NTDS/KCC errors 1311, 1566 1865 - with a twist (or, I know my remote sites cant contact each other)

OK, so we have a topology as follows:
                                                   HQ (is the main site)
                                        OKC, NEO, HOU (are branch offices connected by watchguard VPN)

Now, all branch sites can ping and access HQ, and HQ can ping/access branch sites. What is not allowed is branch site - branch site communication ( OKC to NEO or HOU to OKC as example). There is no route set for it in the firewall.

Recently we replaced the server at HOU, and added site NEO. HOU server displays these error messages about NTDS/KCC saying that it cant contact the server at OKC or NEO (duh).

In my Active Directory replications, I have only connections from branch offices to HQ and no connections from branch site to branch site.

This may be something really simple, but how do I get branch servers to stop checking these other servers and only check the two domain controllers at HQ?
standardhardwareAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

cmarandiCommented:
The server you replaced, was it the master catalog?

You probably have to do this, read article:

It got rid of my ntds issues

http://support.microsoft.com/kb/255504
0
cmarandiCommented:
0
standardhardwareAuthor Commented:
If youre talking about Schema master, that's one of the two DC's in HQ - not the one replaced in HOU. HOU was just a local DC that also served DNS & DHCP for that office.
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

standardhardwareAuthor Commented:
Sorry, you posted the second link while I was typing, I'll check it out and get back with you.
0
cmarandiCommented:
i mistook the HOU for HQ... sorry.
Let me look at some other things.
0
standardhardwareAuthor Commented:
Yeah, I'm fairly confident that the server held none of those roles, as we only have one forest, one domain, and there can only be one server holding those roles in each forest/domain. And I know that that server is in HQ...
0
cmarandiCommented:
Go to the new server in HOU
Look at Active Directory Sites & Services
Expand your domain
That should list all the servers
Under each server there is NTDS Settings
Look at the property of each of those NTDS settings
Under the tab CONNECTIONS
Is it showing the correct servers to replicate from and to?
If not, I would change the settings on each of those servers, instead of waiting for one to replicate.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
standardhardwareAuthor Commented:
Ok, checking this out there was an auto-generated link between HOU and NEO (under HOU site), which I deleted as there was a link to HQ #1 DC as well. Also there was a link from HOU to NEO (under NEO site), which I deleted as there was a link to HQ #2 DC as well. OKC was only setup to link to HQ #1.

In these instances, in case we reboot server  #1 or server #2, should we link branch sites to both servers? Or is one sufficient?

Example:
OKC - HQ#1 and HQ#2
NEO - HQ#1 and HQ#2
HOU - HQ#1 and HQ#2

Configuration was:
OKC - HQ#1
NEO - HQ#2, HOU
HOU - HQ#1, NEO

Thanks, if this clears it up I will award the points.
0
cmarandiCommented:
What I would do, is if you already have a server that's functioning properly (OKC, NEO???) I would look at the settings over there and I would make the HOU like them.

Replications is done ervy 4 hours, so hopefully it will work and you'll know tomorrow... :-)
0
standardhardwareAuthor Commented:
Well, I still have the errors this morning on HOU30. Checking sites and servcies, I see that the automagically generated connection from HOU to NEO has returned. All other connections remaind the same after I deleted them.

Looking at Sites & Services on #2 at HQ, I see links as follows:
Site HOU - HQ#1 and NEO server links
Site NEO - HOU and HQ#1 server links
Site OKC - HQ#1 server link

Looking at sites & services on #1 at HQ (schema master, primary domain controller), I see the same as #2 above.

Should I make the change on #1 at HQ, as it seems that the changes made at the remote site didn't replicate?

Would this have anything to do with Zone Transfers?

thanks for the help so far.
0
standardhardwareAuthor Commented:
I tried deleting the links on HQ#2, as a test to see if they were being recreated by HQ#1 (schema master). They are , as I saw them again this morning. I have deleted the links from HQ#1, in the anticipation that it will replicate to all the servers, and once the links are gone the NTDS/KCC errors will disappear.
0
cmarandiCommented:
Sorry, I was out of the office yesterday... Yes, the changes you make on the master will replicate to the other servers... since you have a 4 hour window, I would login to each server, including the ones in HQ and make it the way you'd want it to be.
Which is what you already did.
0
standardhardwareAuthor Commented:
could anything else cause the links to be re-created? If I delete them all manually from all domain controllers, they still come back and cause the NTDS/KCC errors. :(
0
cmarandiCommented:
There's got to be another DC that's forcing the replication... I donn't think the NTDS settings are coming from anywhere else.

Check all your DC's... I'll research to see if they can come from some where else.
0
standardhardwareAuthor Commented:
Point of clarification... it seems to be my NEO server thats the problem. All DCs correctly reflect the same thing - that the  NEO server is the only one in ADS&S pointing to HOU as an automatic generated connection. HOU does not have an automatically generated link to NEO. I've attached a picture.
shhou30.bmp
0
standardhardwareAuthor Commented:
Thanks for your help.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.