?
Solved

AD Replication

Posted on 2008-06-10
6
Medium Priority
?
961 Views
Last Modified: 2013-12-05
I have an exchange 2000 mail server which is also a DC for our domain. This is multi site domain. Replication to this mail server will not work due to 'access is denied errors' & ERROR_REPLICA_SYNC_FAILED_ACCESS IS DENIED. The event log on that server is full of NTDS KCC entries in the event logs. It has failed to replicate for over 90 days. Therefore (a) it is fixable and (b) do I want to replicate if it has been offline for that long, bearing in mind our AD activity is pretty minimal.

Regards.
0
Comment
Question by:championit
  • 2
  • 2
4 Comments
 
LVL 3

Expert Comment

by:Karl12347
ID: 21752722
You have major problems due to the fact you have exchnage on a domain controller. If you demote the server from being a domain controller, exchnage will not function correctly at all.

It is a bit tricky, you will have to use the dcdiag tool and ntdsutil tools to troubleshoot why the connection problems are occouring. If you get the connection working again, your latest updated Active directory on another server can be replicated to overwrite this domain controller that is not working correctly.

Hope this helps
0
 

Author Comment

by:championit
ID: 21753642
I thought Exchange had to be installed on a DC for some reason!! We have 5 DC's across our WAN all running Exchange. I take it this is not best practice and we need to get Exchange off their asap.
I am running some dcdiag tests at present and will upload the results in a file when complete.

If I move Exchange to another server then rebuild the DC will Exchange as an enterprise function given that one Exchange server will be running on a member sercer and the other 4 on DC's ?
0
 

Author Comment

by:championit
ID: 21753684
dcdiag attached, not sure whether this test the connectivity as it's a very long time since I used this. Will try ntdsutil also
mail02-dcdiag1.txt
0
 
LVL 3

Accepted Solution

by:
Karl12347 earned 2000 total points
ID: 21759152
First of all you should start the windows time service on your mail box.  Kerberos will fail if it cannot verify the time on your systems.
w32time Service is stopped on [MCR-MAIL-02]
Try running DCdiag with the /fixall command.

MCR-MAIL-02 failed test kccevent indicates that you are having problems with the Kerberos Consistecy checker on your domain controller.

Without sitting infront of your servers and having a look, It is very doubtfull that anyone on her could provide a full solution.

If you have any further questions please let me know.

Karl
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here in this article, you will get a step by step guidance on how to restore an Exchange database to a recovery database. Get a brief on Recovery Database and how it can be used to restore Exchange database in this section!
Steps to fix “Unable to mount database. (hr=0x80004005, ec=1108)”.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…
Suggested Courses
Course of the Month13 days, 19 hours left to enroll

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question