Solved

NTDS/KCC errors 1311, 1566 1865 - with a twist (or, I know my remote sites cant contact each other)

Posted on 2008-10-21
16
433 Views
Last Modified: 2011-10-19
OK, so we have a topology as follows:
                                                   HQ (is the main site)
                                        OKC, NEO, HOU (are branch offices connected by watchguard VPN)

Now, all branch sites can ping and access HQ, and HQ can ping/access branch sites. What is not allowed is branch site - branch site communication ( OKC to NEO or HOU to OKC as example). There is no route set for it in the firewall.

Recently we replaced the server at HOU, and added site NEO. HOU server displays these error messages about NTDS/KCC saying that it cant contact the server at OKC or NEO (duh).

In my Active Directory replications, I have only connections from branch offices to HQ and no connections from branch site to branch site.

This may be something really simple, but how do I get branch servers to stop checking these other servers and only check the two domain controllers at HQ?
0
Comment
Question by:standardhardware
  • 9
  • 7
16 Comments
 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
The server you replaced, was it the master catalog?

You probably have to do this, read article:

It got rid of my ntds issues

http://support.microsoft.com/kb/255504
0
 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
0
 

Author Comment

by:standardhardware
Comment Utility
If youre talking about Schema master, that's one of the two DC's in HQ - not the one replaced in HOU. HOU was just a local DC that also served DNS & DHCP for that office.
0
 

Author Comment

by:standardhardware
Comment Utility
Sorry, you posted the second link while I was typing, I'll check it out and get back with you.
0
 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
i mistook the HOU for HQ... sorry.
Let me look at some other things.
0
 

Author Comment

by:standardhardware
Comment Utility
Yeah, I'm fairly confident that the server held none of those roles, as we only have one forest, one domain, and there can only be one server holding those roles in each forest/domain. And I know that that server is in HQ...
0
 
LVL 7

Accepted Solution

by:
cmarandi earned 250 total points
Comment Utility
Go to the new server in HOU
Look at Active Directory Sites & Services
Expand your domain
That should list all the servers
Under each server there is NTDS Settings
Look at the property of each of those NTDS settings
Under the tab CONNECTIONS
Is it showing the correct servers to replicate from and to?
If not, I would change the settings on each of those servers, instead of waiting for one to replicate.
0
 

Author Comment

by:standardhardware
Comment Utility
Ok, checking this out there was an auto-generated link between HOU and NEO (under HOU site), which I deleted as there was a link to HQ #1 DC as well. Also there was a link from HOU to NEO (under NEO site), which I deleted as there was a link to HQ #2 DC as well. OKC was only setup to link to HQ #1.

In these instances, in case we reboot server  #1 or server #2, should we link branch sites to both servers? Or is one sufficient?

Example:
OKC - HQ#1 and HQ#2
NEO - HQ#1 and HQ#2
HOU - HQ#1 and HQ#2

Configuration was:
OKC - HQ#1
NEO - HQ#2, HOU
HOU - HQ#1, NEO

Thanks, if this clears it up I will award the points.
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
What I would do, is if you already have a server that's functioning properly (OKC, NEO???) I would look at the settings over there and I would make the HOU like them.

Replications is done ervy 4 hours, so hopefully it will work and you'll know tomorrow... :-)
0
 

Author Comment

by:standardhardware
Comment Utility
Well, I still have the errors this morning on HOU30. Checking sites and servcies, I see that the automagically generated connection from HOU to NEO has returned. All other connections remaind the same after I deleted them.

Looking at Sites & Services on #2 at HQ, I see links as follows:
Site HOU - HQ#1 and NEO server links
Site NEO - HOU and HQ#1 server links
Site OKC - HQ#1 server link

Looking at sites & services on #1 at HQ (schema master, primary domain controller), I see the same as #2 above.

Should I make the change on #1 at HQ, as it seems that the changes made at the remote site didn't replicate?

Would this have anything to do with Zone Transfers?

thanks for the help so far.
0
 

Author Comment

by:standardhardware
Comment Utility
I tried deleting the links on HQ#2, as a test to see if they were being recreated by HQ#1 (schema master). They are , as I saw them again this morning. I have deleted the links from HQ#1, in the anticipation that it will replicate to all the servers, and once the links are gone the NTDS/KCC errors will disappear.
0
 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
Sorry, I was out of the office yesterday... Yes, the changes you make on the master will replicate to the other servers... since you have a 4 hour window, I would login to each server, including the ones in HQ and make it the way you'd want it to be.
Which is what you already did.
0
 

Author Comment

by:standardhardware
Comment Utility
could anything else cause the links to be re-created? If I delete them all manually from all domain controllers, they still come back and cause the NTDS/KCC errors. :(
0
 
LVL 7

Expert Comment

by:cmarandi
Comment Utility
There's got to be another DC that's forcing the replication... I donn't think the NTDS settings are coming from anywhere else.

Check all your DC's... I'll research to see if they can come from some where else.
0
 

Author Comment

by:standardhardware
Comment Utility
Point of clarification... it seems to be my NEO server thats the problem. All DCs correctly reflect the same thing - that the  NEO server is the only one in ADS&S pointing to HOU as an automatic generated connection. HOU does not have an automatically generated link to NEO. I've attached a picture.
shhou30.bmp
0
 

Author Closing Comment

by:standardhardware
Comment Utility
Thanks for your help.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now