Solved

Errors in DCDIAG.

Posted on 2008-10-07
11
1,777 Views
Last Modified: 2011-10-19
Hello!

I have some errors running DCDIAG, which i would like tohave solved. Can you help me? here is my dcdiag from my PDC.
      Starting test: Connectivity
         ......................... DC1 passed test Connectivity

Doing primary tests

   Testing server: Site1\DC1
      Starting test: Replications
         REPLICATION-RECEIVED LATENCY WARNING
         DC1:  Current time is 2008-10-07 09:56:29.
            DC=ForestDnsZones,DC=domain,DC=eu
               Last replication recieved from EDENSRV1 at 2007-08-24 08:57:44.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days
!
            DC=DomainDnsZones,DC=domain,DC=eu
               Last replication recieved from EDENSRV1 at 2007-08-24 09:15:54.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days
!
            CN=Schema,CN=Configuration,DC=domain,DC=eu
               Last replication recieved from EDENSRV1 at 2007-08-24 08:57:43.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days
!
               Last replication recieved from PDNSRV1 at 2008-04-18 09:46:34.
            CN=Configuration,DC=domain,DC=eu
               Last replication recieved from EDENSRV1 at 2007-08-24 08:57:43.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days
!
               Last replication recieved from PDNSRV1 at 2008-04-18 09:46:34.
            DC=domain,DC=eu
               Last replication recieved from EDENSRV1 at 2007-08-24 08:57:44.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days
!
               Last replication recieved from PDNSRV1 at 2008-04-18 09:46:35.
         ......................... DC1 passed test Replications
      Starting test: NCSecDesc
         ......................... DC1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC1 passed test NetLogons
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\PdnDc1.domain.eu, when we
 were trying to reach DC1.
         Server is not responding or is not considered suitable.
         ......................... DC1 failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... DC1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... DC1 passed test RidManager
      Starting test: MachineAccount
         ......................... DC1 passed test MachineAccount
      Starting test: Services
            NETLOGON Service is paused on [DC1]
         ......................... DC1 failed test Services
      Starting test: ObjectsReplicated
         ......................... DC1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... DC1 passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC1 failed test frsevent
      Starting test: kccevent
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 10/07/2008   09:50:41
            Event String: All domain controllers in the following site that
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) has
         An Warning Event occured.  EventID: 0x80000749
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) was
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 10/07/2008   09:50:41
            Event String: All domain controllers in the following site that
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) has
         An Warning Event occured.  EventID: 0x80000749
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) was
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 10/07/2008   09:50:41
            Event String: All domain controllers in the following site that
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) has
         An Warning Event occured.  EventID: 0x80000749
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) was
         An Warning Event occured.  EventID: 0x8000061E
            Time Generated: 10/07/2008   09:50:41
            Event String: All domain controllers in the following site that
         An Error Event occured.  EventID: 0xC000051F
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) has
         An Warning Event occured.  EventID: 0x80000749
            Time Generated: 10/07/2008   09:50:41
            Event String: The Knowledge Consistency Checker (KCC) was
         An Warning Event occured.  EventID: 0x80000785
            Time Generated: 10/07/2008   09:50:43
            Event String: The attempt to establish a replication link for
         An Warning Event occured.  EventID: 0x80000785
            Time Generated: 10/07/2008   09:50:43
            Event String: The attempt to establish a replication link for
         ......................... DC1 failed test kccevent
      Starting test: systemlog
         ......................... DC1 passed test systemlog
      Starting test: VerifyReferences
         ......................... DC1 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : papd
      Starting test: CrossRefValidation
         ......................... papd passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... papd passed test CheckSDRefDom

   Running enterprise tests on : papd.eu
      Starting test: Intersite
         ......................... papd.eu passed test Intersite
      Starting test: FsmoCheck
         ......................... papd.eu passed test FsmoCheck


Is is important to notice, that the problems reaching the servers PDNSRV1 and EDENSRV1 is because these DC´s are no longer in the domain. But why do I still see them some places in DNS, and also in this DCDIAG?

Any help on all the issues one by one would be gratly appreciated.
0
Comment
Question by:johnnybrian
  • 5
  • 5
11 Comments
 
LVL 3

Assisted Solution

by:tismetoo
tismetoo earned 50 total points
Comment Utility
Jonnybrian

This DC has not been connected for more than 13 months. First question I would ask is do you really need it?

After that, the servers are listed in dcdiag because they are still in the DNS this server refers to - presumably itself. First thing I would do is change it's DNS server to a DC that is connected and replicating with the domain.

After that look at the following article, which gives the whole picture on AD replication. The most important bit will be removing the lingering objects - check out the command repadmin /removelingeringobjects in the doc.

http://technet.microsoft.com/en-us/library/cc772726.aspx
0
 
LVL 82

Accepted Solution

by:
oBdA earned 450 total points
Comment Utility
You still see them because you should not just shut down DCs you don't need anymore; DCs have to be demoted, so that AD knows they're gone for good.
Check here on how to clean up your AD:
How to remove data in Active Directory after an unsuccessful domain controller demotion
http://support.microsoft.com/?kbid=216498

How can I delete a failed Domain Controller object from Active Directory?
http://www.petri.co.il/delete_failed_dcs_from_ad.htm
0
 
LVL 1

Author Comment

by:johnnybrian
Comment Utility
Okay, did the think on Petri.co.il and it looks a little birghter now i think; Please tak a look at my dcdiag now:

The only thing that springs to mind is the problem with dhasrv1, but i dont quite know how to interpret this error message. I can tell you though, that it seems like my domain actually thinks that dhasrv1 is the main DC of my domain, but the FSMO is DC1.

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Varde\DC1
      Starting test: Connectivity
         ......................... DC1 passed test Connectivity

Doing primary tests

   Testing server: Varde\DC1
      Starting test: Replications
         ......................... DC1 passed test Replications
      Starting test: NCSecDesc
         ......................... DC1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC1 passed test NetLogons
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\dhasrv1.XXXXX.eu, when w
e were trying to reach DC1.
         Server is not responding or is not considered suitable.
         ......................... DC1 failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... DC1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... DC1 passed test RidManager
      Starting test: MachineAccount
         ......................... DC1 passed test MachineAccount
      Starting test: Services
            NETLOGON Service is paused on [DC1]
         ......................... DC1 failed test Services
      Starting test: ObjectsReplicated
         ......................... DC1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... DC1 passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC1 failed test frsevent
      Starting test: kccevent
         ......................... DC1 passed test kccevent
      Starting test: systemlog
         ......................... DC1 passed test systemlog
      Starting test: VerifyReferences
         ......................... DC1 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : XXX
      Starting test: CrossRefValidation
         ......................... XXXXX passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... XXXXX passed test CheckSDRefDom

   Running enterprise tests on : XXXXX.eu
      Starting test: Intersite
         ......................... XXXXX.eu passed test Intersite
      Starting test: FsmoCheck
         ......................... XXXXX.eu passed test FsmoCheck
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
Start with starting the netlogon service on DC1; it's paused.
Then make sure that there aren't any host entries for dhasrv1 in DNS, especially in _msdcs.
Then make sure your DNS setoings are correct:

10 DNS Errors That Will Kill Your Network
http://redmondmag.com/features/article.asp?EditorialsID=413

Frequently asked questions about Windows 2000 DNS and Windows Server 2003 DNS
http://support.microsoft.com/?kbid=291382

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003
http://support.microsoft.com/?kbid=825036
0
 
LVL 1

Author Comment

by:johnnybrian
Comment Utility
oBdA: Well, dhasrv1 is actually online and running as a DNS. Thats the problem, so i dont think i should delete entries in DNS?

/HAX

Also, i have posted one thing i think is strange with my sites; look at the attached file of my sites, and then of the sites in DNS.

As you see in MSDCS under DC>sites and GC>Sites, i think that DC1 (FSMO) is in the Outrup site. However, as you cann on the other attachment, this server is actually in the VARDE site. So actually there are old sites in DNS which does not even exist anymore, and the DNS thinks that DC1 is in OUTRUP site, but really it is in Varde. What gives?


Sites-in-DNS.png
sitesandservices.png
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 1

Author Comment

by:johnnybrian
Comment Utility
Sorry, forget about that last part. I fugured that one out.

The only problem i now face is this: Starting test: Advertising
         Warning: DsGetDcName returned information for \\dhasrv1.XXXXX.eu, when w
e were trying to reach DC1.
         Server is not responding or is not considered suitable.

This server is up and running and a DC. Why the error?

0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
If dhasrv1 is still alive and a DC, then the DNS entries should of course not be deleted, but check if the entries are correct. Did you ever rename one of the DCs?
Make sure each DC is in its correct site, remove sites that don't exist anymore from AD and DNS.
Then restart the netlogon service on all DCs, and run 'ipconfig /registerdns' on all of them.
Check DNS again after it had time to replicate.
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
Have you actually (re-)started the netlogon service on DC1 as advised in 22657839? No netlogon service, no domain services ...
0
 
LVL 1

Author Comment

by:johnnybrian
Comment Utility
I restarted the service, yeah. and after that, the erro has gone completely.

Last error is: Starting test: frsevent
   There are warning or error events within the last 24 hours after the
   SYSVOL has been shared.  Failing SYSVOL replication problems may cause
   Group Policy problems.
 ......................... DC1 failed test frsevent

Thanks for all your help so far! :)
0
 
LVL 82

Expert Comment

by:oBdA
Comment Utility
Here dcdiag is just reading from the event log. As long as these warnings are stopping now (or are not important, because of temporary connection problems), you should be fine.
If you feel like it, you can save and delete the system event log and run dcdiag again after an hour or so.
0
 
LVL 1

Author Comment

by:johnnybrian
Comment Utility
Thanks! That really cleared up my AD!

/HAX
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
This is a little timesaver I have been using for setting up Microsoft Small Business Server (SBS) in the simplest possible way. It may not be appropriate for every customer. However, when you get a situation where the person who owns the server is i…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now