Link to home
Start Free TrialLog in
Avatar of walsh_stephen
walsh_stephenFlag for United States of America

asked on

Repadmin /syncall generates a 8453 (0x2105) Error and Fails on replication

I created a brand new Windows 2008 Enterprise Domain in a VM Environment with all the latest patches. After promoting the Second DC - I started noticing that servers that were joining the domain would not appear in Users and Computers.  I checked the following:

1. TimeSync with NTP (There was a time issue but it is now resolved - all are sync'ing with nist.gov)
2. DNS has valid entries in the domain in the _msdcs folder
3. Ran repadmin to trouble shoot and saw the following:
 for /syncall run -
CALLBACK MESSAGE: The following replication is in progress:
    From: 26a54e69-1984-4e95-9491-f423da334a8d._msdcs.lss.company.com
    To  : 6068dd17-a0fb-4a57-819a-01d8022ddb55._msdcs.lss.company.com
CALLBACK MESSAGE: Error issuing replication: 8453 (0x2105):
    Replication access was denied.
    From: 26a54e69-1984-4e95-9491-f423da334a8d._msdcs.lss.company.com
    To  : 6068dd17-a0fb-4a57-819a-01d8022ddb55._msdcs.lss.company.com
CALLBACK MESSAGE: SyncAll Finished.

SyncAll reported the following errors:
Error issuing replication: 8453 (0x2105):
    Replication access was denied.
    From: 26a54e69-1984-4e95-9491-f423da334a8d._msdcs.lss.company.com
    To  : 6068dd17-a0fb-4a57-819a-01d8022ddb55._msdcs.lss.company.com

for a /showreps -

C:\Users\swalsh>repadmin /showreps
Default-First-Site-Name\AVAMAR252
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 6068dd17-a0fb-4a57-819a-01d8022ddb55
DSA invocationID: 6068dd17-a0fb-4a57-819a-01d8022ddb55

==== INBOUND NEIGHBORS ======================================

DC=lss,DC=company,DC=com
    Default-First-Site-Name\AVAMAR253 via RPC
        DSA object GUID: 26a54e69-1984-4e95-9491-f423da334a8d
        Last attempt @ 2008-10-10 15:04:00 was successful.

CN=Configuration,DC=lss,DC=company,DC=com
    Default-First-Site-Name\AVAMAR253 via RPC
        DSA object GUID: 26a54e69-1984-4e95-9491-f423da334a8d
        Last attempt @ 2008-10-10 14:56:54 was successful.

CN=Schema,CN=Configuration,DC=lss,DC=company,DC=com
    Default-First-Site-Name\AVAMAR253 via RPC
        DSA object GUID: 26a54e69-1984-4e95-9491-f423da334a8d
        Last attempt @ 2008-10-10 14:56:54 was successful.

DC=DomainDnsZones,DC=lss,DC=company,DC=com
    Default-First-Site-Name\AVAMAR253 via RPC
        DSA object GUID: 26a54e69-1984-4e95-9491-f423da334a8d
        Last attempt @ 2008-10-10 14:56:54 was successful.

DC=ForestDnsZones,DC=lss,DC=company,DC=com
    Default-First-Site-Name\AVAMAR253 via RPC
        DSA object GUID: 26a54e69-1984-4e95-9491-f423da334a8d
        Last attempt @ 2008-10-10 14:56:54 was successful.
DsReplicaGetInfo() failed with status 8453 (0x2105):
    Replication access was denied.
DsReplicaGetInfo() failed with status 8453 (0x2105):
    Replication access was denied.

There is also an 4013 error in DNS that I don't know how to fix and there is no info on Microsoft's site that I have found:
Event Type:      Warning
Event Source:      DNS
Event Category:      None
Event ID:      4013
Date:            10/10/2008
Time:            2:27:14 PM
User:            N/A
Computer:      AVAMAR252.lss.company.com
Description:
The DNS server is waiting for Active Directory Domain Services (AD DS) to signal that the initial synchronization of the directory has been completed. The DNS server service cannot start until the initial synchronization is complete because critical DNS data might not yet be replicated onto this domain controller. If events in the AD DS event log indicate that there is a problem with DNS name resolution, consider adding the IP address of another DNS server for this domain to the DNS server list in the Internet Protocol properties of this computer. This event will be logged every two minutes until AD DS has signaled that the initial synchronization has successfully completed.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I am unsure if these are interrelated. Any guidance greatly appreciated.

- Steve
ASKER CERTIFIED SOLUTION
Avatar of Gideon7
Gideon7
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of walsh_stephen

ASKER

So I need to wait the 60-90m before doing the DCPROMO /forceremoval ? How do I know DNS is unblocked ?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Still had randon SID Corruption across the DC's. Ended up rebuilding but this was great info in triage. Thanks
Avatar of cntboys
cntboys

This happens when you do a repadmin /syncall without an enterprise account.
You must be Enterprise Admin to force replication to remote domains and subdomains.