Windows 2000 Server Cannot Join Existing ISA Array

When you install a new ISA Server-based computer into an existing ISA Server array, you may receive the following error message:

This issue can occur if the new ISA Server computer does not meet the following requirements to install a new ISA Server computer into an existing ISA array or cannot verify them:

• The new ISA Server computer is a member of the same Microsoft Windows 2000 domain as the ISA Server computers that are in the target ISA array, prior to ISA Server being installed on the computer.
• The new ISA Server computer is in the same Active Directory site as the ISA Server computers that are in the target ISA array, prior to ISA being installed on the computer.

During an ISA Server installation, the target server uses a Domain Name System (DNS) server to verify which computers are in its domain and site. If the server cannot find other ISA Server computers in its domain or site by querying DNS, it is not able to join an existing ISA array. ISA Server Setup is limited to configuring the new ISA Server computer as a stand-alone ISA Server computer.

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this issue, verify the target server's configuration before you try to install ISA Server:

1. Verify the server's domain membership. To do so, on the desktop of the server, right-click My Computer, click Properties, and then click the Network Identification tab. The domain that is listed on this tab should match the domain that is listed on the same tab of the ISA Server computers in the existing ISA array. If its not, change it accordingly.
2. Verify what Active Directory site the server is in by looking at a value that is set in the registry on the server. Use Registry Editor (Regedt32.exe) to view the DynamicSiteName value in the following registry key:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters
   The site name that is specified by this registry value should match the site that the ISA Server computers in the existing ISA array are in. At the same location in the registry, check if a SiteName registry value has been added. This value statically configures a server's site. If this value has been added, ensure that it specifies the same site as the other servers that already exist in the target ISA array.
   
   If the new ISA Server computer is not a member of the same Active Directory site as the servers in the target ISA array, move the new ISA Server computer into the correct site and re-install ISA Server. Refer to Windows 2000 Server Help for instructions about how to change Active Directory sites.
3. If the new ISA Server computer is a member of the same domain and in the same Active Directory site as the other ISA Server computers in the ISA array, but you still receive the error message that is listed in the "Symptoms" section of this article, it is likely that DNS issues are the cause.
   
   As noted in Request For Comment (RFC) 2136, Windows 2000 supports dynamic DNS updates. Each Windows 2000 server registers Host (A) record(s), Pointer (PTR) records, and Service (SRV) records with a DNS server. Alternatively, you must manually configure a server's records in the correct zones within DNS.
   
   Windows 2000 servers also use these records to locate Windows 2000 domains and Active Directory sites. If a Windows 2000 server has not successfully registered its DNS records with a DNS server, other Windows 2000-based computer cannot locate the server and its services. For additional information about how domain controllers are located in Windows 2000, click the article number below to view the article in the Microsoft Knowledge Base:
   247811� How Domain Controllers Are Located in Windows 2000
   The ISA installation Wizard relies on this DNS mechanism to determine Windows 2000 domain and Active Directory site membership. If the new ISA Server computer cannot find other ISA Server computers in its own domain or site, it only allows ISA Server to be installed as a stand-alone ISA Server computer. It is critical that the new ISA Server computer be configured to use one or more DNS servers and that it registers its DNS records properly with those servers before the ISA Server installation process starts. During the ISA Server installation process, the new server tries to verify what Active Directory site it is in, and find other servers that are in the same site. If the new ISA Server computer cannot query DNS or receives negative responses from DNS during this process, the new ISA server will not be able to join an exiting ISA array.
   
   To ensure that the new ISA Server computer has registered with DNS properly, and that ISA Server computers in the target ISA array are also registered with DNS properly, run the netdiag.exe /test:dns /fix /v command on all ISA Server computers. For more detail, run the netdiag.exe /debug /fix /v command on all ISA Server computers.
   
   When you run the Netdiag.exe utility with these command-line switches, it tests whether all of the server's DNS records (A, PTR, and SRV) are registered with all of the configured DNS servers and can be found successfully. If some DNS registrations are missing, the utility attempts to re-register the server's records with its configured DNS servers. The utility generates a report that indicates the results of the tests, and any re-registration attempts. The Netdiag.exe utility is installed with the Windows 2000 Support Tools. For additional information about Netdiag.exe, click the article number below to view the article in the Microsoft Knowledge Base:
   265706� DCDiag/NetDiag in Windows 2000 Facilitate Join and DC Creation
   All DNS issues on the new ISA Server computer and on all ISA Server computers in the target ISA array should be resolved before you try to install new ISA Server computers into the array.