DC's are not speaking to each other.

We have two domain controllers on our network.  One of them crashed and we restored it from backup.  Everything seemed to be working fine except all of a sudden we noticed all the users lost their rights to that server.  We dug a little deeper and noticed that one DC could replicate to the other but not the other way around.  Whenever we tried to replicate from 1 to 2 it worked but from 2 to 1 we received the following message.

The following error occurred during the attempt to synchronize naming context mkrs.com from domain controller server1 to domain controller server2:
The naming contex is in the process of being removed or is not replicated from the specified server.
This operation will not continue.

Can anyone give me some guidance or better yet, tell me how to fix this?


Who is Participating?
EricIT ManagerCommented:
Yuck.  that sucks.   Then you have to force it.



EricIT ManagerCommented:
IS it an option to demote the DC and repromote it?
This has worked for me in the past when a restore did not work completly.  Or did you rebuild it from scratch and use DCPROMO to start with?
mkrsmisAuthor Commented:
I've tried to demote the both of the DC's but I haven't been able to.  I've used DCPROMO and I get the following errors.  If I mark it as the last domain controller I get...

This domain controller is not the last domain controller in the domain.

If I do not mark it as the last domain controller I get...

A domain controller could not be contacted for the domain domain.com that contained an account for this computer.  Make the computer a memeber of a workgroup then rejoin the domain before retrying the promotion.

From the other server I get the same message if I mark it as the last domain controller and a message stating that it could copy object to the other DC so it cannot remove Active Directory.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

EricIT ManagerCommented:
dont demote both!  does the working server have all the roles assigned to it?

did you join the domain after the rebuild?
delete the computer account for the restored server out of active diretory users and computers.
Then rejoin the domain.  then try a dcpromo.

mkrsmisAuthor Commented:
I was trying to demote one, when that failed I tried the other.  I can't demote either of them.  I tried to rejoin the domain but since it is a domain controller, it will not let me leave the domain to then try to rejoin it.
EricIT ManagerCommented:
What if you blow the server out, reload it and repromote it.  Give it a new name and never look back :o

Then you would have to edit AD to remove references to the old server if it still belives it exists..
I had to do that once.  Its not to bad, and I will help you find the step by step if you decide to take that route.

mkrsmisAuthor Commented:
I really would like to avoid that.  Can you think of anything else?
EricIT ManagerCommented:
see if all the master roles are possesed by the remaining server I think there are 5.  Plus the Global catalog
mkrsmisAuthor Commented:
Where can I see that and where would I make changes?
EricIT ManagerCommented:
You could do a force demote on the crappy one.    But first determine if the good one has the roles.
for roles:
open AD users and computers.  right click domain name and choose operations masters.
check RID, PDC, and infrastructure.
they need to all be your surviving DC.

In AD sites and services:
go all the way down to the NTDS settings, right click properites.  Make sure the surviving DC has global catalog checked.

I forget where the other two are.. look here

See this link.   It mentioned doing the meta cleanup I talked about above.  

EricIT ManagerCommented:
Open active directory domains and trusts MMC.

right click and do "operations masters"  that is another one, just one more... hmmmm

Ahh its in that article above... with pictures and all :D
Finding the Schema Master via GUI

To find out who currently holds the Schema Master Role:

Register the Schmmgmt.dll library by pressing Start > RUN and typing:

regsvr32 schmmgmt.dll

Press OK. You should receive a success confirmation.

From the Run command open an MMC Console by typing MMC.

On the Console menu, press Add/Remove Snap-in.

Press Add. Select Active Directory Schema.

Press Add and press Close. Press OK.

Click the Active Directory Schema icon. After it loads right-click it and press Operation Masters.

EricIT ManagerCommented:
And finally how to cleanup the meta data ...


mkrsmisAuthor Commented:
When I went in to check all of the above it showed error as the server.  I was able to transfer everything to the good server except the RID.  When I try that I get this message...

The requested FSMO operation failed.  The current FSMO holder could not be contacted.  The transfer of the current Operations Master could not be performed.
format the bad server and rejoin to good server as per its previous role.

The last hope.


Leon FesterSenior Solutions ArchitectCommented:
Sounds like a roles problem on the AD.

You can user adsiedit.msc to manually manipulate the roles and setting on your servers.

Open adsiedit.msc

Expand domain
Expand the domain that you need to update
Expand Domain Controllers, and ensure that both Domain controllers computer accounts are listed there.
Check the properties and settings of the "Attribute Editor" and the "Security tabs" of the two DC's and ensure that they have the same roles, obviously you can only have 1 PDC, but you may want to test the roles by setting up both a Primary, and see if they act according to the designed functions.
mkrsmisAuthor Commented:
After forcing DCPROMO, I was able to unjoin and rejoin the domain.  Then I added Active Directory and it is now working fine.

Thank you for all of your help and guidance.

EricIT ManagerCommented:
sweet.   Check you event logs.  iF its pissing and moaning about the old server missing, i strongly recommend doing the metafile cleanup.

some domain controllers are just jerks :)

Glad its working!
Just to clarify, to force DCPROMO:
Start --> Run: "dcpromo /forceremoval
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.