Windows 2003 Active Directory Group Policy And Site Replication Problems

Here you go:

1) Site structure: All main sites have a site defined and all IP ranges of these sites are linked accordingly. Do I need to create the subnets for the sites that do not have a DC also ? If so, to which site do I link thelm then ? Also I looked and there is one site link whiwh contains all sites. Each site has one DC and they are all assigned as global catalog server. Finally the NTDS settings have a link to each of the other servers per site. (overkill ?)

2) I check each site and they all look fine except:

              Latency information for 3 entries in the vector were ignored.
                 3 were retired Invocations.  0 were either: read-only replicas
and are not verifiably latent, or dc's no longer replicating this nc.  0 had no
latency information (Win2K DC).
           DC=DomainDnsZones,DC=median,DC=local
              Latency information for 3 entries in the vector were ignored.
                 3 were retired Invocations.  0 were either: read-only replicas
and are not verifiably latent, or dc's no longer replicating this nc.  0 had no
latency information (Win2K DC).
           CN=Schema,CN=Configuration,DC=median,DC=local
              Latency information for 6 entries in the vector were ignored.
                 6 were retired Invocations.  0 were either: read-only replicas
and are not verifiably latent, or dc's no longer replicating this nc.  0 had no
latency information (Win2K DC).
           CN=Configuration,DC=median,DC=local
              Latency information for 6 entries in the vector were ignored.
                 6 were retired Invocations.  0 were either: read-only replicas
and are not verifiably latent, or dc's no longer replicating this nc.  0 had no
latency information (Win2K DC).
           DC=median,DC=local
              Latency information for 4 entries in the vector were ignored.
                 4 were retired Invocations.  0 were either: read-only replicas
and are not verifiably latent, or dc's no longer replicating this nc.  0 had no
latency information (Win2K DC).

Is this something to worry about or look further into ?

Also I noticed this ...

       Skipping site France-Lille, this site is outside the scope provided by
       the command line arguments provided.
       Skipping site Belgium-Brussels, this site is outside the scope
       provided by the command line arguments provided.
       Skipping site Germany-HiHo, this site is outside the scope provided by
       the command line arguments provided.
       Skipping site Germany-Heppenheim, this site is outside the scope
       provided by the command line arguments provided.
       Skipping site Spain-Barcelona, this site is outside the scope provided
       by the command line arguments provided.
       Skipping site Sweden-Gothenburg, this site is outside the scope
       provided by the command line arguments provided.
       Skipping site Norway-Oslo, this site is outside the scope provided by
       the command line arguments provided.

What is that about ?

All other tests passed or display correct.

3) ALl ports are open between these sites since they have VPN tunnels in between them that go up on demand.

Thanks

@mpfister

1) I added those

2) I ran the tests and this error comes up ...

* The File Replication Service Event log test
There are warning or error events within the last 24 hours after the
SYSVOL has been shared.  Failing SYSVOL replication problems may cause
Group Policy problems.
An Warning Event occured.  EventID: 0x800034FA
   Time Generated: 10/08/2007   14:30:30
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:32
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:33
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:34
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:35
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:42
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C4
   Time Generated: 10/08/2007   14:32:47
   (Event String could not be retrieved)
An Warning Event occured.  EventID: 0x800034C5
   Time Generated: 10/08/2007   15:53:04
   (Event String could not be retrieved)

3) Only port 42 TCP says NOT LISTENING ...

@DeanC30

On what server do I run this procedure ?

@mpfister

3) Yes I tried in both directions from the DC's themselves querying each other site using RDP.

Hmm strange that this concerns DNS since all DC's are DNS servers also ...

answers :

1) Yes
2) It's own IP address
3) The sites DC aka DNS server
4) This works, also from the site which says port 42 is NOT listening

@DeanC30

Well your solution did solve the errors in the DNS eventlog .. all is smooth in there now ...

I am going to replicate the DC's and see what errors I end up with after this change

After fixing the duplicate partition according to DeanC30's procedure I still have these errors:

1) Event-ID: 13508: The File Replication Service is having trouble enabling replication from MEDFRAD to MEDDEAD for c:\windows\sysvol\domain using the DNS name medfradad.median.local. FRS will keep retrying.

2) Event-ID: 4013 (Only when starting the server) The DNS server was unable to open the Active Directory.  This DNS server is configured to use directory service information and can not operate without access to the directory.  The DNS server will wait for the directory to start.  If the DNS server is started but the appropriate event has not been logged, then the DNS server is still waiting for the directory to start.

3) Event-ID: 1865: The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
 
Sites:
CN=Sweden-Gothenburg,CN=Sites,CN=Configuration,DC=median,DC=local

4) Event-ID: 1311: The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
 
Directory partition:
CN=Configuration,DC=median,DC=local
 
There is insufficient site connectivity information in Active Directory Sites and Services for the KCC to create a spanning tree replication topology. Or, one or more domain controllers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible domain controllers.

5) Event-ID: 5781: Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.median.local.' failed.  These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).  

6) Event-ID: 40960: The Security System detected an authentication error for the server cifs/MEDBEAD.  The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request.
 (0xc000005e)".

7: EVent-ID 1030: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.


It got worse or there are more problems then at first sight

Any ideas ?

Last need I did some work after being put in the right direction by mpfister and DeanC30 (which will both receive part of the points already).

Mp fister put my attention to the fact that I needed to make sure each site was connected properly physically with all ports open. I noticed 2 out of 6 had VPN tunnels that never came up.

DeamC30 described how to resolve the DNS errors.

1) All DNS servers which still had errors after removing the duplicate partition I reinstalled (remove DNS and reinstall DNS), then rebooted.
2) On all dc's then the replication occured with less errors but still the GPO failed. Installed GPO Editor from Microsoft, removed any unexisting links / policies and replicated.
3) On one DC this still gave corrupt sysvol/domain/policies directory so I copied manually to that location.
4) Cleared DSF cach by doing dfsutil /purgemupcache
5) Reboot entire domain and now replication is perfect and no GPO errors anymore on the dc's ...

Now some of my client servers and machine seem to have the GPO working properly also but I still have a lot of then that do not get it:

- tried reboot
- gpupdate /force

but still receive this error ...

Event-ID 1058: Windows cannot access the file gpt.ini for GPO cn={E4440129-4B59-4B53-A13A-27FCF6B1DBDE},cn=policies,cn=system,DC=median,DC=local. The file must be present at the location <\\median.local\SysVol\median.local\Policies\{E4440129-4B59-4B53-A13A-27FCF6B1DBDE}\gpt.ini>. (The system cannot find the path specified. ). Group Policy processing aborted.

This policy t refers to doesn't exist in the domain anymore .. so how do I make it stop looking for it ?

DFSUTIL is for DC's I believe ...

@mpfister

The problem is that this folder does not exist on any SYSVOL\median.local\policies share on any DC.

These machine are looking for a policy that no longer exists and I need to find out how I can force it to stop looking for it ...

@mpfirster

I ran the tool and it produced a heap of error, especially "SYSVOL mismatch". I solved those with http://support.microsoft.com/default.aspx?scid=kb;en-us;828760

Then there were a few "Version mismatch" error and then I rebuild the SYSVOL enterprise wide (http://support.microsoft.com/kb/315457)

Now it seems that replication is taking place errorless, no DNS errors, no File Replication errors and no directory service errors.

Smooth ...

Then GPUPDATE /FORCE on all machines that are still not taking the GPO and that did the trick !