With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.
The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community
Your Input Matters Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.
If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.
Tags:Microsoft, Windows Server, Windows Server 2000, Replication Issues
Hi Experts,
We are having replication issues between our 3 DCs which is causing various issues with our 4 Exchange Servers. All the DCs and Exchange Servers are in different states, but they are all in 1 single domain, 2k.network.com. Examples of problems are: certain mailboxes stop working and wont receive mail, new AD accounts arent showing up on some Exchange Servers, unable to move some mailboxes between Exchange Servers, etc. The problem appears to be rooted at the schema master which is also the main Exchange Server called D2 running Windows 2000 Advanced Server. D2 is getting in the Application Log every 5 minutes this warning:
Event Type: Warning Event Source: SceCli Event Category: None Event ID: 1202 User: N/A Computer: D2 Description: Security policies are propagated with warning. 0x534: No mapping between account names and security IDs was done.
I found Microsoft KB 324383 Troubleshooting SCECLI 1202 Events under the section 0x534: No mapping between account names and security IDs was done. After following step 1 and 2 (creating the ExtensionDebugLevel value and refreshing the policy settings), we type the following and receive:
So NetShowServices is the problem account in the Log on as a service policy.
When I go to Administrative Tools > Local Security Settings > Security Settings > Local Policies > User Rights Assignment > open Log on as a service policy, NetShowServices has an Effective Policy Setting that is checked and greyed out.
To find out more information about the problem policy, I type:
Testing server: Default-First-Site-Name\D2 Starting test: Replications [Replications Check,D2] A recent replication attempt failed: From D1 to D2 Naming Context: CN=Schema,CN=Configuration,DC=2k,DC=network,DC=c om The replication generated an error (1326): Logon failure: unknown user name or bad password. The failure occurred at 2008-02-13 11:55.03. The last success occurred at 2008-01-27 22:56.21. 363 failures have occurred since the last success. Kerberos Error. The machine account is not present, or does not match on the. destination, source or KDC servers. Verify domain partition of KDC is in sync with rest of enterprise. The tool repadmin/syncall can be used for this purpose. [Replications Check,D2] A recent replication attempt failed: From D1 to D2 Naming Context: CN=Configuration,DC=2k,DC=network,DC=com The replication generated an error (1326): Logon failure: unknown user name or bad password. The failure occurred at 2008-02-13 11:55.03. The last success occurred at 2008-01-27 22:56.21. 363 failures have occurred since the last success. Kerberos Error. The machine account is not present, or does not match on the. destination, source or KDC servers. Verify domain partition of KDC is in sync with rest of enterprise. The tool repadmin/syncall can be used for this purpose. [Replications Check,D2] A recent replication attempt failed: From D1 to D2 Naming Context: DC=2k,DC=network,DC=com The replication generated an error (1326): Logon failure: unknown user name or bad password. The failure occurred at 2008-02-13 11:55.03. The last success occurred at 2008-01-27 22:56.21. 363 failures have occurred since the last success. Kerberos Error. The machine account is not present, or does not match on the. destination, source or KDC servers. Verify domain partition of KDC is in sync with rest of enterprise. The tool repadmin/syncall can be used for this purpose. ......................... D2 passed test Replications Starting test: NCSecDesc ......................... D2 passed test NCSecDesc Starting test: NetLogons ......................... D2 passed test NetLogons Starting test: Advertising ......................... D2 passed test Advertising Starting test: KnowsOfRoleHolders ......................... D2 passed test KnowsOfRoleHolders Starting test: RidManager ......................... D2 passed test RidManager Starting test: MachineAccount ......................... D2 passed test MachineAccount Starting test: Services ......................... D2 passed test Services Starting test: ObjectsReplicated ......................... D2 passed test ObjectsReplicated Starting test: frssysvol There are errors after the SYSVOL has been shared. The SYSVOL can prevent the AD from starting. ......................... D2 passed test frssysvol Starting test: kccevent ......................... D2 passed test kccevent Starting test: systemlog An Error Event occured. EventID: 0x80001774 Time Generated: 02/13/2008 12:12:12 Event String: A driver packet received from the I/O subsystem An Error Event occured. EventID: 0x80001774 Time Generated: 02/13/2008 12:12:07 Event String: A driver packet received from the I/O subsystem ......................... D2 failed test systemlog
Running enterprise tests on : 2k.network.com Starting test: Intersite ......................... 2k.network.com passed test Intersite Starting test: FsmoCheck ......................... 2k.network.com passed test FsmoCheck
CN=Schema,CN=Configuration,DC=2k,DC=network,DC=com Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70 Last attempt @ 2008-02-13 11:55.03 was successful. Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Last attempt @ 2008-02-13 11:55.03 failed, result 1326: Logon failure: unknown user name or bad password. Last success @ 2008-01-27 22:56.21. 363 consecutive failure(s).
CN=Configuration,DC=2k,DC=network,DC=com Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Last attempt @ 2008-02-13 11:55.03 failed, result 1326: Logon failure: unknown user name or bad password. Last success @ 2008-01-27 22:56.21. 363 consecutive failure(s). Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70 Last attempt @ 2008-02-13 12:26.58 was successful.
DC=2k,DC=network,DC=com Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Last attempt @ 2008-02-13 11:55.03 failed, result 1326: Logon failure: unknown user name or bad password. Last success @ 2008-01-27 22:56.21. 363 consecutive failure(s). Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70 Last attempt @ 2008-02-13 12:23.39 was successful.
==== OUTBOUND NEIGHBORS FOR CHANGE NOTIFICATIONS ============
CN=Schema,CN=Configuration,DC=2k,DC=network,DC=com Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70
CN=Configuration,DC=2k,DC=network,DC=com Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70
DC=2k,DC=network,DC=com Default-First-Site-Name\D1 via RPC objectGuid: 9526741d-927b-42de-a9e5-b11ae75c5929 Default-First-Site-Name\C1 via RPC objectGuid: 19ec1769-6ab5-4464-973c-856da2414e70
dcdiag and repadmin both showed Error 1326. So I found a Knowledge Base article on this error: Microsoft KB 892426 - Replication error message 1326 and event message ID 1265 "Unknown user name or bad password" on Windows 2000.
The problem with this article and all the other articles I found is we dont have more than one domain. We just have the one domain. And we dont receive the Event ID 1265 in the Directory Service Event Log or any other Log like the article says we should. We do receive an Event that the article mentions:
Event ID: 63 Source: W32Time Description: The time service cannot provide secure (signed) time to client IP because the attempt to validate its computer account failed with error 1317. Falling back to insecure (unsigned) time for this client.
Does anyone know how we can solve our replication problem? Any help is appreciated.
Hi Chris, sorry for the delay in responding. Are you referring to the Administrator account? We use two, the standard built-in Administrator account and another created Administrator account. Both accounts do exist in active directory on the schema master D2 and appear to be normal. D2 uses the created Administrator account. Thank you for your response, please let me know if you need anymore information or want me to try anything.
There's a knowledge base article that will let you reset the Win 2000 Domain Controllers password on the domain (for the Computer Account). I feel this may work towards solving the problem... But...
I have serious reservations about recommending you run this against a DC which is also running Exchange.
I'm tempted to advise you contact Microsoft Product Support Services prior to doing any of this and make sure they agree that it's the correct course of action (or see if they can advise on what is the correct course).
The downside to that, as always, is they'll charge you for it. But you may consider that to be worthwhile.
If you consider the risk worthwhile then here's the KB article:
Thank you for your help Chris, I contacted Microsoft Tech Support and they solved the problems. There were two separate problems: 1. For the 1202 Event ID message they removed the "NetShowServices" account in the "Log on as a service" policy. It wasn't required to be there. 2. The replication problems were caused because the Windows Time service some how got disabled on one of the DCs. After starting the service, it fixed the replication problems and all the other symptoms we were experiencing.
