Event Id 1864, NTDS replication error

I have NTDS replication error event id 1864 on Windows 2003 domain. Current setup is one single domain with 15 sites (and growing). Each site have 2 DCs + DNS. One DC at one site start having replication error event id 1864. How do I fix this? Is this the reason why Group Policy takes very long to update changes even after running gpupdate?
thophamAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Nirmal SharmaSolution ArchitectCommented:
Make sure DNS Servers are working properly...its an RPC issue..
0
joedoe58Commented:
Hi,
What do you find in the event log on the DC that has the problem. You found 1864 but is there any other message before that in the same log or in another log that inidcates that you have problem with replication. Have you tried REPLMON to try a manual replication and when you did did you check that you want replication across boundaries.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

thophamAuthor Commented:
This is what the event viewer log said:

Source NTDS Replication
Category Replication
Event ID 1864
User NT AUTHORITY\ANONYMOUS LOGON
This is the replication status for the following directory partition on the local domain controller.
Directory partition:
DC=DomainDnsZones,DC=localdomain,DC=com

The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals.

More than 24 hours:
2
More than a week:
2
More than one month:
1
More than two months:
1
More than a tombstone lifetime:
1
Tombstone lifetime (days):
60
Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.

To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe.

You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency <partition-dn>".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp
0
joedoe58Commented:
Did you do any changes in the routers or firewalls between the servers? did you run the tools mentioned in the error message and if so what did they report?
0
thophamAuthor Commented:
I did not make any changes on routers. Ran REPLMON, it reports replication between  DCs good. Still got the Event ID 1864 every 24 hours.
0
Nirmal SharmaSolution ArchitectCommented:
*** Quote ***

On domain controllers that are running Windows Server 2003, the up-to-dateness vector includes a timestamp that represents the last time the local (destination) domain controller has completed a full replication cycle with the source domain controller. The replication cycle may have occurred directly (direct replication partner) or indirectly (transitive replication partner). The timestamp is recorded whether or not the local domain controller actually received any changes from the partner.

By examining the timestamps, a domain controller can quickly identify other domain controllers that are not replicating. Warning messages are posted to the event log on each domain controller when non-replicating partners are discovered (Event ID 1864 in the Directory Service event log).

*** End Quoate ***
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Nirmal SharmaSolution ArchitectCommented:
Did you try manual replication ?

Top three causes of AD replication failure:

1) Missing or incorrect DNS settings on one or more DCs
2) Firewall is enabled on the network interface of one or more DCs
3) Incorrect date/time on one or more DCs

Troubleshooting replication:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/standard/proddocs/en-us/sag_adsite_trouble_1.asp 

Thankx
SystmProg
0
Nirmal SharmaSolution ArchitectCommented:
Thanks :-) did u solve the problem ?
0
joedoe58Commented:
Yes I would also appreciate to know what the soultion to the problem was
0
thophamAuthor Commented:
No, the problem has not been solved. Replications between DCs are fine. I just don't know what generating the error. I have to get 10 more sites into the AD by the end of March. Will come back to the error after the migration. Thanks for all of your feedbacks.
0
rbollinger1212Commented:
WEll I know what my problem is...


I am getting the same error as you... I ran the dcdiag command and it appears that another test domain controller is still on the "replicate to me" list.

I pulled the dns records out and I am still getting the same error of:

Event Type:      Error
Event Source:      NTDS Replication
Event Category:      (5)
Event ID:      1864
Date:            4/12/2005
Time:            3:03:55 PM
User:            NT AUTHORITY\ANONYMOUS LOGON
Computer:      BIGDOG
Description:
This is the replication status for the following directory partition on the local domain controller.
 
Directory partition:
DC=ForestDnsZones,DC=NewRealty,DC=net
 
The local domain controller has not recently received replication information from a number of domain controllers.   The count of domain controllers is shown, divided into the following intervals.
 
More than 24 hours:
1
More than a week:
1
More than one month:
1
More than two months:
0
More than a tombstone lifetime:
0
Tombstone lifetime (days):
60
 Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.
 
To identify the domain controllers by name, install the support tools included on the installation  CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest.   The command is "repadmin /showvector /latency <partition-dn>".

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


How can i resolve this issue? apparently pulling out the dns records was/is not enough...

Please advise...



Robert

0
Unknown_And_HiddenCommented:
Hello Guys I also experience this problem, I see that the question has been closed, but I am not clear on the resolution
0
sumeshbnrCommented:
Also I noticed that my PDC has the replication erros has been occureing before I install ADS .

PDC is an an upgraded one from win2000




This is the replication status for the following directory partition on the local domain controller.
 
Directory partition:
CN=Configuration,DC=MSSERVER
 
The local domain controller has not recently received replication information from a number of domain controllers.   The count of domain controllers is shown, divided into the following intervals.
 
More than 24 hours:
1
More than a week:
1
More than one month:
1
More than two months:
1
More than a tombstone lifetime:
1
Tombstone lifetime (days):
60
 Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.
 
To identify the domain controllers by name, install the support tools included on the installation  CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest.   The command is "repadmin /showvector /latency <partition-dn>".

0
sumeshbnrCommented:
sorry wrong place
0
vanleeuwenCommented:
IN November I added a (first) Windows 2008 R2 server as a DC to the domain (fully W2003) and it seems that server is the one in my network that is causing this message....

a dcdiag gives me the name of that W2008 R2 machine telling me its over its 60 days...

 REPLICATION-RECEIVED LATENCY WARNING
 <servername>:  Current time is 2011-02-02 08:28:12.
    DC=ForestDnsZones,DC=<DCName>,DC=com
       Last replication recieved from <servername> at 2010-11-23 10:20:54.
       WARNING:  This latency is over the Tombstone Lifetime of 60 days!
etc.

however, it can ping all other servers etc without problems...during its promotion (dcpromo) back in November 2011 it did not give any problems...not quite sure why it tells me that it has been 60 days since a tombstone was succesfully made....
0
vanleeuwenCommented:
might be that i should have fixed firewall access for DC functionality....i assumed that W2008R2 would take care of that at the moment that i did a dcpromo....but perhaps i should not assume this...:-(
0
malhamdiCommented:
"might be that i should have fixed firewall access for DC functionality....i assumed that W2008R2 would take care of that at the moment that i did a dcpromo....but perhaps i should not assume this...:-( "

How do you fix the firewall for DC functionality?
0
jody_j_houghtonCommented:
Soooooo, what is the resilution for this?  All I got from this, was too pull the dns records out for the DC that's failing from the active dc?  Is this right?
0
SpreadpointCommented:
I have the same problem here - W2k8R2 - any solutions on that?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.