• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 264
  • Last Modified:

Active Directory with no Domain Controllers

I am migrating from an old SBS2003 environment to a virtual 2003 Standard Server environment. The SBS2003 server has already been demoted and removed from the network, leaving only a stand alone EXCHANGE server/DC for authentication. I created 2 new virtual Windows Server 2003 servers (DC1 & DC2), DCPROMO'd both of them. Both DC1 and DC2 showed errors in their event logs referencing problems with SYSVOL replication, and saying that they would not be fully promoted until SYSVOL was properly replicated.

Further investigation revealed that NTFRS on EXCHANGE was in an error state due to a recent disaster recovery. Had to create file "NTFRS_CMD_FILE_MOVE_ROOT" and restart NTFRS in order to repair. Since DC1 and DC2 are also waiting for SYSVOL replication, there were no other fully promoted DC's on the network (my bad) so there are no replication partners, and now EXCHANGE is also not acting as a DC. As a result, no domain controllers are availalbe to answer domain requests, no GC servers, etc.

I have tried the SYSVOL rebuild methods (D4 and D2) outlined in the article:
<a href="http://support.microsoft.com/kb/315457">http://support.microsoft.com/kb/315457</a>
And it does not appear to have remedied anything. There are still no SYSVOL or NETLOGON shares, and I'm continuing to receive event ID 13508, "The File Replication Service is having trouble enabling replication from EXCHANGE to DC1 for c:\windows\sysvol\domain using the DNS name EXCHANGE.domain.com. FRS will keep retrying."

I'm currently working on a new virtual network that mimics our current environment and hopefully we can move into that new environment soon, but in the meantime I have a very unstable network. Any help is appreciated.
  • 4
  • 2
1 Solution
Your exchange machine...In TCPIP properties what DNS server is it referencing?  First DNS server should be itself and since you have no other machines yet there should be no secondary.

restart the netlog on service - do the netlogon and sysvol shares show up on the exchange DC?
Also you shoudl check to make sure your existing exchange dc believes they dcpromod out correctly.

First try cleaning the metadata from the dcpromo

If thats doesnt work then you need to check that they didnt fail on dcpromo

Once this is squared away retry starting the netlog on service if no go I would rebuild the shares again
GarrisonITAuthor Commented:
On a hunch (based on your advice), I retried the NTFRS_CMD_FILE_MOVE_ROOT technique, and now the SYSVOL and NETLOGON shares are present on EXCHANGE, and domain authentication appears to be working again. It appears that the NTFRS_CMD_FILE_MOVE_ROOT *after* the D4 registry modification did the trick, at least for EXCHANGE.

FYI - DNS on EXCHANGE was/is pointing to itself, the DNS records appear to be correct for all computers. There are no warnings or failures recorded in the event log for DNS on EXCHANGE. Also, pinging DC1, DC2 and EXCHANGE from the command line resolves to the correct IP address in all cases from all DC's.

At this point the problem has been reduced to replication between the DC's. I am still receiving the 13508 events on all 3 systems...

"The File Replication Service is having trouble enabling replication from EXCHANGE to DC1 for c:\windows\sysvol\domain using the DNS name EXCHANGE.domain.com. FRS will keep retrying."

This is preventing DC1 and DC2 from being fully promoted to domain controllers.

Any ideas?
Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

ok it takes time to replicate and you may see these errors for a few minutes.
But next i woudl run a dcdiag /fix then run a dcdiag and see what errors come back.  The run a netdiag and see what errors come back.

If none come back then wait about 20 minutes to see if replication comes back online and then try to dcpromo.
Also make sure the SRV records are present.  This will also cause replication issues.  You can always remove them and readd them.  Retstart the replication service and see.
GarrisonITAuthor Commented:
SRV Records are present and accurate. DCDiag and NetDiag both look pretty clean. I did run FRSDiag on all 3 DC's. EXCHANGE looked good, but both DC1 and DC2 had several errors. At this point the network is functional, so I'm going to stop troubleshooting this SYSVOL replication issue and spend my time putting together the new, clean virtual server environment. Thanks for your help.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now