title: Cannot create an AD Connector in AWS Workspace
body: <p>I am starting to do some familiarization/testing with AWS Workspaces, but we want to use our own AD for the authentication, so I created a small Win2K12 AWS instance and installed AD (and associated DNS server) on it.</p>
  
  <p>Then, I wanted to try to create an AD Connector, but I have been trying for several days to get it working, and failing. I have tried a bunch of different configurations, but I am getting Failed, with one of two types of errors:</p>
  
  <p>1) I get errors indicating there are not SRV records in the AD for ldap an Kerberos. But looking that my DNS server (via the Windows DNS applet) I can see SRV records for "ldap" and "Kerberos". In fact, I see several different set, in different locations in the DNS.</p>
  
  <p>OR</p>
  
  <p>2) The other error I get is that it says that the DNS server doesn't exist on port 53. This is even if I turn off the Windows firewall.</p>
  
  <p>Here is an actual example of one of the SRV error messages:</p>
  
  <p>"Configuration issues detected: SRV record for LDAP does not exist for IP: 192.168.0.xxx, SRV record for Kerberos does not exist for IP: 192.168.0.xxx. Please verify existing configuration and retry the operation."</p>
  
  <p>Some additional comments:
  The AD instance is a pretty simple one, just an AD+DNS on that one AWS instance. </p>
  
  <p>Also, the security group I use is basically completely open, both for input and output.</p>
  
  <p>I have run the small script for testing the AD (from the prerequisites doc) and that works, except that when it does the forest and domain functional tests, they are giving "Unknown" for the type and also, for some reason the TCP/port 5722 test is failing. Also, sometimes, I get an error saying the domain "could not be found". This test seems to also sometimes get different results depending on which machine the test script is run on.</p>
  
  <p>Also, I made another Win2K12 instance and was able to join that instance to that AD domain, so it seems like the AD and probably the DNS server, are, in general, "working", but I just cannot figure out how to get the AD connector created successfully, so if anyone has any idea what might be wrong, please help!</p>
  
  <p>Thanks in advance,
  Jim</p>
  
  <p>EDIT:
  Here is what running the directory test command gives:</p>
  
  <p>E:>DirTest\DirectoryServicePortTest.exe -d "domain.dev" -ip "192.168.0.xxx" -tcp "53,88,135,389,445,3268,5722,9389" -
  udp "53,88,123,138,389,445"
  Testing forest functional level.
  Forest Functional Level = Unknown : FAILED</p>
  
  <p>Testing domain functional level.
  Domain Functional Level = Unknown : FAILED</p>
  
  <p>Testing TCP ports to 192.168.0.xxx:
  Checking TCP port 53: PASSED
  Checking TCP port 88: PASSED
  Checking TCP port 135: PASSED
  Checking TCP port 389: PASSED
  Checking TCP port 445: PASSED
  Checking TCP port 3268: PASSED
  Checking TCP port 5722: FAILED
  Checking TCP port 9389: PASSED</p>
  
  <p>Testing UDP ports to 192.168.0.xxx:
  Checking UDP port 53: PASSED
  Checking UDP port 88: PASSED
  Checking UDP port 123: PASSED
  Checking UDP port 138: PASSED
  Checking UDP port 389: PASSED
  Checking UDP port 445: PASSED</p>
  
  <p>EDIT: I've been continuing to get this working.  No success so far, but I enabled debug on the DNS server, and while I don't have a solution thus far, I think that it looks something like maybe something is tacking on "ec2.internal" to the DNS FQDN.  I was able to get it to now at least see the DNS server by creating the AD domain as "ec2.internal" and netbios "ec2", but now I am getting errors about missing SRV records for LDAP and Kerberos.  I can see that _ldap and _kerberos SRV records are ACTUALLY there, in the DNS, but I think they are like .ec2.internal, but it is looking for .ec2.internal.ec2.internal, and I have been manually going through the DNS and adding those records, but it is still failing with the missing SRV records for some reason :(...</p>