Solved

AD Replication fails to Server 2008 for ~12 hours after reboot

Posted on 2008-10-15
6
1,272 Views
Last Modified: 2008-10-25
Hi

First, let me give you some information on our current setup: We have a main site and two branch offices. Two DCs are installed at our main site, and one is at each branch office. The main site and the two branch offices are each in a different subnet and in different sites on Active Directory Sites and Services.

The DCs are:
DC1 (main site, Server 2003 x86)
DC2 (main site, Server 2003 R2 x64)
DC3 (branch office 1, Server 2003 x86)
DC4 (branch office 2, Server 2008 x64)

The two branch offices are connected to the mainsite over a 10Mbit Fibre Connection. The connection is very stable and all ports are open between the sites.

DC4 is the newest DC in our setup and I've been having this problem from the moment i've ran dcpromo on DC4. I have even reinstalled DC4, but it did not change anything.

For debugging reasons i have set DC4 to replicate with all other DCs. I first tried to replicate only with one DC at our main site, but this had the very same effect. Once I reboot DC4, it will not have any INBOUND replication for roughly 12 hours. OUTBOUND replications work fine. Running repadmin /showrepl gives nothing but successes on DCs 1-3 (also replications with DC4 are reported successful), but fails miserably for every try on DC4.

repadmin /showrepl ran against DC4 gives two different errors. For DC=domain, DC=tld ; Configuration ; Schema, the error is "result 1396 (0x574): Logon Failure: The target account name is incorrect.". For DomainDnsZones and ForestDnsZones, the error is "result 1256 (0x4e8):The remote system is not available. For information about network troubleshooting, see Windows Help."

Additionally, I have a couple of errors 1311 and 1645 in Event Viewer, along with 1925 and 1566 Warnings (they pop up every 15 minutes, so I assume for every replication try).

As mentioned, this only happens for the first 12 hours after a reboot of DC4. Once this certain time (or number of retries?) has passed, all event errors / warnings stop and changed items are replicated. repadmin /showrepl shows no errors anymore and the replications works fine as far as I can tell.

Any ideas?
0
Comment
Question by:Scripting_Guy
  • 4
  • 2
6 Comments
 
LVL 3

Author Comment

by:Scripting_Guy
ID: 22723013
Ok, I once again had this effect and it just went from "all bad" to "working smoothly". I rebooted the macine this morning and it came back up at 8:44 am. First Replication Error was at 9:04 am. Retries were made every 15 minutes

Last Replication Error was at 6:04 pm. 6:19 pm was the first successful replication. If my math is correct, it took exactly 40 failed retries or 10 hours until it started working.

0
 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 22736058
Ensure that site link replication is configured in both directions for all DCs to avoid dead ends.
0
 
LVL 3

Author Comment

by:Scripting_Guy
ID: 22752716
This is the case for all connections.
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 
LVL 3

Author Comment

by:Scripting_Guy
ID: 22752730
Apparently nobody has an idea about this issue. Therefore I will open a support call with Microsoft by Monday morning about this issue and will let you know what they figured out (supposed my boss is willing to spend the cash, but I assume he is).
0
 
LVL 3

Accepted Solution

by:
Scripting_Guy earned 0 total points
ID: 22759212
Microsoft called me back this afternoon and they are aware of the problem. It took them about 1/2 year to fix it, and the solution is this hotfix here:
http://support.microsoft.com/kb/939820/en-us

The problems occur if you ever had a authoritive restore of your User krbtgt (kerberos account). In our case, we deleted a couple of users that should not have been deleted some time ago, and we restored the whole User OU. The authoritive restore will increase the version number of all items by 100'000, making it 100'002 instead of 2 for the krbtgt user. This causes the problem.

Although, the problem described in the KB has absolutely nothing to do with my problem, this hotfix will solve it. Note that the hotfix in this article is not downloadable directly from the Microsoft Homepage, you have to call them / write an email so they send you the links and passwords via email. You have to install the hotfix on all 2003 DCs and reboot them, reboot the 2008 Server afterwards and the replications work.

Maybe this will help someone who has the same issue as we had.
0
 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 22759510
Good to hear it was solved.
0

Featured Post

Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now