Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

NTDS/KCC errors 1311, 1566 1865 - with a twist (or, I know my remote sites cant contact each other)

Posted on 2008-10-21
16
Medium Priority
?
461 Views
Last Modified: 2011-10-19
OK, so we have a topology as follows:
                                                   HQ (is the main site)
                                        OKC, NEO, HOU (are branch offices connected by watchguard VPN)

Now, all branch sites can ping and access HQ, and HQ can ping/access branch sites. What is not allowed is branch site - branch site communication ( OKC to NEO or HOU to OKC as example). There is no route set for it in the firewall.

Recently we replaced the server at HOU, and added site NEO. HOU server displays these error messages about NTDS/KCC saying that it cant contact the server at OKC or NEO (duh).

In my Active Directory replications, I have only connections from branch offices to HQ and no connections from branch site to branch site.

This may be something really simple, but how do I get branch servers to stop checking these other servers and only check the two domain controllers at HQ?
0
Comment
Question by:standardhardware
  • 9
  • 7
16 Comments
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771503
The server you replaced, was it the master catalog?

You probably have to do this, read article:

It got rid of my ntds issues

http://support.microsoft.com/kb/255504
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771515
0
 

Author Comment

by:standardhardware
ID: 22771544
If youre talking about Schema master, that's one of the two DC's in HQ - not the one replaced in HOU. HOU was just a local DC that also served DNS & DHCP for that office.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 

Author Comment

by:standardhardware
ID: 22771552
Sorry, you posted the second link while I was typing, I'll check it out and get back with you.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22771577
i mistook the HOU for HQ... sorry.
Let me look at some other things.
0
 

Author Comment

by:standardhardware
ID: 22771580
Yeah, I'm fairly confident that the server held none of those roles, as we only have one forest, one domain, and there can only be one server holding those roles in each forest/domain. And I know that that server is in HQ...
0
 
LVL 7

Accepted Solution

by:
cmarandi earned 1000 total points
ID: 22771806
Go to the new server in HOU
Look at Active Directory Sites & Services
Expand your domain
That should list all the servers
Under each server there is NTDS Settings
Look at the property of each of those NTDS settings
Under the tab CONNECTIONS
Is it showing the correct servers to replicate from and to?
If not, I would change the settings on each of those servers, instead of waiting for one to replicate.
0
 

Author Comment

by:standardhardware
ID: 22772005
Ok, checking this out there was an auto-generated link between HOU and NEO (under HOU site), which I deleted as there was a link to HQ #1 DC as well. Also there was a link from HOU to NEO (under NEO site), which I deleted as there was a link to HQ #2 DC as well. OKC was only setup to link to HQ #1.

In these instances, in case we reboot server  #1 or server #2, should we link branch sites to both servers? Or is one sufficient?

Example:
OKC - HQ#1 and HQ#2
NEO - HQ#1 and HQ#2
HOU - HQ#1 and HQ#2

Configuration was:
OKC - HQ#1
NEO - HQ#2, HOU
HOU - HQ#1, NEO

Thanks, if this clears it up I will award the points.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22772062
What I would do, is if you already have a server that's functioning properly (OKC, NEO???) I would look at the settings over there and I would make the HOU like them.

Replications is done ervy 4 hours, so hopefully it will work and you'll know tomorrow... :-)
0
 

Author Comment

by:standardhardware
ID: 22776208
Well, I still have the errors this morning on HOU30. Checking sites and servcies, I see that the automagically generated connection from HOU to NEO has returned. All other connections remaind the same after I deleted them.

Looking at Sites & Services on #2 at HQ, I see links as follows:
Site HOU - HQ#1 and NEO server links
Site NEO - HOU and HQ#1 server links
Site OKC - HQ#1 server link

Looking at sites & services on #1 at HQ (schema master, primary domain controller), I see the same as #2 above.

Should I make the change on #1 at HQ, as it seems that the changes made at the remote site didn't replicate?

Would this have anything to do with Zone Transfers?

thanks for the help so far.
0
 

Author Comment

by:standardhardware
ID: 22787020
I tried deleting the links on HQ#2, as a test to see if they were being recreated by HQ#1 (schema master). They are , as I saw them again this morning. I have deleted the links from HQ#1, in the anticipation that it will replicate to all the servers, and once the links are gone the NTDS/KCC errors will disappear.
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22787310
Sorry, I was out of the office yesterday... Yes, the changes you make on the master will replicate to the other servers... since you have a 4 hour window, I would login to each server, including the ones in HQ and make it the way you'd want it to be.
Which is what you already did.
0
 

Author Comment

by:standardhardware
ID: 22798840
could anything else cause the links to be re-created? If I delete them all manually from all domain controllers, they still come back and cause the NTDS/KCC errors. :(
0
 
LVL 7

Expert Comment

by:cmarandi
ID: 22798867
There's got to be another DC that's forcing the replication... I donn't think the NTDS settings are coming from anywhere else.

Check all your DC's... I'll research to see if they can come from some where else.
0
 

Author Comment

by:standardhardware
ID: 22799063
Point of clarification... it seems to be my NEO server thats the problem. All DCs correctly reflect the same thing - that the  NEO server is the only one in ADS&S pointing to HOU as an automatic generated connection. HOU does not have an automatically generated link to NEO. I've attached a picture.
shhou30.bmp
0
 

Author Closing Comment

by:standardhardware
ID: 31508507
Thanks for your help.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Is your OST file inaccessible, Need to transfer OST file from one computer to another? Want to convert OST file to PST? If the answer to any of the above question is yes, then look no further. With the help of Stellar OST to PST Converter, you can e…

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question