Solved

Windows 2003 Active Directory is not replicating.

Posted on 2004-09-24
17
11,963 Views
Last Modified: 2010-06-29
Here is the situation. We have a Windows 2003 server (I'll refer to as WORKSVR) running active directory and DNS, containing about 1000 users. I recently aquired a new rackmount server ( i will refer to as RACK) in which I would like to promote as the server and then get rid of the WORKSVR. After some work I was able to add the RACK as a DC, but replication is not working.

When running a dcdiag on the WORKSVR, everything runs successfully except the following output:

Starting test: MachineAccount
   * worksvr is not a server trust account
   The corresponding flag bits are missing from the computer object's
   User-Account-Control attribute. You can re-run this command and
   include the /FixMachineAccount option to attempt a repair.
   ......................... worksvr failed test MachineAccount

WHEN I run dcdiag /FixMachineAccount as stated, I get the following error:

Starting test: MachineAccount
   * worksvr is not a server trust account
   Cannot repair the computer account flags. The error is 8341
   ......................... worksvr failed test MachineAccount


In the NTFRS log contains one error that stood out:

<ThSupWaitThread:               1880:   533: S1: 17:35:28> :S: ReplicaCs: normal wait
<FrsDsFindComputer:             1992:  8786: S2: 17:35:48> :DS: Computer FQDN is cn=worksvr,ou=domain controllers,dc=medlab,dc=medadmin,dc=med,dc=wisc,dc=edu
<FrsDsFindComputer:             1992:  8792: S2: 17:35:48> :DS: Computer's dns name is worksvr.medlab.medadmin.med.wisc.edu
<FrsDsFindComputer:             1992:  8806: S2: 17:35:48> :DS: Settings reference is cn=ntds settings,cn=worksvr,cn=servers,cn=default-first-site-name,cn=sites,cn=configuration,dc=medlab,dc=medadmin,dc=med,dc=wisc,dc=edu
<FrsDsGetSubscriptions:         1992:  8426: S0: 17:35:48> :DS: No NTFRSSubscriptions object found under cn=worksvr,ou=domain controllers,dc=medlab,dc=medadmin,dc=med,dc=wisc,dc=edu!.
<SERVER_FrsRpcStartPromotionParent:1984:  1852: S0: 17:36:11> :S: SERVER Start Promotion Parent:
<SERVER_FrsRpcStartPromotionParent:1984:  1853: S0: 17:36:11> :S:      Partner      : infolabsvr.medlab.medadmin.med.wisc.edu
<SERVER_FrsRpcStartPromotionParent:1984:  1854: S0: 17:36:12> :S:      PartnerPrinc : MEDLAB\INFOLABSVR$
<SERVER_FrsRpcStartPromotionParent:1984:  1855: S0: 17:36:12> :S:      AuthLevel    : 0
<SERVER_FrsRpcStartPromotionParent:1984:  1856: S0: 17:36:12> :S:      Account      : (null)
<SERVER_FrsRpcStartPromotionParent:1984:  1857: S0: 17:36:12> :S:      SetName      : DOMAIN SYSTEM VOLUME (SYSVOL SHARE)
<SERVER_FrsRpcStartPromotionParent:1984:  1858: S0: 17:36:12> :S:      SetType      : Domain
<SERVER_FrsRpcStartPromotionParent:1984:  1859: S0: 17:36:12> :S:      CxtionName   : worksvr.medlab.medadmin.med.wisc.edu
<LOCAL_FrsRpcVerifyPromotionParent:1984:  1693: S0: 17:36:12> :S: SERVER Verify Promotion Parent:
<LOCAL_FrsRpcVerifyPromotionParent:1984:  1694: S0: 17:36:12> :S:      SetName  : DOMAIN SYSTEM VOLUME (SYSVOL SHARE)
<LOCAL_FrsRpcVerifyPromotionParent:1984:  1695: S0: 17:36:12> :S:      SetType  : Domain
<FrsDsVerifyPromotionParent:    1984:  5582: S0: 17:36:12> :S: ERROR - DOMAIN SYSTEM VOLUME (SYSVOL SHARE) does not exist on WORKSVR!
<LOCAL_FrsRpcVerifyPromotionParent:1984:  1724: S0: 17:36:12> ++ ERROR - verifying set DOMAIN SYSTEM VOLUME (SYSVOL SHARE) on parent WORKSVR;  WStatus: ERROR_NOT_FOUND
<SERVER_FrsRpcStartPromotionParent:1984:  1867: S0: 17:36:12> ++ ERROR - verify;  WStatus: FRS_ERR_SYSVOL_POPULATE


Any help would be greatly appreciated!


0
Comment
Question by:HSLC-INFOLAB
  • 7
  • 7
17 Comments
 
LVL 16

Expert Comment

by:JamesDS
ID: 12145657
HSLC-INFOLAB

This is almost certainly DNS related but there are other issues here too.
Please provide an IPCONFIG /ALL output from each DC and the output from netdiag from the support tools pack.
Download DUMPFSMOS from here and post the output: http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/dumpfsmos-o.asp

This is the Windows 2000 version of the tool, but it will work on Windows 2000, and 2003

If SYSVOL is missing off the existing DC and there is no copy on the newly promoted DC then you will have to restore it from backup. SYSVOL can be recovered from scratch, but it's painful and takes a while to do and each GPO will have to be rebuilt by hand as text files. I did one of these recently and it took almost 6 hours from start to finish using Terminal Services. Let's hope you have a copy somewhere!

Until you have a fully working copy of the AD database, including sysvol you will not be able to successfully promote and replicate a new DC.

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12145914
** Here is the dump of the FSMOS roles from the tool run on WORKSVR:

ntdsutil: roles
fsmo maintenance: Connections
server connections: Connect to server worksvr
Binding to worksvr ...
Connected to worksvr using credentials of locally logged on user.
server connections: Quit
fsmo maintenance: select Operation Target
select operation target: List roles for connected server
Server "worksvr" knows about 5 roles
Schema - CN=NTDS Settings,CN=worksvr,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Domain - CN=NTDS Settings,CN=worksvr,CN=Servers,CN=Default-First-Site-Name,CN=Si
tes,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
PDC - CN=NTDS Settings,CN=worksvr,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
RID - CN=NTDS Settings,CN=worksvr,CN=Servers,CN=Default-First-Site-Name,CN=Sites
,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Infrastructure - CN=NTDS Settings,CN=worksvr,CN=Servers,CN=Default-First-Site-Na
me,CN=Sites,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
select operation target: Quit
fsmo maintenance: Quit
ntdsutil: Quit
Disconnecting from worksvr...

** IPCONFIG /ALL from WORKSVR

Windows IP Configuration

   Host Name . . . . . . . . . . . . : worksvr
   Primary Dns Suffix  . . . . . . . : medlab.medadmin.med.wisc.edu
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : medlab.medadmin.med.wisc.edu
                                       medadmin.med.wisc.edu
                                       med.wisc.edu
                                       wisc.edu

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
   Physical Address. . . . . . . . . : 00-0D-56-95-81-4F
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 144.92.47.14
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 144.92.47.1
   DNS Servers . . . . . . . . . . . : 144.92.47.14
                                       144.92.47.15

** IPCONFIG /ALL from BACKUPSVR

Windows IP Configuration

   Host Name . . . . . . . . . . . . : backupsvr
   Primary Dns Suffix  . . . . . . . : medlab.medadmin.med.wisc.edu
   Node Type . . . . . . . . . . . . : Unknown
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : medlab.medadmin.med.wisc.edu
                                       medadmin.med.wisc.edu
                                       med.wisc.edu
                                       wisc.edu

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
   Physical Address. . . . . . . . . : 00-0F-20-D0-D4-B9
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 144.92.47.15
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : 144.92.47.14
                                       144.92.47.15

** NETDIAG from WORKSVR

.....................................

    Computer Name: WORKSVR
    DNS Host Name: worksvr.medlab.medadmin.med.wisc.edu
    System info : Windows 2000 Server (Build 3790)
    Processor : x86 Family 15 Model 2 Stepping 9, GenuineIntel
    List of installed hotfixes :
        KB819696
        KB823182
        KB823353
        KB823559
        KB823980
        KB824105
        KB824141
        KB825119
        KB828035
        KB828741
        KB835732
        KB837001
        KB839643
        KB839645
        KB840315
        KB840374
        KB867801
        Q147222
        Q828026


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : Local Area Connection

        Netcard queries test . . . : Passed

        Host Name. . . . . . . . . : worksvr
        IP Address . . . . . . . . : 144.92.47.14
        Subnet Mask. . . . . . . . : 255.255.255.0
        Default Gateway. . . . . . : 144.92.47.1
        Dns Servers. . . . . . . . : 144.92.47.14
                                     144.92.47.15


        AutoConfiguration results. . . . . . : Passed

        Default gateway test . . . : Passed

        NetBT name test. . . . . . : Passed
        [WARNING] At least one of the <00> 'WorkStation Service', <03> 'Messeng
r Service', <20> 'WINS' names is missing.

        WINS service test. . . . . : Skipped
            There are no WINS servers configured for this interface.


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{DB66616E-8C16-44B5-8312-8636BCCA1BEE}
    1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed
    [WARNING] You don't have a single interface with the <00> 'WorkStation Serv
ce', <03> 'Messenger Service', <20> 'WINS' names defined.


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed
    PASS - All the DNS entries for DC are registered on DNS server '144.92.47.1
' and other DCs also have some of the names registered.
    PASS - All the DNS entries for DC are registered on DNS server '144.92.47.1
' and other DCs also have some of the names registered.


Redir and Browser test . . . . . . : Passed
    List of NetBt transports currently bound to the Redir
        NetBT_Tcpip_{DB66616E-8C16-44B5-8312-8636BCCA1BEE}
    The redir is bound to 1 NetBt transport.

    List of NetBt transports currently bound to the browser
        NetBT_Tcpip_{DB66616E-8C16-44B5-8312-8636BCCA1BEE}
    The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Skipped


Kerberos test. . . . . . . . . . . : Passed


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
    No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Skipped

    Note: run "netsh ipsec dynamic show /?" for more detailed information


The command completed successfully



As it comes to SYSVOL, i'm not too familiar with what to do pertaining to the questions you have asked.


0
 
LVL 16

Expert Comment

by:JamesDS
ID: 12146110
HSLC-INFOLAB
It is very odd that you IPCONFIG show the DNS for worksvr as 144.92.47.14, yet the NETDIAG output shows it as 144.92.47.1. I suspect this is because you missed the last digit off the copy from the dos window, but please confirm.

SYSVOL is a file share located by default on each domain controller at \windows\sysvol\sysvol.
The directory structure starting from \windows\sysvol\ (ie the previous level up) should contain these other directories:
domain
staging
staging areas
sysvol
 
\windows\sysvol\sysvol should contain a directory with the same name as your AD domain ie medlab.medadmin.med.wisc.edu under which is two more directories called policies and scripts.
This is where your GPOs live.

Look in the File Replication Service Event Log and post a recent example of one of the many errors you will have there.

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12146273
Hey JamesDS.

I apologize, the DNS was correct, I missed the last digit on the post.

On 9\1 this event exists

Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller testwss.medlab.medadmin.med.wisc.edu for FRS replica set configuration information.
 
 Could not bind to a Domain Controller. Will try again at next polling cycle.

 Under directory service

On 9\24 this exists

The attempt to establish a replication link for the following writable directory partition failed.
 
Directory partition:
CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Source domain controller:
CN=NTDS Settings,CN=BACKUPSVR,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wi
Source domain controller address:
c11609f3-78fe-4f35-93d3-eabc59e2ebab._msdcs.medlab.medadmin.med.wisc.edu
Intersite transport (if any):
 
 
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  
 
User Action
Verify if the source domain controller is accessible or network connectivity is available.
 
Additional Data
Error value:
8453 Replication access was denied.

For more information, see Help and Support Center at



AND


The attempt to establish a replication link for the following writable directory partition failed.
 
Directory partition:
CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Source domain controller:
CN=NTDS Settings,CN=BACKUPSVR,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wi
Source domain controller address:
c11609f3-78fe-4f35-93d3-eabc59e2ebab._msdcs.medlab.medadmin.med.wisc.edu
Intersite transport (if any):
 
 
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  
 
User Action
Verify if the source domain controller is accessible or network connectivity is available.
 
Additional Data
Error value:
8453 Replication access was denied.





shank
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12146297
Might I add, my whole goal is to get my AD functional, then rebuild my rack server (backupsvr) as INFOLABSVR with a new IP, and permanently have AD on that server, leaving worksvr behind.


I hope this can be done!
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 12146454
HSLC-INFOLAB
Strange one this, there is something I am not seeing.

was worksvr the original DC, or was there another one that got removed a while ago?

Take a look at this KB article and tell me if it applies:
http://support.microsoft.com/default.aspx?scid=kb;en-us;329860

Also, you didn't tell me about your sysvol

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12146548
Hey James.

There was another server. And I promoted this one (worksvr) and it was working, but when it came time to put AD On my new rack server, here were my problems.

Heres the output from readmin.


C:\PROGRA~1\Resource Kit>repadmin /showreps
Default-First-Site-Name\worksvr
DC Options: IS_GC
Site Options: (none)
DC object GUID: 24952dbc-927d-451f-a745-6bc805a10f0a
DC invocationID: c46ed2ad-21f3-4985-8068-ba3d88e1ebad


Source: Default-First-Site-Name\BACKUPSVR
******* 382 CONSECUTIVE FAILURES since 2004-09-20 10:54:05
Last error: 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup failu
re.

Naming Context: CN=Schema,CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,
DC=edu
Source: Default-First-Site-Name\BACKUPSVR
******* WARNING: KCC could not add this REPLICA LINK due to error.

Naming Context: CN=Configuration,DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Source: Default-First-Site-Name\BACKUPSVR
******* WARNING: KCC could not add this REPLICA LINK due to error.

Naming Context: DC=medlab,DC=medadmin,DC=med,DC=wisc,DC=edu
Source: Default-First-Site-Name\BACKUPSVR
******* WARNING: KCC could not add this REPLICA LINK due to error.


As far as SYSVOL goes, the directories seem to be there on worksvr. The errors I posted are from event viewer.
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 16

Expert Comment

by:JamesDS
ID: 12146654
HSLC-INFOLAB

It looks like something might have gone a bit wrong when the original server was removed and worksvr was put in - but it wasn't bad enough to stop it working then.

ok, what about the link I posted, does this help you any more?

On worksvr AND backupsvr, run these commands:
net stop netlogon
net start netlogon

wait 10 minutes and then re-run repadmin and tell me if the output changes

I have to sign off now (it is after 8pm here), but i'll take a look back in the morning. See my profile if you want to get in touch some other way.

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12146967
Hey James, I appreciate the help. I followed your steps involving the net stop start commands.
After running repadmin again I recevied the same errors, errors pertaining to the replica Link.



shank
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 12147032
HSLC-INFOLAB
£$%^&*!!

worth a try tho, sometime AD is capable of repairing itself.
I think you need to get someone to dial in and see it for themselves. I am not allowed to tout for business on EE, but I do rather lot of these :)

Now I really am signing off, I haven't had any dinner yet and there's a distinct danger of getting thin!

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12147530
JamesDS.

EE is my only option really for help. So do you think I am basically out of luck on this issue unless someone comes and see for their self this problem? We do have the ability to remote control through the 2003 server.


shank
0
 
LVL 16

Expert Comment

by:JamesDS
ID: 12147890
HSLC-INFOLAB
I would first call microsoft PSS support, it is likely to be the cheaper option. But after that, yes your best best is to get someone to take a look in person either on site or remotely over terminal services.

Cheers

JamesDS
0
 

Author Comment

by:HSLC-INFOLAB
ID: 12194894
Ah microsoft PSS support isn't really an option we go choose. So there is no other way to just copy users and bring them to a  new domain without replication?
0
 
LVL 16

Accepted Solution

by:
JamesDS earned 500 total points
ID: 12198022
HSLC-INFOLAB
Sorry, you still have to have replication working for the domain to function properly.

You can DCPRomo Windows 2003 DCs using a backup of the Database. This is used to DCPromo servers over slow WAN links. Even once the database is across tho, you still need replication, or after 60 days the second system will tombstone and stop responding to requests.

If you can't use Microsoft PSS support and are not able to work through the problem yourself, then you will have to hire someone.

Sorry, but there really isn't anything more I can suggest on this one.

Cheers

JamesDS
0
 

Expert Comment

by:neilhu
ID: 14703851
I had a similar problem.  I turned out that the secure channel between the two domain controllers (mine happened to be in different sites) had been corrupted.   Try the following steps to see if this is your issue and then how to fix.

If you have 2 Active Directory Servers that are not replicating, ServerA & ServerB, try the following:

From ServerA, go to Start -> Run and type:  \\ServerB
From ServerB, go to Start -> Run and type:  \\ServerA

If  from ServerA you get and error message indicating that the target name is incorrent, then the the secure channel has been corrupted.  Same Vice-Versa.  You will also see error messages in replmon and repadmin debug indicating that the target is invalid as well.

In My case, I could not get to \\ServerB from ServerA.  The Secure channel on ServerA for ServerB had been corrupted and I had to reset it.  I had to perform the following steps to fix the problem:

a.  Stop the Kerberos Key Distribution Center (KDC) service, and then set it to Manual startup.
b.  Run the netdom command:

resetpwd /server:replication_partner_server_name /userd:domain_name\admin_user /passwordd:*

c.  Restart the computer, start the KDC, and then set it back to Automatic startup.


These commands can be found in the following Microsoft KB:

http://support.microsoft.com/default.aspx?scid=kb;en-us;329721

Hope this helps some one!
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Suggested Solutions

Many of us need to configure DHCP server(s) in their environment. We can do that simply via DHCP console on server or using MMC snap-in on each computer with Administrative Tools installed in a network. But what if we have to configure many DHCP ser…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now