<div>
This error could be a couple of issues. Look through these solutions to see if they help out. Is both DNS servers listed on the DCs? Do you have more then one NIC in the DC? <br />
<br />
<a href="https://www.experts-exchange.com/questions/21740439/FILE-REPLICATION-SERVICE-is-having-trouble-Event-ID-13508.html" rel="ugc">https://www.experts-exchange.com/questions/21740439/FILE-REPLICATION-SERVICE-is-having-trouble-Event-ID-13508.html</a><br />
<br />
<a href="http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=ntfrs&phase=1" rel="ugc">http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=ntfrs&phase=1</a>
</div>


<div>
I have already gone through post <br />
<br />
<a href="https://www.experts-exchange.com/questions/21740439/FILE-REPLICATION-SERVICE-is-having-trouble-Event-ID-13508.html" rel="ugc">https://www.experts-exchange.com/questions/21740439/FILE-REPLICATION-SERVICE-is-having-trouble-Event-ID-13508.html</a><br />
<br />
The only thing I haven't tried yet is setting the Burflags. &nbsp;Will this option take down the system ? &nbsp;As I would only be able to do this in planned downtime which only comes round once every blue moon. &nbsp;I realy need to find a fix that can be done without the risk of system outage.
</div>


<div>
No shouldn't have to bring down the system for the flag solution but make a backup of the registry. Have you looked over the EventID. Also, Can you answer the questions above for me so I can get a little idea of config. Thanks!
</div>


<div>
I will be having a look over the eventid site today, with regards to the questions.<br />
<br />
I have two DC's with are set as themselves as the primary DNS server and each other as Secondary DNS. &nbsp;Each server has 2 x Broadcom Nic's configured as a Smart Load Balance and Fail over team.<br />
<br />
Cheers
</div>


<div>
Multihomed computers shouldn't be DC or DNS servers because of issues that arise. 
</div>


<div>
Hi Darusg,<br />
<br />
Please can you explain in more detail.<br />
<br />
Thanks
</div>


<div>
I have run FRSDiag attached are the results.<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/43120/FRSDiag-Results.txt" target="_blank" class="file-inline" title="FRSDiag Results (8 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>FRSDiag-Results.txt</a>
</div>


FRSDiag-Results.txt

<div>
Further updates,<br />
<br />
I have tried doing a Force Replication on Target Servers from within FRSDiag and get the following results.<br />
<br />
DC1 - Finished Successfully<br />
DC2 - Failed with Could not detect any upstream partners, this server seems to be Orphaned! You should double check this !.
</div>


<div>
Multihomed computers have problems because they listen on two NICs which causes problems with replication and request from clients. You can make DNS listen on one NIC but still this doesn't work all the time. <br />
<br />
<a href="http://technet2.microsoft.com/windowsserver/en/library/756414dd-ec37-4111-b4d1-52c2eae5ed4e1033.mspx?mfr=true" rel="ugc nofollow">http://technet2.microsoft.com/windowsserver/en/library/756414dd-ec37-4111-b4d1-52c2eae5ed4e1033.mspx?mfr=true</a><br />
<br />
<a href="https://www.experts-exchange.com/questions/23555116/Windows-Server-2003-DNS-Zone-Transfers-Failing.html" rel="ugc">https://www.experts-exchange.com/questions/23555116/Windows-Server-2003-DNS-Zone-Transfers-Failing.html</a>
</div>


<div>
Dariusq<br />
<br />
Don't thinks this applys to my configuration as the team is configured as a Smart Load Balance and Fail over, with only a single IP address assigned.
</div>


<div>
I must have read right over that comment, &nbsp;sorry about that. Did you ever look over the EventID? Can you post ipconfig /all for both DC1 and DC2? How is your network setup? Is DC1 and DC2 on the same subnet?
</div>


<div>
I've been going over the EventID site, most of the post seem to refer to setting burflags. I have also run FRSDiag and posted the results above.<br />
<br />
Host name: DC1<br />
Primary Dns Suffix: domain.local<br />
Node Type: Unknown<br />
IP Routing Enabled: No<br />
Wins Proxy Enabled: No<br />
DNS suffix search list: domain.local<br />
<br />
Ethernet adapter team:<br />
Connection-specific DNS suffix:<br />
Description: Basp Virtual Adapter<br />
Physical Address: Mac Address<br />
DHCP Enabled: No<br />
IP Address: 192.168.54.5<br />
Subnet Mask: 255.255.255.0<br />
Default Gateway: 192.168.54.5 - 192.168.54.8<br />
<br />
Host Name: DC2<br />
Primary Dns Suffix: domain.local<br />
Node Type: Unknown<br />
IP Routing Enabled: No<br />
Wins Proxy Enabled: No<br />
DNS suffix search list: domain.local<br />
<br />
Ethernet adapter team:<br />
Connection-specific DNS suffix:<br />
Description: Basp Virtual Adapter<br />
Physical Address: Mac Address<br />
DHCP Enabled: No<br />
IP Address: 192.168.54.8<br />
Subnet Mask: 255.255.255.0<br />
Default Gateway: 192.168.54.8 - 192.168.54.5<br />
<br />
The DC's are configured on the same subnet, there is no firewall preventing RPC traffic internally.<br />
<br />
I have seem a couple of times a W32time error normally around 4am, I have detailed this below<br />
<br />
Event ID 50<br />
Source W32Time<br />
The time service detected a time difference of greater than 128 milliseconds for 90 seconds. &nbsp;The time difference might be caused by synchronization with low-accuracy time source or by suboptimal network conditions. This time service is no longer synchronized and cannot provide the time to other clients or update the system clock. &nbsp;When a valid time stamp is received from a time service provider, the time service will correct itself.<br />
<br />
I am going through the configuration of this as my predisessor has set both DC to sync with an external time source via the default domain controller GPO. <br />
&nbsp;
</div>


<div>
Your PDC should be your time server. I don't see DNS IP addresses listed on the TCP\IP settings. 
</div>


<div>
Sorry bit of a miss type, below are the correct settings<br />
<br />
DC1<br />
Default Gateway - 192.186.54.1<br />
DNS: 192.168.54.5 - 192.168.54.8<br />
<br />
DC2<br />
Default Gateway: 192.168.54.1<br />
DNS: 192.168.54.8 - 192.168.54.5<br />
<br />
I am changing the time configuration this morning, will keep you updated with the results.<br />
<br />
Thanks<br />

</div>


<div>
Ok the PDC is now configured as the time server and all servers are getting there time ok. &nbsp;I have rerun the FRSDiag and I am still getting errors. &nbsp;Attached is the results file.<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/07_w30/43753/FRSDiag-Results.txt" target="_blank" class="file-inline" title="FRS Results file (7 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>FRSDiag-Results.txt</a>
</div>


<div>
OK further update.<br />
<br />
I have been going through KB 279156, I have run the following commands on both DC's <br />
<br />
findstr /i &quot;ContentCmd&quot; %systemroot%\debug\ntfrs_0<wbr />005.log &nbsp;(Log file dated today)<br />
<br />
No results are returned ?<br />
<br />
I have also been through KB 822158 and checked this on both DC's again. On both of my DC's I have McAfee Enterprise VS 8.0.0 with the following configuration:<br />
<br />
Scan: Boot sectors &amp;&nbsp;Floppy during shutdown<br />
Enable on-access scanning at system startup <br />
Scan Files: When writing to disk &amp;&nbsp;When reading from disk<br />
Scan: All files <br />
Exclusions: Windows File Protection, Exculde Subfolder: N/A, Read/Write: Read <br />

</div>


<div>
Change your primary DNS server to point to the other DNS server. Do this on both machines. Check the SYSVOL on both DCs make sure the permissions are the same. Then do a netdiag /fix. Is the Windows Firewall disabled? 
</div>


<div>
Ok I have pointed each server to the other as the primary DNS with itself as the secondary. &nbsp;<br />
<br />
Checked SYSVOL permissions on both DC and they are as follows<br />
<br />
SYSVOL:<br />
Administrators - Full Control<br />
Authenticated Users - Read &amp;&nbsp;Execute<br />
Creator Owner - Full Control<br />
Server Operators - Modify<br />
System - Full Control<br />
<br />
SYSVOL\SYSVOL - Allow Inheritable Permissions<br />
SYSVOL\SYSVOL\ DOMAIN - Allow Inheritable Permissions<br />
SYSVOL\SYSVOL\DOMAIN\POLIC<wbr />IES - Allow Inheritable Permissions<br />
<br />
SYSVOL\SYSVOL\DOMAIN\POLIC<wbr />IES\&quot;Each policy&quot; - Inheritable Permissions removed <br />
Authenticated Users - Read &amp;&nbsp;Execute<br />
Creater Owner - Full Control<br />
Domain Admins - Full Control<br />
Enterprise Admins - Full Control<br />
Enterprise Domain Controllers - Read &amp;&nbsp;Execute<br />
System - Full Control<br />
<br />
There is no firewall on the internal network and I have check both DC and the local firewall is turned off.<br />
<br />
What will netdiag /fix do ? &nbsp;does it have the potental to take down the DC ?
</div>


<div>
No, netdiag will fix the DNS records in DNS for the DC if there is any issues. <br />
<br />
<a href="http://support.microsoft.com/kb/219289" rel="ugc nofollow">http://support.microsoft.com/kb/219289</a>
</div>


<div>
OK,<br />
<br />
Netdiag /fix has been run on both DC's, I have rerun FRSDiag and still get the same results.
</div>


<div>
Can you ping the DC1 from DC2 and DC2 from DC1 by name? Is the FRS service started on both DCs? When you go to Sites and Services do you see both DCs? Select the NTDS settings is the other DC listed as a replicate partner? Double click the connection listed in the NTDS settings to see if the permissions are correct. Disable McAfee.
</div>


<div>
Ok<br />
<br />
I can ping each DC's by name from the other.<br />
FRS services are started on both DC's<br />
Sites and services both DC's are listed on each server and permissions are set as below<br />
<br />
From DC1<br />
Authenticated User - Special (List Content, Read All Properties &amp;&nbsp;Read Permissions) - (Not inherited)<br />
Domain Admin (Domain\Domain Admins) - Special (All ticketed except Full Control, Delete All Child Objects &amp;&nbsp;Delete Connection Objects) - (Not inherited)<br />
System - Full Control - (Not Inherited)<br />
Domain Admins (Domain\Domain Admins - Full Control - Inherited from CN=DC2,CN=Servers,CN=Defau<wbr />lt-First-S<wbr />ite-Name,C<wbr />N=Sites,CN<wbr />=Configura<wbr />tion,DC=do<wbr />main,DC=lo<wbr />cal<br />
Enterprise Admin - Full control - Inheritede from CN=Configuration,DC=domain<wbr />,DC=local<br />
<br />
Allow inheritable permissions TICKED<br />
<br />
From DC2<br />
Authenticated User - Special (List Content, Read All Properties &amp;&nbsp;Read Permissions) - (Not inherited)<br />
Domain Admin (Domain\Domain Admins) - Special (All ticketed except Full Control, Delete All Child Objects &amp;&nbsp;Delete Connection Objects) - (Not inherited)<br />
System - Full Control - (Not Inherited)<br />
Domain Admins (Domain\Domain Admins - Full Control - Inherited from CN=DC1,CN=Servers,CN=Defau<wbr />lt-First-S<wbr />ite-Name,C<wbr />N=Sites,CN<wbr />=Configura<wbr />tion,DC=do<wbr />main,DC=lo<wbr />cal<br />
Enterprise Admin - Full control - Inheritede from CN=Configuration,DC=domain<wbr />,DC=local<br />
<br />
Allow inheritable permissions TICKED<br />
<br />
McAfee is now disabled.
</div>


<div>
Nope still getting NTFRS errors in the event log and FRSDiag is still failing with the same errors.
</div>


<div>
Also noticed this morning, I locked my account yesterday and when I unlockecked I got the following message on both DC's<br />
<br />
WARNING<br />
Event ID 1083<br />
Source NTDS Replication<br />
Description<br />
Active Directory could not update the following object with changes received from the domain controller at the following network address because Active Directory was busy processing information<br />
<br />
Object<br />
CN=Myaccount,OU=OU,OU=OU,D<wbr />C=Domain,D<wbr />C=Local<br />
Network Address<br />
address_msdcs.domain.local<wbr /><br />
<br />
The operation will be tried again later<br />
<br />
INFORMATION<br />
Event ID 1955<br />
Source NTDS Replication<br />
Description<br />
Active Directory encountered a write conflick when applying replication changes to the following object<br />
<br />
Object<br />
CN=Myaccount,OU=OU,OU=OU,D<wbr />C=Domain,D<wbr />C=Local<br />
Time in secounds:<br />
0<br />
<br />
Event log entries preceding this entry will indicate wheater or not the update was accepted.<br />
<br />
A write conflict can be caused by simultaneous changes to the same object or simultaneous changes to other objects that have attributes referencing this object. &nbsp;This commonly occurs when the object represents a large group with many memebers., and the functional level of the forest is set to Windows 2000. &nbsp;This conflict triggered additional retries of the update. &nbsp;If the system appears slow it could be because replication of these changes is occuring.<br />
<br />
User action<br />
Use smaller groups for this operation or raise the fuctional levele to Windows Server 2003<br />
<br />
This happened unlocking my own account ?<br />
<br />
I have check the fuctional level on the domain and it is set to Windows Server 2003 ?<br />

</div>


<div>
When I run DCDiag and NetDiag on both DC's I get the following results<br />
<br />
DC1 <br />
DCDiag - All passes except FRSEvents<br />
NetDiag - All passes except Deafult gateway test (This fails as the gateway is configured to block Pings)<br />
<br />
DC2<br />
DCDiag - All passes ok<br />
NetDiag - All passes except Deafult gateway test (This fails as the gateway is configured to block Pings)
</div>


<div>
I have just been checking that both DC have the same hotfixes, and they do. However I've noticed on the top of the Netdiag results that the System Info is Windows 2000 Server (Build 3790) ?<br />
<br />
When you check the properties of each server (Right Click my computer\properties) it is being displayed as Windows Server 2003 Enterprise Edition SP2 ?
</div>


<div>
That is weird but I don't think that is the problem. Can you run a repadmin to check out the replication? Are both DC global catalogs? Also, System should have Full Control of the whole Sysvol folder.<br />
<br />
<a href="http://technet2.microsoft.com/windowsserver/en/library/24d8a2dd-2596-46cb-9b0f-179f977d434a1033.mspx?mfr=true" rel="ugc nofollow">http://technet2.microsoft.com/windowsserver/en/library/24d8a2dd-2596-46cb-9b0f-179f977d434a1033.mspx?mfr=true</a><br />
<br />
<a href="http://technet2.microsoft.com/windowsserver2008/en/library/24cf60ff-6fae-428e-967a-5c24f5f80d311033.mspx?mfr=true" rel="ugc nofollow">http://technet2.microsoft.com/windowsserver2008/en/library/24cf60ff-6fae-428e-967a-5c24f5f80d311033.mspx?mfr=true</a><br />
<br />
<a href="http://www.petri.co.il/forums/archive/index.php/t-15456.html" rel="ugc">http://www.petri.co.il/forums/archive/index.php/t-15456.html</a>
</div>


<div>
I know this has had me stumped for weeks.<br />
<br />
OK have run repadmin /showrepl on both DC's and here are the results<br />
<br />
DC1<br />
DC Options: IS_GS<br />
<br />
Inbound Neighbors<br />
DC=Domain,DC=Local<br />
Default-First-Site-Name\DC<wbr />2 via RPC<br />
Last Attempot was successful<br />
<br />
CN=Configuration,DC=Domain<wbr />,DC=Local<br />
Default-First-Site-Name\DC<wbr />2 via RPC<br />
Last Attempot was successful<br />
<br />
CN=Schema,CN=Configuration<wbr />,DC=Domain<wbr />,DC=Local<br />
Default-First-Site-Name\DC<wbr />2 via RPC<br />
Last Attempot was successful<br />
<br />
DC=DomainDNSZones,DC=Domai<wbr />n,DC=Local<wbr /><br />
Default-First-Site-Name\DC<wbr />2 via RPC<br />
Last Attempot was successful<br />
<br />
DC=ForestDNSZones,DC=Domai<wbr />n,DC=Local<wbr /><br />
Default-First-Site-Name\DC<wbr />2 via RPC<br />
Last Attempot was successful<br />
<br />
DC2<br />
DC Options: none<br />
<br />
Inbound Neighbors<br />
DC=Domain,DC=Local<br />
Default-First-Site-Name\DC<wbr />1 via RPC<br />
Last Attempot was successful<br />
<br />
CN=Configuration,DC=Domain<wbr />,DC=Local<br />
Default-First-Site-Name\DC<wbr />1 via RPC<br />
Last Attempot was successful<br />
<br />
CN=Schema,CN=Configuration<wbr />,DC=Domain<wbr />,DC=Local<br />
Default-First-Site-Name\DC<wbr />1 via RPC<br />
Last Attempot was successful<br />
<br />
DC=DomainDNSZones,DC=Domai<wbr />n,DC=Local<wbr /><br />
Default-First-Site-Name\DC<wbr />1 via RPC<br />
Last Attempot was successful<br />
<br />
DC=ForestDNSZones,DC=Domai<wbr />n,DC=Local<wbr /><br />
Default-First-Site-Name\DC<wbr />1 via RPC<br />
Last Attempot was successful<br />
<br />
I belive that only DC1 has the global catalogs, Also DC1 is the RID, PDC &amp;&nbsp;Infrastructure operations master. <br />
<br />
Also System has full control of the SYSVOL on both DC's<br />
<br />
I'll have a look through those post and see if anything jumps out.<br />
<br />
Cheers
</div>


<div>
If you have two doman controllers then the infrastructure master should be on a non GC because it won't update the changes within AD. The workaround is having all DCs GC. 
</div>


<div>
Is it better to move the role to DC2 or to turn GC on DC2. Will switching the OM course any downtime? 
</div>


<div>
Just turn on GC for back up and this will fix the other issue with infrastucture master.<br />
<br />

</div>


<div>
OK I've turned GC on at DC2 however I've read the following<br />
<br />
Configuring an excessive number of GCs in a domain wastes network bandwidth during replication. One GC server per domain in each physical location is sufficient. Windows NT sets servers as GCs as necessary, so you dont need to configure additional GCs unless you notice slow query response times.<br />
<br />
My network only consists of approxe 8 Servers (2 x DC, 6 x member servers, no exchange server) and 6 workstations. &nbsp;All other access is via a web application.<br />

</div>


<div>
The quote was lifted from this site.<br />
<br />
<a href="http://www.petri.co.il/configure_a_new_global_catalog.htm" rel="ugc">http://www.petri.co.il/configure_a_new_global_catalog.htm</a>
</div>


<div>
I have checked both DC's and they are now activing as GC. &nbsp;Have rerun FRSDiag and still getting the same errors ?
</div>


<div>
Having more then one Global Catalog is the correct way for backup. If your only GC fails on the network you will have big issues. Allow replication to happen to see if the failure stops.
</div>


<div>
Check to make sure you all SRV records are within DNS. Retstart the netlogon service. 
</div>


<div>
I have been going though DNS checking the SRV records, &nbsp;I have found that in quite a few places I have a 3rd SRV configured to a member server in the domain. &nbsp;<br />
<br />
I have found entries for _GC, _Kerberos and _Ldap<br />
<br />
I have checked this server and it is not running as a DNS server. &nbsp;It looks like at some point this server was a DC which was then demoted to a member server as it still has Directory Services, DNS &amp;&nbsp;File Replication event logs, None of which have any entries.
</div>


<div>
I would do a metadata cleanup on AD.<br />
<br />
<a href="http://technet2.microsoft.com/windowsserver2008/en/library/8ff66708-2ad0-4f52-982d-376a50a0e2dd1033.mspx?mfr=true" rel="ugc nofollow">http://technet2.microsoft.com/windowsserver2008/en/library/8ff66708-2ad0-4f52-982d-376a50a0e2dd1033.mspx?mfr=true</a><br />
<br />
<a href="http://technet2.microsoft.com/windowsserver/en/library/012793ee-5e8c-4a5c-9f66-4a486a7114fd1033.mspx?mfr=true" rel="ugc nofollow">http://technet2.microsoft.com/windowsserver/en/library/012793ee-5e8c-4a5c-9f66-4a486a7114fd1033.mspx?mfr=true</a><br />
<br />
<a href="http://windowsitpro.com/article/articleid/84450/jsi-tip-9774-metadata-cleanup-has-been-improved-in-windows-server-2003-sp1.html" rel="ugc">http://windowsitpro.com/article/articleid/84450/jsi-tip-9774-metadata-cleanup-has-been-improved-in-windows-server-2003-sp1.html</a><br />
<br />
<a href="http://www.petri.co.il/delete_failed_dcs_from_ad.htm" rel="ugc">http://www.petri.co.il/delete_failed_dcs_from_ad.htm</a>
</div>


<div>
I have conencted to both DC and checked the site in the metadata. &nbsp;I can only see the DC1 and DC2 and no information about the member server. &nbsp;I guess that I don't need to do a metadata cleanup and only delete the records from DNS.
</div>


<div>
I have done a couple of DNS tests on both DC<br />
<br />
DC1<br />
<br />
nslookup 192.168.54.5 127.0.0.1<br />
server:: localhost<br />
Address: 127.0.0.1<br />
***Localhost can't find 192.168.54.1: Non-existen domain<br />
<br />
DC2<br />
<br />
nslookup 192.168.54.8 127.0.0.1<br />
Server: localhost<br />
Address: 127.0.0.1<br />
Name: dc2.domain.local<br />
Address 192.168.54.8<br />
<br />
I have also ran a monitoring test on both DNS server. &nbsp;both passed A simple query against this DNS server &amp;&nbsp;A recursive query to other DNS servers.<br />
<br />

</div>


<div>
Last update might have been down to a miss type, I have rerun the command on DC1 and got the following results<br />
<br />
Name: dc1.domain.local<br />
Address: 127.0.0.1<br />
<br />
I have now turned on Debug logging on each DNS server, so will see if any errors come up.
</div>


<div>
last update <br />
<br />
Address 192.168.54.5 not 127.0.0.1
</div>


<div>
I don't know if this is going to help but I was part of another post like yours. <br />
<br />
<a href="https://www.experts-exchange.com/questions/23599357/My-backup-domain-controller-is-getting-event-log-error-13508.html?cid=238&anchorAnswerId=22135331#a22135331" rel="ugc">https://www.experts-exchange.com/questions/23599357/My-backup-domain-controller-is-getting-event-log-error-13508.html?cid=238&anchorAnswerId=22135331#a22135331</a>
</div>


<div>
Looks like the only solution I have left is to try to Burflag option, I will need to arrange to do this during my next downtime period. &nbsp;As I am restricted from making changes that could take the system down during normal processing time.<br />
<br />
Also need to investigate why i've got the additional DNS entries.<br />
<br />
Thanks
</div>


<div>
Ok i've just cleared out the DNS entries, will see what this does.
</div>


<div>
I've been going through the results from the FRSDiag I have found that DC1 has replications sets configured, however DC2 does not. &nbsp;Attached are the ntfrs_set files from both DC's.<br />
<br />
<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/08_w32/48636/DC1-ntfrs-sets.txt" target="_blank" class="file-inline" title="DC1 Ntfrs sets (5 KB)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>DC1-ntfrs-sets.txt</a><br />
<a href="https://filedb.experts-exchange.com/incoming/2008/08_w32/48637/DC2-ntfrs-sets.txt" target="_blank" class="file-inline" title="DC2 Ntfrs sets (45 bytes)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>DC2-ntfrs-sets.txt</a>
</div>


DC1-ntfrs-sets.txt

DC2-ntfrs-sets.txt

<div>
The two errors that keep getting repearted are :<br />
<br />
DC1<br />
<br />
\\DC1\C$\WINDOWS\debug\Ntf<wbr />rs_0005.lo<wbr />g:&lt;SndCsMa<wbr />in: &nbsp;268: &nbsp;877: &nbsp;S0: &nbsp;19:50:00&gt; :SR: Cmd 014b55d8, CxtG 3344396e, &nbsp;WS ERROR_ACCESS_DENIED to DC2.domain.local Len: (370) [SndFail - rpc call] <br />
<br />
\\DC1\C$\WINDOWS\debug\Ntf<wbr />rs_0005.lo<wbr />g:&lt;SndCsMa<wbr />in: &nbsp;268: &nbsp;904: &nbsp;50: &nbsp;19:50:00&gt; :SR: Cmd 014b55d8, CxtG 3344396e, &nbsp;WS ERROR_ACCESS_DENIED, to DC2.domain.local Len: (370) [SndFail - Send Penalty]<br />
<br />
This error is repeated every 5 Mins<br />
<br />
DC2<br />
<br />
\\DC2\C$\WINDOWS\debug\Ntf<wbr />rs_0005.lo<wbr />g:&lt;SERVER_<wbr />FrsRpcSend<wbr />CommPkt: &nbsp;2412: &nbsp;449: &nbsp;S0: &nbsp;01:05:00&gt; ++ ERROR - Invalid Partner: AuthClient:Domain\DC1$, AuthSid: s-1-5-21-3352470473-347790<wbr />8660-16496<wbr />6200-1103<br />
<br />
Again this is repeated every 5 Mins.<br />

</div>


<div>
I have checked the SID of the account DC1$ and it is the same as the one listed in DC2 error message.
</div>


<div>
Looking at the connstat file on each Domain DC indecats that partner DC2 is unjoined, DC2 has no entries in this log file.<br />
<br />
Attached is a copy of the DC1 log file.<br />
<br />
Is it possible that DC2 has lost it's connectivity with DC1 and need to removed and rejoined ?<br />
<a href="https://filedb.experts-exchange.com/incoming/2008/08_w32/48656/DC1-connstat.txt" target="_blank" class="file-inline" title="DC1 Connstat File (949 bytes)"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M67.508 468.467c-58.005-58.013-58.016-151.92 0-209.943l225.011-225.04c44.643-44.645 117.279-44.645 161.92 0 44.743 44.749 44.753 117.186 0 161.944l-189.465 189.49c-31.41 31.413-82.518 31.412-113.926.001-31.479-31.482-31.49-82.453 0-113.944L311.51 110.491c4.687-4.687 12.286-4.687 16.972 0l16.967 16.971c4.685 4.686 4.685 12.283 0 16.969L184.983 304.917c-12.724 12.724-12.73 33.328 0 46.058 12.696 12.697 33.356 12.699 46.054-.001l189.465-189.489c25.987-25.989 25.994-68.06.001-94.056-25.931-25.934-68.119-25.932-94.049 0l-225.01 225.039c-39.249 39.252-39.258 102.795-.001 142.057 39.285 39.29 102.885 39.287 142.162-.028A739446.174 739446.174 0 0 1 439.497 238.49c4.686-4.687 12.282-4.684 16.969.004l16.967 16.971c4.685 4.686 4.689 12.279.004 16.965a755654.128 755654.128 0 0 0-195.881 195.996c-58.034 58.092-152.004 58.093-210.048.041z"/></svg>DC1-connstat.txt</a>
</div>


DC1-connstat.txt

<div>
It seems that the DC has lost connectivity. Have you done the burflag fix yet? Don't remove the DC just yet. Here are a couple of tips from another post that ended up going to MS but if you haven't tried the burflag yet then <br />
<br />
<a href="https://www.experts-exchange.com/questions/23574595/FRS-Replication-Failures-between-Windows-2003-SP2-Domain-Controllers.html" rel="ugc">https://www.experts-exchange.com/questions/23574595/FRS-Replication-Failures-between-Windows-2003-SP2-Domain-Controllers.html</a><br />
<br />
<a href="https://www.experts-exchange.com/questions/23620067/Event-ID-13508-Source-NTFRS-W2K3-and-W2K-Servers.html" rel="ugc">https://www.experts-exchange.com/questions/23620067/Event-ID-13508-Source-NTFRS-W2K3-and-W2K-Servers.html</a>
</div>


<div>
Dariusq,<br />
<br />
I haven't done the Burflags as I am waiting for a downtime window, looks like it going to be round 26th Aug. &nbsp;I have a read through these links and see if anything helps.<br />
<br />
Thanks
</div>


<div>
I really think the burflag will fix issue. 
</div>


<div>
I have point each DC back to its self for primary DNS and to each other as the secondary DNS. &nbsp;I have also been going through my DNS config and found the following.<br />
<br />
DC1 Reverse lookup table<br />
Same as parent folder &nbsp; &nbsp; &nbsp;Name Server (NS) &nbsp; &nbsp; DC1.domain.local<br />
<br />
DC2 Reverse lookup table<br />
Same as parent folder &nbsp; &nbsp; &nbsp;Name Server (NS) &nbsp; &nbsp; DC2.domain.local<br />
192.168.54.8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Pointer (PTR) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; DC2.domain.local<br />
<br />
I have then run the following command and both DC's and got the following results<br />
<br />
DC1<br />
nslookup 192.168.54.5<br />
*** Can't find server anme for address 192.168.54.5: Non-existent domain<br />
Server: unKnown<br />
Address: 192.168.54.5<br />
<br />
nslookup 192.168.54.8<br />
*** Can't find server anme for address 192.168.54.5: Non-existent domain<br />
Server: unKnown<br />
Address: 192.168.54.5<br />
Name: etbdc2.etb.local<br />
Address: 192.168.54.8<br />
<br />
DC2<br />
nslookup 192.168.54.5<br />
Server: dc2.domain.local<br />
Address: 192.168.54.8<br />
*** dc2.domain.local can't find 192.168.54.5: Non-existent domain<br />
<br />
nslookup 192.168.54.8<br />
*** Can't find server anme for address 192.168.54.5: Non-existent domain<br />
Server: dc2.domain.local<br />
Address: 192.168.54.8<br />
Name: etbdc2.etb.local<br />
Address: 192.168.54.8<br />

</div>


<div>
Do you have A, NS, and SOA records for both DCs listed in DNS?
</div>


<div>
In the reverser lookup zone only DC1 has a SOA entry, both DC's have NS entries. &nbsp;They only have A records in the forward lookup zone.
</div>


<div>
DC2 should have an entry for SOA. Try manually adding this record.
</div>


<div>
Scratch that. Sorry that is wrong. 
</div>


<div>
So, you don't have any NS records in your Forward Lookup zone? You should one for each DNS server in the forward lookup zone.
</div>


<div>
Sorry should of also said they have NS for both DC and SOA for primary DC in FLZ
</div>


<div>
I have checked the properties of the reverse lookup zone, I found that in the name servers the FQDN for DC1 was represented with a * I have removed this entry and re-added using the browse. &nbsp;This has now created a PTR reference in this zone.
</div>


<div>
I am thinking about removing DC2 and rebuilding the server as it only runs as a DC and DNS server. &nbsp;Do you think this would be a better option then the Burflags and would you suggest doing anything once DC2 has been DCpromoed to a member server before rebuilding and reintroducing it to the domain.
</div>


<div>
I have tried to demote DC2 but it failed with a netlogon server timeout error. &nbsp;Therefore I have tried running dcpromo /forceremove however I get the following error.<br />
<br />
This DC is a DNS server. if you remove ADC from this computer, all of the DNS data that is stored in AD-intergrated zones will be lost. &nbsp;If you remove AD from this DNS server, update the configurations of all computers on your network that refer to IP address on this DNS server with the IP address of a new DNS server.<br />
<br />
Do you want to continue removing AD from this computer. Yes or No<br />
<br />
This is a secondary DNS server, &nbsp;will this wipe all infromation in DNS? &nbsp;<br />

</div>


<div>
This will wipe all information in this DC's DNS because the zone is integrated with AD. Now saying this when you demote with AD integrated zones the DNS service will still run with the records that are stored in DNS. The only difference is that it won't replicate because the zone is setup to replicate with AD. So, no this won't wipe out DNS on any other DNS server. The message should be worded differently. 
</div>


<div>
Thanks<br />
<br />
DC has now been removed, metadata cleaned up and all entries from DNS removed. &nbsp;Will check the logs tomorrow to see how things are.<br />

</div>


<div>
I have just been going through AD users and computer in advanced view and found the following entries.<br />
<br />
System<br />
&gt;&nbsp;Microsoft DNS<br />
&gt;&nbsp;xx.168.192.in-addr-arpa<br />
<br />
In each of my reverse lookup zones I have the following entries <br />
<br />
DC2.Domain.Local &nbsp;dnsNode<br />
<br />
I have checked DNS reverse lookup zones and the records have been removed and also name servers has been removed.
</div>


<div>
I've also still got an entrie for DC2 in Sites and services, should I delete this ?
</div>


<div>
Yes. If you see any entries just delete.
</div>


<div>
I have been checking the DNS &nbsp;name servers and have found that in some of the lookup zones DC1 is showing its IP address with a * at the end &quot;represents an ip address retrieved as the results of a DNS query and may not represent actual records stored on this server&quot; &nbsp;Would it be best to remove this record and re-add ?
</div>


<div>
Which records are showing up this way? Is it listed under the NS tab this way too? Removing it would be the best thing to do.
</div>


<div>
seems to be in 3 area's<br />
<br />
Forward lookup zones<br />
_msdcs.doma.local<br />
domain.xx.xx.uk<br />
<br />
Reverse lookup zones<br />
192.168.60.x subnet<br />
<br />
All other zones are ok.<br />

</div>


<div>
Yes this is all under the NS tab in properties of the zone in question
</div>


<div>
Remove the record then do a netdiag /fix. 
</div>


<div>
Thanks<br />
<br />
Well all seems to be ok so i've started to rebuild the DC, should hopefully have that back in the domain before close of play today.
</div>


<div>
OK I think i'm being a little bit thick.<br />
<br />
I forgot to install DNS before running dcpromo on DC2, I have therefore installed after succeful promotion. &nbsp;I have added DC2 into all Name servers in the properties of all zones on the primary DNS server. The problem is that I am missing one of my zones and when I click on DC2 in DNS I am prompted with the following information<br />
<br />
Configure a DNS Server<br />
<br />
The domain name system (DNS) is a hierarchical naming system used for locating computers and networks services Blah blah blah<br />
<br />
to configure the DNS server, on the action menu, click configure a DNS server.<br />
<br />
The zones on each servers are as follows<br />
<br />
Primary (DC1)<br />
FLZ<br />
_msdcs.domain.local<br />
domain.local<br />
domain.co.uk<br />
<br />
RLZ<br />
192.168.52.x subnet<br />
192.186.53.x subnet<br />
192.168.54.x subnet<br />
192.168.60.x subnet<br />
<br />
Seconday (DC2)<br />
FLZ<br />
_msdcs.domain.local<br />
domain.local<br />
<br />
RLZ<br />
192.168.52.x.subnet<br />
192.168.53.x subnet<br />
192.168.54.x subnet<br />
192.168.60.x subnet<br />
<br />
When the server was first intorduced as a DC I got several DNS event ID errors 4004. 4015. &nbsp;I have rebooted several times and these seem to have gone, but not sure if they might have coursed the problem to start with.
</div>


<div>
The domain.co.uk looks like a different zone that you would need to add to start replication with.
</div>


<div>
I found that the .co.uk zone is a primary configured zone, have added this and all seem to be working ok. &nbsp;Think that at last I can close this question down.<br />
<br />
Thanks for all you help. was going to accept the following solution as this seemed to fix the problem <br />
<br />
You could try the burflag but the dcpromo isn't a bad idea if you can do that without affecting production or losing domain information. When you dcpromo make sure you do a metadata cleanup just make sure everything is in order and there are no lingering objects. 
</div>


<div>
Excellent help, sorry its been a long one.
</div>


<div>
I'm glad everything is working out. Thanks!
</div>


<div>
<div class="content wysiwyg-content">
Sorry a bit of a long problem<br />
<br />
I've started to get the following error on my primary DC over the last few days.<br />
<br />
Event ID 13508<br />
Source NtFrs<br />
Description<br />
The file replication service is having trouble enabling replication from DC2 to DC1 for c:\windows\sysvol\domain using the DNS name DC2.domain.local FRS will keep retrying following are some of the reason you would see this warning<br />
<br />
1, FRS can not correctly resolve the DS name DC2.domain.local from this computer<br />
2, FRS is not running on DC2.domain.local<br />
3, The topology information in the AD for this replication has not yet replicated to all the DC<br />
<br />
This event log message will appear once per connection. After the problem is fixed you will see another event log message indicating that the connection has been establised.<br />
<br />
This is getting reported once a day around lunch time and not being followed up with an Event ID 13509<br />
<br />
I have confirmed on both DC's that DNS lookup is correct and I am able to ping each server in both directions, FRS is running on both servers and AD seems to be ok.<br />
<br />
Each server has a SYSVOL, however when I create a new text file in c:\windows\Sysvol\Sysvol\d<wbr />omain\scri<wbr />pts\ on my primary server it does not get replicated to the secondary.<br />
<br />
Checks that I have already tried<br />
<br />
ntfrsutl versions DC(1/2).domain.local - All looks ok<br />
repadmin /showrepl - All looks ok<br />
<br />
adsiedit<br />
\domain\domain controllers\DC - Only Primary DC has a NTFRS Subscriptions ?<br />
\domain\system\file replication services - looks ok <br />
<br />
When I run dcdiag I get 1 failed test which is FRSevent on the primary but not the secondary, When I run netdiag the only failure I get is Default Gateway Test but this would be due to the firewall/gateway configure not to responde to a ping.<br />
<br />
I'm a bit stuck on where to check next, any help would be greatly received.<br />
<br />
Thanks for you time.
</div>
</div>


Sorry a bit of a long problem

I've started to get the following error on my primary DC over the last few days.

Event ID 13508
Source NtFrs
Description
The file replication service is having trouble enabling replication from DC2 to DC1 for c:\windows\sysvol\domain using the DNS name DC2.domain.local FRS will keep retrying following are some of the reason you would see this warning

1, FRS can not correctly resolve the DS name DC2.domain.local from this computer
2, FRS is not running on DC2.domain.local
3, The topology information in the AD for this replication has not yet replicated to all the DC

This event log message will appear once per connection. After the problem is fixed you will see another event log message indicating that the connection has been establised.

This is getting reported once a day around lunch time and not being followed up with an Event ID 13509

I have confirmed on both DC's that DNS lookup is correct and I am able to ping each server in both directions, FRS is running on both servers and AD seems to be ok.

Each server has a SYSVOL, however when I create a new text file in c:\windows\Sysvol\Sysvol\domain\scripts\ on my primary server it does not get replicated to the secondary.

Checks that I have already tried

ntfrsutl versions DC(1/2).domain.local - All looks ok
repadmin /showrepl - All looks ok

adsiedit
\domain\domain controllers\DC - Only Primary DC has a NTFRS Subscriptions ?
\domain\system\file replication services - looks ok 

When I run dcdiag I get 1 failed test which is FRSevent on the primary but not the secondary, When I run netdiag the only failure I get is Default Gateway Test but this would be due to the firewall/gateway configure not to responde to a ping.

I'm a bit stuck on where to check next, any help would be greatly received.

Thanks for you time.

Event ID 13508

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).