Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

Which DC should I reset machine account?

Posted on 2008-11-05
21
Medium Priority
?
580 Views
Last Modified: 2013-12-05
I have a single domain called something like abc.xyz.com. There is one DC/DNS/GC running on a slow old PC, I tried to set up a new pc and transfered all 5 role of FSMO to the new PC. It went successfully. I just checked the role on each DC, the roles changed there. But the problem here is when I run DCDIAG /FIX on new DC, I got one of the fail message: Ths system volume has not been completely replicated to the local machine. This machine is not working properly as a DC....

Also when I tried to do replication from site and service (Both DC are GCs), I got "The following error occurred during the attempt to synchronize the domain controllers: Access is denied"....

*both the DCs running windows 2000 sp4. They are poingting theirself for DNS and they are AD-Intergrated. DNS is also working well, I didn't see any DNS errors.

I didn't see any problem wit AD replication. I tried to create a user one DC and it replicates to the other DC.

I think maybe the password is out of sync, that's why I got access denied... But for the part of SYSVOL not been completely replicated..... Does this one has anything to do with resetting the password? If so which DC should I reset password?

I have read a post and the person successfully solved the problem. But his way looks wired to me... The person reset the password on the DC running PDC though....

http://www.tek-tips.com/viewthread.cfm?qid=756697

His solution is at the last post.
0
Comment
Question by:wuitsung
  • 11
  • 10
21 Comments
 
LVL 59

Accepted Solution

by:
Darius Ghassem earned 900 total points
ID: 22890659
0
 

Author Comment

by:wuitsung
ID: 22890727
But the 2 links are the same???
And it's rebuilding SYSVOL....
I don't need to reset machine account password first??
http://support.microsoft.com/kb/260575/en-us
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22890758
No.
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 

Author Comment

by:wuitsung
ID: 22890852
why? can you explain to me?
0
 
LVL 59

Assisted Solution

by:Darius Ghassem
Darius Ghassem earned 900 total points
ID: 22891437
That the fix for that issue. You can try the reset but the burflag method should work without having to reset the computer account. The secure channel reset could work but usually this is used when the DCs lose the domain.
0
 

Author Comment

by:wuitsung
ID: 22897165
Ok. I wil try it. Do you know how to reproduce the problem? I mea to make one of my DC to have this errormessage "Ths system volume has not been completely replicated to the local machine. This machine is not working properly as a DC...."

I want to test it on my lab as well..
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22897514
This happens. I have never really had a trend or knowing exactly when it would happen. You can try to dcpromo with only itself as DNS because this had cause an issue with me.
0
 

Author Comment

by:wuitsung
ID: 22898161
you mean to make a new DC? and point itself as DNS? if so, this will fail at the beginning.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22898271
Sorry left a sentence out. Start the Dc promo process then remove the other DCs IP address. Then have it by itself.
0
 

Author Comment

by:wuitsung
ID: 22898339
just to confirm.. you mean I start a dcpromo dns:old dc
right after dcpromo success, I change its DNS to point to itself?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22898354
Correct. Try this out. I can't for sure tell you that it will fail with this error because this error doesn't seem to happen in the same Scenario everytime it happens.
0
 

Author Comment

by:wuitsung
ID: 22902189
unfortunately... it didn't work ... cannot produce the problem...
I read the article http://support.microsoft.com/kb/290762 

There are 3 bold title there: Nonauthoritative restore, Authoritative FRS restore and Global vs. replica set specific reinitialization.

Nonauthoritative restore and Authoritative FRS restore are simillar, either D2 or D4.

But what's the difference between above and Global vs. replica set specific reinitialization?

I read the article, but still don't understand well....
0
 

Author Comment

by:wuitsung
ID: 22902210
I guess the first one "Nonauthoritative restore and Authoritative FRS restore" is just to restore...

and the second one "Global vs. replica set specific reinitialization" is to rebuild?

So I think I should always try restore first, if that didn't work, I rebuild?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22904210
Try the Nonauthoritative restore first.
0
 

Author Comment

by:wuitsung
ID: 22906200
ok. I was trying to reproduce the problem. So I just deleted the sub folder under domain name in SYSVOL on first DC.

I tried to do this:
1)  Stop the FRS service on both DCs.
2)  On the primary DC (the one with the GOOD sysvol), open Regedit and find this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Cumulative Replica Sets\GUID\BurFlags
(where GUID is the domain GUID)
3)  Change the value of this entry to D4
4)  On the other server, open Regedit and go to the same key but set the value to D2.
5)  Start the FRS service on the server you made D4 *FIRST*
6)  Wait a few minutes.
7)  Start the FRS service on the server you made D2.

But it didn't fix the problem. I see 2 error message in event log. (in screenshot).
Netdiag /fix, everthing passed on both DCs.
Dcdiag /fix - one error:
Starting test: frsevent
   There are warning or error events within the last 24 hours after the
   SYSVOL has been shared.  Failing SYSVOL replication problems may cause
   Group Policy problems.

Do you think the way I run burflag not correct?

gp1.JPG
gp2.JPG
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22906919
Do you have the SYSVOL folder?
0
 

Author Comment

by:wuitsung
ID: 22907068
yes, I still have sysvol folder. I just deleted the sub folder under domain name folder in SYSVOL share.
0
 

Author Comment

by:wuitsung
ID: 22907106
I deleted those folder under domain name folder. But after I run burflag, it got the 2 folders back as shown here. So I really don't know why I am still have the error message since it's already replicated from other DC which has a good copy.
sysvol.JPG
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22907208
Have your restarted the DC yet?
0
 

Author Comment

by:wuitsung
ID: 22907224
i did on both
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 22965890
You can try copying the sysvol from the other working DC to see if that fixes the problem
0

Featured Post

[Webinar] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses

581 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question