Solved

NTDS/KCC errors 1311, 1566 1865 - with a twist (or, I know my remote sites cant contact each other)

Posted on 2008-10-21
16
451 Views
Last Modified: 2011-10-19
OK, so we have a topology as follows:
                                                   HQ (is the main site)
                                        OKC, NEO, HOU (are branch offices connected by watchguard VPN)

Now, all branch sites can ping and access HQ, and HQ can ping/access branch sites. What is not allowed is branch site - branch site communication ( OKC to NEO or HOU to OKC as example). There is no route set for it in the firewall.

Recently we replaced the server at HOU, and added site NEO. HOU server displays these error messages about NTDS/KCC saying that it cant contact the server at OKC or NEO (duh).

In my Active Directory replications, I have only connections from branch offices to HQ and no connections from branch site to branch site.

This may be something really simple, but how do I get branch servers to stop checking these other servers and only check the two domain controllers at HQ?
0
Comment
Question by:standardhardware
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 7
16 Comments
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771503
The server you replaced, was it the master catalog?

You probably have to do this, read article:

It got rid of my ntds issues

http://support.microsoft.com/kb/255504
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771515
0
 

Author Comment

by:standardhardware
ID: 22771544
If youre talking about Schema master, that's one of the two DC's in HQ - not the one replaced in HOU. HOU was just a local DC that also served DNS & DHCP for that office.
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 

Author Comment

by:standardhardware
ID: 22771552
Sorry, you posted the second link while I was typing, I'll check it out and get back with you.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771577
i mistook the HOU for HQ... sorry.
Let me look at some other things.
0
 

Author Comment

by:standardhardware
ID: 22771580
Yeah, I'm fairly confident that the server held none of those roles, as we only have one forest, one domain, and there can only be one server holding those roles in each forest/domain. And I know that that server is in HQ...
0
 
LVL 7

Accepted Solution

by:
cmarandi earned 250 total points
ID: 22771806
Go to the new server in HOU
Look at Active Directory Sites & Services
Expand your domain
That should list all the servers
Under each server there is NTDS Settings
Look at the property of each of those NTDS settings
Under the tab CONNECTIONS
Is it showing the correct servers to replicate from and to?
If not, I would change the settings on each of those servers, instead of waiting for one to replicate.
0
 

Author Comment

by:standardhardware
ID: 22772005
Ok, checking this out there was an auto-generated link between HOU and NEO (under HOU site), which I deleted as there was a link to HQ #1 DC as well. Also there was a link from HOU to NEO (under NEO site), which I deleted as there was a link to HQ #2 DC as well. OKC was only setup to link to HQ #1.

In these instances, in case we reboot server  #1 or server #2, should we link branch sites to both servers? Or is one sufficient?

Example:
OKC - HQ#1 and HQ#2
NEO - HQ#1 and HQ#2
HOU - HQ#1 and HQ#2

Configuration was:
OKC - HQ#1
NEO - HQ#2, HOU
HOU - HQ#1, NEO

Thanks, if this clears it up I will award the points.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22772062
What I would do, is if you already have a server that's functioning properly (OKC, NEO???) I would look at the settings over there and I would make the HOU like them.

Replications is done ervy 4 hours, so hopefully it will work and you'll know tomorrow... :-)
0
 

Author Comment

by:standardhardware
ID: 22776208
Well, I still have the errors this morning on HOU30. Checking sites and servcies, I see that the automagically generated connection from HOU to NEO has returned. All other connections remaind the same after I deleted them.

Looking at Sites & Services on #2 at HQ, I see links as follows:
Site HOU - HQ#1 and NEO server links
Site NEO - HOU and HQ#1 server links
Site OKC - HQ#1 server link

Looking at sites & services on #1 at HQ (schema master, primary domain controller), I see the same as #2 above.

Should I make the change on #1 at HQ, as it seems that the changes made at the remote site didn't replicate?

Would this have anything to do with Zone Transfers?

thanks for the help so far.
0
 

Author Comment

by:standardhardware
ID: 22787020
I tried deleting the links on HQ#2, as a test to see if they were being recreated by HQ#1 (schema master). They are , as I saw them again this morning. I have deleted the links from HQ#1, in the anticipation that it will replicate to all the servers, and once the links are gone the NTDS/KCC errors will disappear.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22787310
Sorry, I was out of the office yesterday... Yes, the changes you make on the master will replicate to the other servers... since you have a 4 hour window, I would login to each server, including the ones in HQ and make it the way you'd want it to be.
Which is what you already did.
0
 

Author Comment

by:standardhardware
ID: 22798840
could anything else cause the links to be re-created? If I delete them all manually from all domain controllers, they still come back and cause the NTDS/KCC errors. :(
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22798867
There's got to be another DC that's forcing the replication... I donn't think the NTDS settings are coming from anywhere else.

Check all your DC's... I'll research to see if they can come from some where else.
0
 

Author Comment

by:standardhardware
ID: 22799063
Point of clarification... it seems to be my NEO server thats the problem. All DCs correctly reflect the same thing - that the  NEO server is the only one in ADS&S pointing to HOU as an automatic generated connection. HOU does not have an automatically generated link to NEO. I've attached a picture.
shhou30.bmp
0
 

Author Closing Comment

by:standardhardware
ID: 31508507
Thanks for your help.
0

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This may not be a text book method to resolve VSS backup issues but it seemed to have worked on few of the Windows 2003 servers we had issues while performing a Volume Shadow Copy backup. If you have issues while performing a shadow copy backup usin…
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

615 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question