?
Solved

Two servers in the same domain are PDC master and Infrastructure master

Posted on 2006-03-23
9
Medium Priority
?
647 Views
Last Modified: 2008-02-01
I have two Windows Server 2003 Standard in my network (Server1 and Server2), both domain controllers of the same domain.

The problem is that both says that are the PDC and Infrastructure master of the domain, and I have problems with the replication.

If I do a ntdsutil then:

ntdsutil: roles

fsmo maintenance: select operation target

select operation target: connection

server connections: connect to server Server1
Binding to Server1 ...
Connected to Server1 using credentials of locally logged on user.

server connections: q


select operation target: list sites
Found 1 site(s)
0 - CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es

select operation target: select site 0
Site - CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
No current domain
No current server
No current Naming Context

select operation target: list domains in site
Found 1 domain(s)
0 - DC=myd,DC=es

select operation target: select domain 0
Site - CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Domain - DC=myd,DC=es
No current server
No current Naming Context

select operation target: list servers for domain in site
Found 2 server(s)
0 - CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
1 - CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es


select operation target: list roles for connected server
Server "Server1" knows about 5 roles
Schema: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Domain: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
PDC: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
RID: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Infraestructure: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es


select operation target: connection
Connected to Server1 using credentials of locally logged on user.

server connections: connect to server Server2
Unbinding de Server1...
Binding to Server2 ...
Connected to Server2 using credentials of locally logged on user.

server connections: q

select operation target: list roles for connected server
Server "Server2" knows about 5 roles
Schema: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Domain: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
PDC: CN=NTDS Settings,CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
RID: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Infraestructure: CN=NTDS Settings,CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es


As you can see, both says that are the PDC and Infraestructure master. Any idea how can I solve it?

TIA.
0
Comment
Question by:gllanderas
9 Comments
 
LVL 12

Expert Comment

by:Mazaraat
ID: 16272414
Frist transfer the roles ON the server that shoulnt be the master, http://www.petri.co.il/transferring_fsmo_roles.htm

If lists both, try forcing the transfer from the server that SHOULD have them:
http://www.petri.co.il/seizing_fsmo_roles.htm
0
 
LVL 1

Author Comment

by:gllanderas
ID: 16273012
I have tried both things.

I can't transfer the roles because when I connect to Server1 and do:

- Open the Active Directory Users and Computers snap-in from the Administrative Tools folder.
- Right-click the icon next to Active Directory Users and Computers and press Connect to Domain Controller.
- Select the domain controller Server1 and press OK.
- Right-click the Active Directory Users and Computers icon again and press Operation Masters.
- Select PDC and click on Change

Then I obtain and error saying (I have the Spanish version of Windows, so I will translate the message to English):

'Current domain controller is the operation master. To transfer the function of operation master to another sever, you must connect to it first.'

And the same occurs when I do it to the Server2 server.


If I try to force the transfer then:

ntdsutil: roles

fsmo maintenance: connection

server connections: connect to server Server1
Binding to Server1 ...
Connected to Server1 using credentials of locally logged on user.

server connections: q

fsmo maintenance: seize pdc

[I receive a warning window and I confirm the seize]
Are you sure you want server "Server1" to seize the domain naming role with the value below?
CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es

Attempting safe transfer of PDC FSMO before seizure.
Transfer of PDC FSMO success. It is not necessary to seize.
Server "Server1" knows about 5 roles
Schema: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Domain: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
PDC: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
RID: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Infraestructure: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es

fsmo maintenance: connection
Connected to Server1 using credentials of locally logged on user.

server connections: connect to server Server2
Unbinding de Server1...
Binding to Server2 ...
Connected to Server2 using credentials of locally logged on user.

server connections: q

fsmo maintenance: seize pdc

[I receive a warning window and I confirm the seize]
Are you sure you want server "Server2" to seize the domain naming role with the value below?
CN=NTDS Settings,CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es

Attempting safe transfer of PDC FSMO before seizure.
Transfer of PDC FSMO success. It is not necessary to seize.
Server "Server2" knows about 5 roles
Schema: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Domain: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
PDC: CN=NTDS Settings,CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
RID: CN=NTDS Settings,CN=Server1,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es
Infraestructure: CN=NTDS Settings,CN=Server2,CN=Servers,CN=Default-First-Site,CN=Sites,CN=Configuration,DC=myd,DC=es

0
 
LVL 1

Expert Comment

by:denzmor
ID: 16273155
try this


      You must use Ntdsutil.exe to seize the schema master, domain naming master, and RID master roles. When you use Ntdsutil.exe to seize an operations master role, it first attempts a transfer from the current role owner. If the current role owner is unavailable, it performs the seizure.

In the Run dialog box, type ntdsutil and press ENTER.
At the ntdsutil: prompt, type roles and press ENTER.
At the fsmo maintenance: prompt, type connections and press ENTER.
At the server connections: prompt, type connect to server servername, where servername is the name of the domain controller that will assume the operation master role, and press ENTER.
After you receive confirmation of the connection, type quit and press ENTER to exit the menu..
RID Master Domain Admins seize rid master

The system asks for confirmation. It then attempts to transfer the role. When the transfer fails, some error information appears and the system proceeds with the seizure. After the seizure is complete, a list of the roles and the LDAP name of the server that currently holds each role appears.

During seizure of the RID master, the current role holder attempts to synchronize with its replication partners. If it cannot establish a connection with a replication partner during the seizure operation, it displays a warning and confirms that you want the role seizure to proceed. Click Yes to proceed.

Type quit and press ENTER. Type quit and press ENTER to exit ntdsutil.exe.

---------
To get RID of the old Snark object, you should cleanup this metadata. Use the following procedure:

If you give the new domain controller the same name as the failed computer, then you need perform only the first procedure to clean up metadata, which removes the NTDS Settings object of the failed domain controller.

At the command line, type ntdsutil and press ENTER.
At the ntdsutil: prompt, type metadata cleanup and press ENTER.
At the metadata cleanup: prompt, type connections and press ENTER.
At the server connections: prompt, type connect to server servername, where servername is the domain controller (any functional domain controller in the same domain) from which you plan to clean up the metadata of the failed domain controller. Press ENTER.
Type quit and press ENTER to return you to the metadata cleanup: prompt.
Type select operation target and press ENTER.
Type list domains and press ENTER. This lists all domains in the forest with a number associated with each.
Type select domain number, where number is the number corresponding to the domain in which the failed server was located. Press ENTER.
Type list sites and press ENTER.
Type select site number, where number refers to the number of the site in which the domain controller was a member. Press ENTER.
Type list servers in site and press ENTER. This will list all servers in that site with a corresponding number.
Type select server number and press ENTER, where number refers to the domain controller to be removed.
Type quit and press ENTER. The Metadata cleanup menu is displayed.
Type remove selected server and press ENTER.
At this point, Active Directory confirms that the domain controller was removed successfully. If you receive an error that the object could not be found, Active Directory might have already removed from the domain controller.

Type quit, and press ENTER until you return to the command prompt.
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 13

Accepted Solution

by:
Kini pradeep earned 189 total points
ID: 16273404
since it shows that both are RID masters and PDC emulator, there might have been an instance when one of the DC's was offline and the roles were seized onto the other.
the only way out of this is to demote one of the boxes from being a dc, you would not be able to do a graceful demotion so you might have to do a force demotion using Dcpromo /force removal in which case the meta data will still be left on the other DC.
clean the metadata and then promote it to a DC again.make sure you have a good backup before you do that, also make sure that they are not beyond the tombstone lifetime period which is 60 days by default.
use repadmin /showreps to find the last sucessful replication.
for metadata use:http://support.microsoft.com/kb/216498
transfer, seize fsmo : http://support.microsoft.com/kb/255504
0
 
LVL 1

Author Comment

by:gllanderas
ID: 16273451
It doesn't work either, denzmor.

I have tried to transfer and to seize the PDC and the Infraestructure functions to both servers.

One thing, Server1 is the DNS server, and:

C:\>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : Server1
        Primary DNS Suffix  . . . . . . . : myd.es
        Node Type . . . . . . . . . . . . : unknow
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : myd.es

Ethernet adapter Conexión de área local:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Intel(R) PRO/1000 XT Network Connection
        Physical Address. . . . . . . . . : ??-??-??-??-??-??
        DHCP Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.1.2
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 127.0.0.1


And for Server2:

C:\>ipconfig /all

Windows IP Configuration

        Host Name . . . . . . . . . . . . : Server2
        Primary DNS Suffix  . . . . . . . : myd.es
        Node Type . . . . . . . . . . . . : unknow
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : myd.es

Ethernet adapter Conexión de área local:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet
        Physical Address. . . . . . . . . : ??-??-??-??-??-??
        DHCP Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.1.3
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 192.168.1.2
0
 
LVL 12

Expert Comment

by:Mazaraat
ID: 16274642
I think your simplest solution, though maybe not the best, is going to be demoting one of the servers to a member server, seize roles on the DC that is left, then DCpromo the other server back as a DC.  By running DCpromo it shoud force the server to give up the roles.
0
 
LVL 12

Assisted Solution

by:Mazaraat
Mazaraat earned 186 total points
ID: 16276244
Additionally you may have to actually remove the server from the domain completely, clean up AD of any instance of the DC, then bring it back into the domain and run DCpromo

-----------------------------------------------------------------------------------------
As I look over your DNS settings, I'm looking at your second DC - it should have its DNS pointed at itself (192.168.1.3 or 127.0.0.1) and have the primary DNS server (192.168.1.2) listed in the forwarders tab in the DNS management MMC.....
0
 
LVL 1

Author Comment

by:gllanderas
ID: 16280080
All right, I was scared about this solution (demoting and promoting again the second server), but it seems that it isn't another choice.

I have done it and know I have both computers working as domain servers with an unique PDC emulator master and Infraestructure master. I have had to delete by hand a lot of things after doing the dcpromo /forceremove. The unique error that appears at the Directory Service is a NTDS Replication error (ID 1411), but I will see it next week. :-)

Thank you very much for your help.


Mazaraat, Server2 is not a DSN server, Windows didn't install it when I promote to domain server. This is way it has 192.168.1.2 as primary DNS server. However, I must configure it as a secundary DNS server.
0
 
LVL 12

Expert Comment

by:Mazaraat
ID: 16282165
ahhhh, OK that explains it =)   Glad we could help!

Gary
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Learn about cloud computing and its benefits for small business owners.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
Look below the covers at a subform control , and the form that is inside it. Explore properties and see how easy it is to aggregate, get statistics, and synchronize results for your data. A Microsoft Access subform is used to show relevant calcul…

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question