>\n<td><strong>Domain g\u00fcven ili\u015fkisi (g\u00fc\u00e7l\u00fc test)<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nslookup DC&#8230;<\/strong><\/td>\n<td><strong>DC DNS \u00e7\u00f6z\u00fcmlemesi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nslookup -type=SRV<\/strong><\/td>\n<td><strong>AD servis kay\u0131tlar\u0131<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>ping DC&#8230;<\/strong><\/td>\n<td><strong>Temel a\u011f eri\u015fimi ve isim \u00e7\u00f6z\u00fcmlemesi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>ipconfig \/all<\/strong><\/td>\n<td><strong>IP, DNS ve a\u011f yap\u0131land\u0131rmas\u0131<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>arp -a<\/strong><\/td>\n<td><strong>IP\/MAC e\u015fle\u015fmeleri ve olas\u0131 \u00e7ak\u0131\u015fma ipu\u00e7lar\u0131<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>SYSVOL \/ NETLOGON<\/strong><\/td>\n<td><strong>DC payla\u015f\u0131mlar\u0131na eri\u015fim<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>gpupdate \/force<\/strong><\/td>\n<td><strong>Group Policy uygulanabiliyor mu?<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>gpresult \/r<\/strong><\/td>\n<td><strong>Hangi GPO&#8217;lar uygulanm\u0131\u015f?<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>w32tm<\/strong><\/td>\n<td><strong>Zaman senkronizasyonu<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>dcdiag<\/strong><\/td>\n<td><strong>Domain Controller sa\u011fl\u0131k kontrolleri<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>repadmin<\/strong><\/td>\n<td><strong>DC replikasyon durumu<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4><strong>6.4 Hata Kodlar\u0131 ve \u0130lk Bak\u0131lacak Alan<\/strong><\/h4>\n<table style=\"height: 361px;\" width=\"949\">\n<thead>\n<tr>\n<td><strong>Hata \/ Belirti<\/strong><\/td>\n<td><strong>\u0130lk Bak\u0131lacak Alan<\/strong><\/td>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>1355 ERROR_NO_SUCH_DOMAIN<\/strong><\/td>\n<td><strong>DNS \/ DC Discovery \/ Netlogon<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>1311 ERROR_NO_LOGON_SERVERS<\/strong><\/td>\n<td><strong>DC eri\u015fimi \/ DNS \/ <span class=\"\">Netlogon servisi \/<\/span>Kerberos \/ KDC<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nltest \/sc_verify ba\u015far\u0131s\u0131z<\/strong><\/td>\n<td><strong>Secure Channel \/ Computer Account<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>gpt.ini okunam\u0131yor<\/strong><\/td>\n<td><strong>SYSVOL \/ DNS \/ DFS \/ DC eri\u015fimi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>gpupdate \/force ba\u015far\u0131s\u0131z<\/strong><\/td>\n<td><strong>GPO \/ SYSVOL \/ DC \/ DNS<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>Source: Local CMOS Clock<\/strong><\/td>\n<td><strong>Windows Time yap\u0131land\u0131rmas\u0131<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>nslookup timeout<\/strong><\/td>\n<td><strong>DNS sunucusu \/ a\u011f eri\u015fimi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>FQDN \u00e7al\u0131\u015f\u0131yor, k\u0131sa isim \u00e7al\u0131\u015fm\u0131yor<\/strong><\/td>\n<td><strong>DNS suffix \/ isim \u00e7\u00f6z\u00fcmleme<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>Ayn\u0131 IP farkl\u0131 MAC&#8217;lere gidiyor<\/strong><\/td>\n<td><strong>IP \u00e7ak\u0131\u015fmas\u0131 \u015f\u00fcphesi<\/strong><\/td>\n<\/tr>\n<tr>\n<td><strong>DC&#8217;ye ping var, AD i\u015flemleri ba\u015far\u0131s\u0131z<\/strong><\/td>\n<td><strong>DNS \/ SRV \/ Netlogon \/ Kerberos<\/strong><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Bu tablo bir &#8220;hata kodu \u2192 kesin neden&#8221; tablosu de\u011fildir. Her hata, ilgili katman\u0131n daha ayr\u0131nt\u0131l\u0131 incelenmesi gerekti\u011fini g\u00f6steren te\u015fhis i\u015faretidir.<\/strong><\/p>\n<ol start=\"7\">\n<li>\n<h4><strong> K\u0131sa Bir Vaka \u00d6rne\u011fi<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Bir m\u00fc\u015fteride sabah saatlerinde birden fazla kullan\u0131c\u0131 &#8220;\u015fifrem \u00e7al\u0131\u015fm\u0131yor&#8221; diye ticket a\u00e7t\u0131. \u0130lk kontrollerde:<\/strong><\/p>\n<ul>\n<li><strong>whoami \u2192 domain hesab\u0131 do\u011fru<\/strong><\/li>\n<li><strong>echo %logonserver% \u2192 \\\\DC beklenen sunucu<\/strong><\/li>\n<li><strong>nltest \/dsgetdc:DOMAIN.LOCAL \u2192 ba\u015far\u0131l\u0131<\/strong><\/li>\n<li><strong>nltest \/sc_verify:DOMAIN.LOCAL \u2192 ba\u015far\u0131s\u0131z (ERROR_ACCESS_DENIED)<\/strong><\/li>\n<\/ul>\n<p><strong>Secure Channel onar\u0131m\u0131 yap\u0131ld\u0131 ancak sorun birka\u00e7 saat sonra tekrar etti. Bu kez arp -a birka\u00e7 kez \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131 ve DC&#8217;nin IP&#8217;sinin bazen farkl\u0131 bir MAC adresine gitti\u011fi g\u00f6r\u00fcld\u00fc. DC \u00fczerinde Event ID 4198 kayd\u0131 vard\u0131.<\/strong><\/p>\n<p><strong>K\u00f6k neden: Yeni kurulan bir cihaz, DHCP yap\u0131land\u0131rmas\u0131ndaki hatal\u0131 adres da\u011f\u0131t\u0131m\u0131 nedeniyle DC taraf\u0131ndan kullan\u0131lan IP adresini kullanmaya ba\u015flam\u0131\u015ft\u0131. DHCP kapsam\u0131ndan bu IP \u00e7\u0131kar\u0131ld\u0131, yaz\u0131c\u0131 yeniden ba\u015flat\u0131ld\u0131 ve istemcilerde ipconfig \/flushdns + arp -d * \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131. Sorun kal\u0131c\u0131 olarak \u00e7\u00f6z\u00fcld\u00fc.<\/strong><\/p>\n<p><strong>\u00c7\u0131kar\u0131m: Secure Channel onar\u0131m\u0131 semptomu ge\u00e7ici olarak d\u00fczeltmi\u015fti; as\u0131l neden IP \u00e7ak\u0131\u015fmas\u0131yd\u0131 ve d\u00fczeltilmeden semptom tekrar ediyordu.<\/strong><\/p>\n<ol start=\"8\">\n<li>\n<h4><strong> IP \u00c7ak\u0131\u015fmas\u0131n\u0131 \u00d6nlemek \u0130\u00e7in<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Domain Controller&#8217;\u0131n IP adresi Active Directory altyap\u0131s\u0131n\u0131n kritik par\u00e7alar\u0131ndan biridir. Bu nedenle:<\/strong><\/p>\n<ul>\n<li><strong>Domain Controller i\u00e7in uygun \u015fekilde yap\u0131land\u0131r\u0131lm\u0131\u015f statik IP kullan\u0131lmal\u0131.<\/strong><\/li>\n<li><strong>DC&#8217;nin IP adresi DHCP havuzundan ayr\u0131lmal\u0131.<\/strong><\/li>\n<li><strong>Ayn\u0131 IP ba\u015fka bir cihazda kullan\u0131lmamal\u0131.<\/strong><\/li>\n<li><strong>DNS kay\u0131tlar\u0131 d\u00fczenli kontrol edilmeli.<\/strong><\/li>\n<li><strong>DHCP ve DNS yap\u0131land\u0131rmalar\u0131 birlikte de\u011ferlendirilmeli.<\/strong><\/li>\n<li><strong>A\u011f \u00fczerinde IP\/MAC e\u015fle\u015fmeleri gerekti\u011finde switch ve DHCP kay\u0131tlar\u0131ndan do\u011frulanmal\u0131.<\/strong><\/li>\n<\/ul>\n<p><strong>\u00d6zellikle bir DC&#8217;nin IP adresinin ba\u015fka bir cihaz taraf\u0131ndan kullan\u0131lmas\u0131, yaln\u0131zca basit bir a\u011f problemi olarak de\u011ferlendirilmemelidir. Active Directory&#8217;nin DNS, Kerberos, LDAP, Netlogon, SMB, SYSVOL ve Group Policy gibi bir\u00e7ok bile\u015feni bu ileti\u015fime ba\u011fl\u0131d\u0131r.<\/strong><\/p>\n<ol start=\"9\">\n<li>\n<h4><strong> Sonu\u00e7<\/strong><\/h4>\n<\/li>\n<\/ol>\n<p><strong>Active Directory ortam\u0131nda &#8220;kullan\u0131c\u0131 ad\u0131 ve parola kabul edilmiyor&#8221; \u015fik\u00e2yeti her zaman parola problemi anlam\u0131na gelmez. \u00d6zellikle ayn\u0131 anda;<\/strong><\/p>\n<ul>\n<li><strong>\\\\DC tekrar kullan\u0131c\u0131 ad\u0131 ve parola istiyorsa,<\/strong><\/li>\n<li><strong>Domain kullan\u0131c\u0131lar\u0131 oturum a\u00e7am\u0131yorsa,<\/strong><\/li>\n<li><strong>nltest 1355 veya 1311 hatalar\u0131 veriyorsa,<\/strong><\/li>\n<li><strong>gpupdate \/force SYSVOL veya gpt.ini hatas\u0131 veriyorsa,<\/strong><\/li>\n<li><strong>DNS sorgular\u0131 ba\u015far\u0131s\u0131z oluyor veya zaman a\u015f\u0131m\u0131na u\u011fruyorsa,<\/strong><\/li>\n<\/ul>\n<p><strong>\u00f6ncelikle Domain Controller eri\u015fimi, DNS, a\u011f yap\u0131land\u0131rmas\u0131 ve IP \u00e7ak\u0131\u015fmas\u0131 kontrol edilmelidir.<\/strong><\/p>\n<p><strong>Bu t\u00fcr bir sorunda en do\u011fru yakla\u015f\u0131m, do\u011frudan NTLM, Kerberos veya Group Policy ayarlar\u0131n\u0131 de\u011fi\u015ftirmek de\u011fil; problemi katman katman daraltmakt\u0131r:<\/strong><\/p>\n<p><strong>Kullan\u0131c\u0131 \/ Oturum<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Domain Controller ke\u015ffi<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0 DNS<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0 A\u011f ba\u011flant\u0131s\u0131<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Secure Channel \/ Netlogon<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>Kerberos \/ LDAP \/ SMB<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>SYSVOL \/ NETLOGON<\/strong><\/p>\n<p><strong>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u2193<\/strong><\/p>\n<p><strong>\u00a0 Group Policy<\/strong><\/p>\n<p><strong>\u0130ncelenen \u00f6rnekte kullan\u0131c\u0131 taraf\u0131nda g\u00f6r\u00fcnen sorun &#8220;domain \u015fifresi kabul edilmiyor&#8221; \u015feklindeydi. Ancak yap\u0131lan kontroller \u2014 \u00f6zellikle arp -a \u00e7\u0131kt\u0131s\u0131 ve Event ID 4198 kayd\u0131 \u2014 problemin kullan\u0131c\u0131 parolas\u0131ndan ziyade Domain Controller&#8217;\u0131n IP adresiyle ilgili bir a\u011f \u00e7ak\u0131\u015fmas\u0131ndan kaynakland\u0131\u011f\u0131n\u0131 ortaya \u00e7\u0131kard\u0131.<\/strong><\/p>\n<p><strong>Bu nedenle Active Directory sorunlar\u0131nda en \u00f6nemli yakla\u015f\u0131m \u015fudur:<\/strong><\/p>\n<blockquote><p><strong>G\u00f6r\u00fcnen hataya de\u011fil, hatan\u0131n olu\u015fmas\u0131na neden olan ileti\u015fim zincirine bak\u0131n. Bazen kullan\u0131c\u0131ya &#8220;\u015fifre yanl\u0131\u015f&#8221; gibi g\u00f6r\u00fcnen problem, asl\u0131nda \u00e7ok daha a\u015fa\u011f\u0131da, DNS veya a\u011f katman\u0131nda ba\u015flam\u0131\u015f olabilir.<\/strong><\/p><\/blockquote>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows Server Domain Giri\u015f Sorunu: DNS, Domain Controller ve IP \u00c7ak\u0131\u015fmas\u0131 Nas\u0131l Tespit Edilir? Active Directory kullan\u0131lan Windows Server ortamlar\u0131nda baz\u0131 sorunlar ilk bak\u0131\u015fta kullan\u0131c\u0131 ad\u0131 veya parola problemi gibi g\u00f6r\u00fcnebilir. \u00d6rne\u011fin: Domain kullan\u0131c\u0131s\u0131 do\u011fru parolay\u0131 girdi\u011fi halde oturum a\u00e7amaz. \\\\DC yaz\u0131ld\u0131\u011f\u0131nda Windows tekrar kullan\u0131c\u0131 ad\u0131 ve parola ister. Daha \u00f6nce eri\u015filebilen a\u011f payla\u015f\u0131mlar\u0131na ula\u015f\u0131lamaz. [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":4104,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[273,274,276,275],"class_list":["post-4637","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft","tag-active-directory","tag-dns","tag-ip-cakismasi","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/comments?post=4637"}],"version-history":[{"count":13,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4637\/revisions"}],"predecessor-version":[{"id":4650,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/posts\/4637\/revisions\/4650"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/media\/4104"}],"wp:attachment":[{"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/media?parent=4637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/categories?post=4637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ozgurguler.net\/blog\/wp-json\/wp\/v2\/tags?post=4637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}