AD Replication fails to Server 2008 for ~12 hours after reboot

Posted on 2008-10-15
Last Modified: 2008-10-25

First, let me give you some information on our current setup: We have a main site and two branch offices. Two DCs are installed at our main site, and one is at each branch office. The main site and the two branch offices are each in a different subnet and in different sites on Active Directory Sites and Services.

The DCs are:
DC1 (main site, Server 2003 x86)
DC2 (main site, Server 2003 R2 x64)
DC3 (branch office 1, Server 2003 x86)
DC4 (branch office 2, Server 2008 x64)

The two branch offices are connected to the mainsite over a 10Mbit Fibre Connection. The connection is very stable and all ports are open between the sites.

DC4 is the newest DC in our setup and I've been having this problem from the moment i've ran dcpromo on DC4. I have even reinstalled DC4, but it did not change anything.

For debugging reasons i have set DC4 to replicate with all other DCs. I first tried to replicate only with one DC at our main site, but this had the very same effect. Once I reboot DC4, it will not have any INBOUND replication for roughly 12 hours. OUTBOUND replications work fine. Running repadmin /showrepl gives nothing but successes on DCs 1-3 (also replications with DC4 are reported successful), but fails miserably for every try on DC4.

repadmin /showrepl ran against DC4 gives two different errors. For DC=domain, DC=tld ; Configuration ; Schema, the error is "result 1396 (0x574): Logon Failure: The target account name is incorrect.". For DomainDnsZones and ForestDnsZones, the error is "result 1256 (0x4e8):The remote system is not available. For information about network troubleshooting, see Windows Help."

Additionally, I have a couple of errors 1311 and 1645 in Event Viewer, along with 1925 and 1566 Warnings (they pop up every 15 minutes, so I assume for every replication try).

As mentioned, this only happens for the first 12 hours after a reboot of DC4. Once this certain time (or number of retries?) has passed, all event errors / warnings stop and changed items are replicated. repadmin /showrepl shows no errors anymore and the replications works fine as far as I can tell.

Any ideas?
Question by:Scripting_Guy
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Author Comment

ID: 22723013
Ok, I once again had this effect and it just went from "all bad" to "working smoothly". I rebooted the macine this morning and it came back up at 8:44 am. First Replication Error was at 9:04 am. Retries were made every 15 minutes

Last Replication Error was at 6:04 pm. 6:19 pm was the first successful replication. If my math is correct, it took exactly 40 failed retries or 10 hours until it started working.

LVL 31

Expert Comment

by:Henrik Johansson
ID: 22736058
Ensure that site link replication is configured in both directions for all DCs to avoid dead ends.

Author Comment

ID: 22752716
This is the case for all connections.
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.


Author Comment

ID: 22752730
Apparently nobody has an idea about this issue. Therefore I will open a support call with Microsoft by Monday morning about this issue and will let you know what they figured out (supposed my boss is willing to spend the cash, but I assume he is).

Accepted Solution

Scripting_Guy earned 0 total points
ID: 22759212
Microsoft called me back this afternoon and they are aware of the problem. It took them about 1/2 year to fix it, and the solution is this hotfix here:

The problems occur if you ever had a authoritive restore of your User krbtgt (kerberos account). In our case, we deleted a couple of users that should not have been deleted some time ago, and we restored the whole User OU. The authoritive restore will increase the version number of all items by 100'000, making it 100'002 instead of 2 for the krbtgt user. This causes the problem.

Although, the problem described in the KB has absolutely nothing to do with my problem, this hotfix will solve it. Note that the hotfix in this article is not downloadable directly from the Microsoft Homepage, you have to call them / write an email so they send you the links and passwords via email. You have to install the hotfix on all 2003 DCs and reboot them, reboot the 2008 Server afterwards and the replications work.

Maybe this will help someone who has the same issue as we had.
LVL 31

Expert Comment

by:Henrik Johansson
ID: 22759510
Good to hear it was solved.

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question