Solved

NTDS Replication EVENTID 1085 problem

Posted on 2004-10-25
2,753 Views
Last Modified: 2010-05-18
I keep getting this EVENTID:1085 (NTDS Replication) every 30 minutes. I had to remove a server from the domain previously for repair to which the "fb65582a-31bb-4486-96a7-75fc0c9e6758._msdcs.domainname.org" refers to below. This is no longer a valid ID, but I do not know where to go to fix this problem. I can seem to find the bad ID anywhere. Anyone able to help here? Of course there is no help worth a poop on MS.

SOURCE "NTDS Replication" EVENTID "1085"
Internal event: Active Directory could not synchronize the following directory partition with the domain controller at the following network address.
 
Directory partition:
DC=domainname,DC=org
Network address:
fb65582a-31bb-4486-96a7-75fc0c9e6758._msdcs.domainname.org
 
If this error continues, the Knowledge Consistency Checker (KCC) will reconfigure the replication links and bypass the domain controller.
 
User Action
Verify that the network address can be resolved with a DNS query.
 
Additional Data
Error value:
8524 The DSA operation is unable to proceed because of a DNS lookup failure.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
Question by:Lazarus
    16 Comments
     
    LVL 3

    Expert Comment

    by:kelo501
    Cut and past for event ID


    This error is displayed because two domain controllers tried to replicate but cant because the machine that is initiating the request cannot find the computer it is trying to replicate with in DNS.  KCC (Knowledge Consistency Checker) will then try and find another route to the detsination machine.  KCC does not always work.  The manual version is to load AD Sites and Services, and display the NTDS settings for the server that is starting the request, and then manaully add a connection for each server that it should be able to replicate with.  If you then right click on each of those connections that you have created, and choose replicate now.  If it works ok - problem solved.  If it fails, then you need to make sure you can ping the FQDN of the machine you are connecting to, and ensure you get a response.  If not - update the DNS server, and all should then start working...  

    No matter what you need to make sure your DNS is correct.  

    Hope this help,
    kelo501
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    Umm... It seems you didn't read the whole question. The "fb65582a-31bb-4486-96a7-75fc0c9e6758._msdcs.domainname.org" is no longer valid and I'm trying to get rid of whatever is making it try to replicate. It does not show up anywhere in the Sites and services or elsewhere.
    0
     
    LVL 3

    Expert Comment

    by:kelo501
    OK sorry about that..

    Did you DCPROMO the domain controller down before you removed it?

    If not how did you remove the server from active directory?

    If you did not dcpromo the old server down before removing it from the network please install the support tools from the server CD and let me know.  We will have to clea up the AD with ntdsutil or adsiedit.

    Just to make sure the server is not in the domain controller OU under active directory users and computers?

    Let me know....

    sorry again did not mean to waste your time.

    kelo501
    0
     
    LVL 3

    Expert Comment

    by:kelo501
    Here is the steps to complete the clean up of AD from the following MS article http://support.microsoft.com/kb/216498

    Procedure
    1. Click Start, point to Programs, point to Accessories, and then click Command Prompt.
    2. At the command prompt, type ntdsutil, and then press ENTER.
    3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur.
    4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do so, type set creds domain nameusernamepassword and press ENTER. For a null password, type null for the password parameter.
    5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server.

    Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message:
    Error 2094. The DSA Object cannot be deleted0x2094  
    6. Type quit, and then press ENTER. The Metadata Cleanup menu appears.
    7. Type select operation target and press ENTER.
    8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number.
    9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine if the server being removed is the last domain controller of that domain.
    10. Type list sites and press ENTER. A list of sites, each with an associated number, is displayed.
    11. Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose.
    12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed.  
    13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name Server (DNS) host name, and the location of the server's computer account you want to remove.
    14. Type quit and press ENTER. The Metadata Cleanup menu appears.
    15. Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message:
    Error 8419 (0x20E3)
    The DSA object could not be found
    the NTDS Settings object may already be removed from Active Directory as the result of another administrator removing the NTDS Settings object, or replication of the successful removal of the object after running the DCPROMO utility.

    Note You may also see this error when you try to bind to the domain controller that is going to be removed. Ntdsutil has to bind to a domain controller other than the one that is going to be removed with metadata cleanup.
    16. Type quit at each menu to quit the Ntdsutil utility. You should receive confirmation that the connection disconnected successfully.
    17. Remove the cname record in the _msdcs.root domain of forest zone in DNS. Assuming that DC is going to be reinstalled and re-promoted, a new NTDS Settings object is created with a new GUID and a matching cname record in DNS. You do not want the DC's that exist to use the old cname record.

    As best practice you should delete the hostname and other DNS records. If the lease time that remains on Dynamic Host Configuration Protocol (DHCP) address assigned to offline server is exceeded then another client can obtain the IP address of the problem DC.
    Now that the NTDS Settings object has been deleted, you can delete the computer account, the FRS member object, the cname (or Alias) record in the _msdcs container, the A (or Host) record in DNS, the trustDomain object for a deleted child domain, and the domain controller. 1. Use ADSIEdit to delete the computer account. To do this, follow these steps: a.  Start ADSIEdit.
    b.  Expand the Domain NC container.
    c.  Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
    d.  Expand OU=Domain Controllers.
    e.  Right-click CN=domain controller name, and then click Delete.
    If you receive the "DSA object cannot be deleted" error when you try to delete the object, change the UserAccountControl value. To change the UserAccountControl value, right-click the domain controller in ADSIEdit, and then click Properties. Under Select a property to view, click UserAccountControl. Click Clear, change the value to 4096, and then click Set. You can now delete the object.

    Note The FRS subscriber object is deleted when the computer object is deleted because it is a child of the computer account.
    2. Use ADSIEdit to delete the FRS member object. To do this, follow these steps: a.  Start ADSIEdit.
    b.  Expand the Domain NC container.
    c.  Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
    d.  Expand CN=System.
    e.  Expand CN=File Replication Service.
    f.  Expand CN=Domain System Volume (SYSVOL share).
    g.  Right-click the domain controller you are removing, and then click Delete.
     
    3. In the DNS console, use the DNS MMC to delete the A record in DNS. The A record is also known as the Host record. To delete the A record, right-click the A record, and then click Delete. Also delete the cname (also known as the Alias) record in the _msdcs container. To do so, expand the _msdcs container, right-click the cname, and then click Delete.

    Important If this was a DNS server, remove the reference to this DC under the Name Servers tab. To do this, in the DNS console, click the domain name under Forward Lookup Zones, and then remove this server from the Name Servers tab.

    Note If you have reverse lookup zones, also remove the server from these zones.
    4. If the deleted computer was the last domain controller in a child domain and the child domain was also deleted, use ADSIEdit to delete the trustDomain object for the child. To do this, follow these steps: a.  Start ADSIEdit.
    b.  Expand the Domain NC container.
    c.  Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
    d.  Expand CN=System.
    e.  Right-click the Trust Domain object, and then click Delete.
     
    5. Use Active Directory Sites and Services to remove the domain controller. To do this, follow these steps: a.  Start Active Directory Sites and Services.
    b.  Expand Sites.
    c.  Expand the server's site. The default site is Default-First-Site-Name.
    d.  Expand Server.
    e.  Right-click the domain controller, and then click Delete
     
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    I did run DCPROMO on the server before I took it down. But I'll try the clean up as well and see if that helps.
    0
     
    LVL 3

    Expert Comment

    by:kelo501
    Hum...

    Before that,  go into adsi edit to the DC container and see if that server is still listed there.  

    What was the server doing that caused it to be removed.

    Can you run dcdiag and netdiag and post any errors from them?

    let me know if you need help running the tools.

    kelo501
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    The "fb65582a-31bb-4486-96a7-75fc0c9e6758._msdcs.domainname.org" Server is no longer listed thats why I can not figure this out.
    No Failures in NetDiag or in DCdiag... The previous Server was removed for simple reasons. It was replaced by a better server.
    0
     
    LVL 3

    Expert Comment

    by:kelo501
    humm.....

    0
     
    LVL 2

    Expert Comment

    by:myron-szy
    I know that this is a solution when the horse has bolted the stable, but something I have done on the network I'm managing is that I keep a hard copy of all the AD related DNS records and other settings.  This has actually got me out of trouble when there was a minor DNS configuration error.  I managed to re-create lost DNS records that have those wonderful and nearly impossible to remember GUID entries.
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    No suitable answers have been given here, so I intend on closing this question... Thanks for trying
    0
     
    LVL 2

    Accepted Solution

    by:
    Are the machine account passwords between domain controllers correct?  There are a few issues that can cause the KCC to screw-up, one common one is the clocks between the domain controllers being wildly different.

    I had a similar problem some months ago and re-synchronising the machine account passwords scured the problem there and then.

    Have you seen the following MS-KB article:
     How To Use Netdom.exe to Reset Machine Account Passwords of a Windows Server 2003 Domain Controller
     http://support.microsoft.com/default.aspx?scid=kb;en-us;325850

    If your network links are secure against hackers then you could even cofnigure the computer policies on the domain controllers to prevent periodic automatic changing of the machine account passwords.  Only do this if there is no risk of any one sniffing data traffic between your domain controllers in an attempt to discover the machine passwords.
    0
     
    LVL 2

    Expert Comment

    by:myron-szy
    Oops.  I misread the original question.  Still worth keeping the comment and what I describe causes the same type of error.
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    myron-szy, This was indeed part of the problem and led me to the rest of the fix. Thanks for pursuing it!
    0
     
    LVL 2

    Expert Comment

    by:myron-szy
    Thanks for accepting the answer.  Out of sheer curiosity, what was the problem you was experiencing with your system?  Maybe a bette rquestion would be, "what caused the problem in the first place?"  I'm assuming that whatever went wrong screwed-up the machine passwords so the related domain controllers became strangers to each other until you re-introduced them and got them to shake hands.

    Hmmm....  Actually, that's a good non-technical way of explaining the `machine password re-sync` solution.
    0
     
    LVL 20

    Author Comment

    by:Lazarus
    I wish I new what actually caused the problem. One day all was fine the next they just stopped speaking to each other. Sort like being married for along time.. LOL They got over it though, with some outside consuling.. Thanks Again
    0
     
    LVL 2

    Expert Comment

    by:myron-szy
    Only thing I can think of is for some strange reason, when machine passwords were exchanged, one or both of the servers did not pick up it's partners new password.  Check the domain controller group policy and make sure that the policy to refuse machine password changes is disabled.  It's that or there is a fault with the KDC.

    If your LAN and WAN links are secure from outside hackers then it may be worth your while do disable the machine password changes for domain controllers.

    Something else to consider is if the removed server contined any of the FMSO's.  If this is the case then you'll need to force a domain controller to take over the missing FMSO roles.  Take care when you do this.

    For instance, if the domain controller held the PDC FMSO, do not force the PDC role onto another server if the removed server will re-appear.

    I think you'll find the following very interesting reading.
     Active Directory Operations Guide
     Appendix B - Procedures Reference
     http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/maintain/opsguide/part2/adogdapb.mspx

    I think I'll have a read of it myself, at least to just refresh my own memory.
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Course: JavaScript Coding - Massive 12-Part Bundle

    Regardless of your programming skill level, you'll go from basics to advanced concepts in a vast array of JavaScript subjects including Sammy.js, Agility.js, Ember.js, Node.js, jQuery, AJAX, Extjs, AngularJS, Knockout.js, and JSON.

    Suggested Solutions

    Title # Comments Views Activity
    Windows 7 Updates 11 61
    home drive migration 16 43
    DNS Records Deleted? 12 49
    formating cluster disk 6 45
    Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
    I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
    This Experts Exchange video Micro Tutorial shows how to tell Microsoft Office that a word is NOT spelled correctly. Microsoft Office has a built-in, main dictionary that is shared by Office apps, including Excel, Outlook, PowerPoint, and Word. When …
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    856 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now