How to change an incorrect dsa_Guid on a replication DC
I recently replaced the PDC in a 2 server network. I did this by replicating the AD from the old server to a temporary server and then in turn replicating this to the new server. Once I put the new server in place the 2nd server in the group (Engineerserv) lost the ability to replicate AD from it (the new server). I have narrowed the problem down to DNS. When I open the NTDS Settings properties under AD Sites and Services on the Engineerserv the DNS Alias is showing the wrong GUID. How can I change or replace this incorrect information?
1)Delete the DC GUID from DNS
2)Make sure that the Dc point to the correct DNS
3)Restart Netlogon
When you restart Netlogon,it will register all SRV records and GUID
2)Make sure that the Dc point to the correct DNS
3)Restart Netlogon
When you restart Netlogon,it will register all SRV records and GUID
small correcton...all missing SRV records and GUID :)
ASKER
Chris-Dent -
On the PDC emulator that holds all of the roles, I checked the GUID ID there and it is 0ff8a6aa-633a-4f3f-a62c-80
Now, could the b720044f-abc6-4355-8499-f8
On the PDC emulator that holds all of the roles, I checked the GUID ID there and it is 0ff8a6aa-633a-4f3f-a62c-80
Now, could the b720044f-abc6-4355-8499-f8
ASKER
chrishudson123 -
Do you mean I change the GUID from the PDC or from the Engineerserv?
Do you mean I change the GUID from the PDC or from the Engineerserv?
don't change anything now.The DC GUID is mainly used for replication.check whether the repliaction is fine or not.If the replication is working fine,Ur GUID issue is fixed
Now about 1030 and 1058 events,these are userenv errors,there is no relation with DC GUID.
refer http://support.microsoft.com/kb/834649 for 1030 and 1058 errors
Let me know the status ASAP...I can give you further troubleshooting tips based on Ur env
Now about 1030 and 1058 events,these are userenv errors,there is no relation with DC GUID.
refer http://support.microsoft.com/kb/834649 for 1030 and 1058 errors
Let me know the status ASAP...I can give you further troubleshooting tips based on Ur env
The GUID value is set based on the GUID of the NTDS Settings folder you see in AD Sites and Services. It gets populated from %SystemRoot%\System32\Conf
The output from DCDiag and NetDiag would be useful to further isolate the cause of your troubles.
Chris
ASKER
Chris and Chris,
Thanks for the help so far guys...I really appreciate it.
Info from the Eventvwr:
------->> Under the File Replication Service I am getting one of these every day:
Event ID 13508
The File Replication Service is having trouble enabling replication from NEWSERV to ENGINEERSERV for c:\windows\sysvol\domain using the DNS name newserv.NEWWAY.local. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name newserv.NEWWAY.local from this computer.
[2] FRS is not running on newserv.NEWWAY.local.
[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
For more information, see Help and Support Center at
**************************
-------->> Also getting Directory Service Event ID 1864:
This is the replication status for the following directory partition on the local domain controller.
Directory partition:
DC=ForestDnsZones,DC=NEWWA
The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals.
More than 24 hours:
1
More than a week:
1
More than one month:
0
More than two months:
0
More than a tombstone lifetime:
0
Tombstone lifetime (days):
180
Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.
To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency <partition-dn>".
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
-------->> Also getting Event ID 2093
The remote server which is the owner of a FSMO role is not responding. This server has not replicated with the FSMO role owner recently.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: CN=Schema,CN=Configuration
FSMO Server DN: CN=NTDS Settings,CN=NEWSERV,CN=Ser
Latency threshold (hours): 24
Elapsed time since last successful replication (hours): 252
User Action:
This server has not replicated successfully with the FSMO role holder server.
1. The FSMO role holder server may be down or not responding. Please address the problem with this server.
2. Determine whether the role is set properly on the FSMO role holder server. If the role needs to be adjusted, utilize NTDSUTIL.EXE to transfer or seize the role. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
3. If the FSMO role holder server used to be a domain controller, but was not demoted successfully, then the objects representing that server are still in the forest. This can occur if a domain controller has its operating system reinstalled or if a forced removal is performed. These lingering state objects should be removed using the NTDSUTIL.EXE metadata cleanup function.
4. The FSMO role holder may not be a direct replication partner. If it is an indirect or transitive partner, then there are one or more intermediate replication partners through which replication data must flow. The total end to end replication latency should be smaller than the replication latency threshold, or else this warning may be reported prematurely.
5. Replication is blocked somewhere along the path of servers between the FSMO role holder server and this server. Consult your forest topology plan to determine the likely route for replication between these servers. Check the status of replication using repadmin /showrepl at each of these servers.
The following operations may be impacted:
Schema: You will no longer be able to modify the schema for this forest.
Domain Naming: You will no longer be able to add or remove domains from this forest.
PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory accounts.
RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
--------->> From System Eventvwr i am getting Event ID 4:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/newserv.newway.local.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
------->> This is what I WAS getting from the Directory Service Eventvwr log when I originally posted this question: EVENT ID 1645:
Active Directory did not perform an authenticated remote procedure call (RPC) to another domain controller because the desired service principal name (SPN) for the destination domain controller is not registered on the Key Distribution Center (KDC) domain controller that resolves the SPN.
Destination domain controller:
b720044f-abc6-4355-8499-f8
SPN:
E3514235-4B06-11D1-AB04-00
User Action
Verify that the names of the destination domain controller and domain are correct. Also, verify that the SPN is registered on the KDC domain controller. If the destination domain controller has been recently promoted, it will be necessary for the local domain controllers computer account data to replicate to the KDC before this computer can be authenticated.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I will post the dcdiag and netdiag logs here in just a bit.
Thanks for the help so far guys...I really appreciate it.
Info from the Eventvwr:
------->> Under the File Replication Service I am getting one of these every day:
Event ID 13508
The File Replication Service is having trouble enabling replication from NEWSERV to ENGINEERSERV for c:\windows\sysvol\domain using the DNS name newserv.NEWWAY.local. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name newserv.NEWWAY.local from this computer.
[2] FRS is not running on newserv.NEWWAY.local.
[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
For more information, see Help and Support Center at
**************************
-------->> Also getting Directory Service Event ID 1864:
This is the replication status for the following directory partition on the local domain controller.
Directory partition:
DC=ForestDnsZones,DC=NEWWA
The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals.
More than 24 hours:
1
More than a week:
1
More than one month:
0
More than two months:
0
More than a tombstone lifetime:
0
Tombstone lifetime (days):
180
Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.
To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency <partition-dn>".
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
-------->> Also getting Event ID 2093
The remote server which is the owner of a FSMO role is not responding. This server has not replicated with the FSMO role owner recently.
Operations which require contacting a FSMO operation master will fail until this condition is corrected.
FSMO Role: CN=Schema,CN=Configuration
FSMO Server DN: CN=NTDS Settings,CN=NEWSERV,CN=Ser
Latency threshold (hours): 24
Elapsed time since last successful replication (hours): 252
User Action:
This server has not replicated successfully with the FSMO role holder server.
1. The FSMO role holder server may be down or not responding. Please address the problem with this server.
2. Determine whether the role is set properly on the FSMO role holder server. If the role needs to be adjusted, utilize NTDSUTIL.EXE to transfer or seize the role. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
3. If the FSMO role holder server used to be a domain controller, but was not demoted successfully, then the objects representing that server are still in the forest. This can occur if a domain controller has its operating system reinstalled or if a forced removal is performed. These lingering state objects should be removed using the NTDSUTIL.EXE metadata cleanup function.
4. The FSMO role holder may not be a direct replication partner. If it is an indirect or transitive partner, then there are one or more intermediate replication partners through which replication data must flow. The total end to end replication latency should be smaller than the replication latency threshold, or else this warning may be reported prematurely.
5. Replication is blocked somewhere along the path of servers between the FSMO role holder server and this server. Consult your forest topology plan to determine the likely route for replication between these servers. Check the status of replication using repadmin /showrepl at each of these servers.
The following operations may be impacted:
Schema: You will no longer be able to modify the schema for this forest.
Domain Naming: You will no longer be able to add or remove domains from this forest.
PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory accounts.
RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
--------->> From System Eventvwr i am getting Event ID 4:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/newserv.newway.local.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
**************************
------->> This is what I WAS getting from the Directory Service Eventvwr log when I originally posted this question: EVENT ID 1645:
Active Directory did not perform an authenticated remote procedure call (RPC) to another domain controller because the desired service principal name (SPN) for the destination domain controller is not registered on the Key Distribution Center (KDC) domain controller that resolves the SPN.
Destination domain controller:
b720044f-abc6-4355-8499-f8
SPN:
E3514235-4B06-11D1-AB04-00
User Action
Verify that the names of the destination domain controller and domain are correct. Also, verify that the SPN is registered on the KDC domain controller. If the destination domain controller has been recently promoted, it will be necessary for the local domain controllers computer account data to replicate to the KDC before this computer can be authenticated.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I will post the dcdiag and netdiag logs here in just a bit.
ASKER
I am going to attach the dcdiag and netdiag files to this message so the thread does'nt get rediculously long.
1st one is from the PDC
2nd one is from the DC
DCDIAG-and-NETDIAG-from-PDC.txt
DCDIAG-and-NETDIAG-from-DC.txt
1st one is from the PDC
2nd one is from the DC
DCDIAG-and-NETDIAG-from-PDC.txt
DCDIAG-and-NETDIAG-from-DC.txt
Checked the DCdiag
NEWSERV works fine ,I hope the syvol is hsared in this server
ENGINEERSERV shows AD replication failure with error " The RPC server is unavailable"
It looks like DNS issue (if DNS is rt we have to check RPC traffic)
Follow the given steps
1)Point both ENGINEERSERV and NEWSERV to NEWSERV as DNS server (No changes needed since they are pointing to NEWSERV now)
2)delete both of the GUIDs from DNS console(Under _msdcs.<domainName>
3)Restart NEtlogon service from both the DCs
4)Open Ad sites and services and delete connection objects Under Sites>Default-First-Site-N
5)Wait till it recreate the new connection objects,if it didn't create "right click NTDS Settings>All Tasks>Check replication Topology"
6) give 5-10 minutes and check replication
let me know the repadmin /showreps output after following all these steps
Your AD replication is broken.Let's fix AD repliaction first
NEWSERV works fine ,I hope the syvol is hsared in this server
ENGINEERSERV shows AD replication failure with error " The RPC server is unavailable"
It looks like DNS issue (if DNS is rt we have to check RPC traffic)
Follow the given steps
1)Point both ENGINEERSERV and NEWSERV to NEWSERV as DNS server (No changes needed since they are pointing to NEWSERV now)
2)delete both of the GUIDs from DNS console(Under _msdcs.<domainName>
3)Restart NEtlogon service from both the DCs
4)Open Ad sites and services and delete connection objects Under Sites>Default-First-Site-N
5)Wait till it recreate the new connection objects,if it didn't create "right click NTDS Settings>All Tasks>Check replication Topology"
6) give 5-10 minutes and check replication
let me know the repadmin /showreps output after following all these steps
Your AD replication is broken.Let's fix AD repliaction first
ASKER
You want I should delete the GUIDs from the DNS console on the Engineerserv? or the Newserv? and by both GUIDs you mean the GUID for both the Engineerserv and Newserv? Do I leave the NS records?
Step 4 - Is that on the Engineerserv or Newserv?
Step 4 - Is that on the Engineerserv or Newserv?
no need to touch Engineerserv as the DCs are pointing to Newserv as DNS.
delete both the GUIDs from Newserv DNS Mgmt console
After step 3 check replication is fine or not.
If the replication still failing,then folow step 4 on EngineerSrv
delete both the GUIDs from Newserv DNS Mgmt console
After step 3 check replication is fine or not.
If the replication still failing,then folow step 4 on EngineerSrv
ASKER
Didn't work. I have some of th same eventlog errors. Here is the results from the /repadmin command
Default-First-Site-Name\EN
DC Options: (none)
Site Options: (none)
DC object GUID: f916f0ee-0d67-4dba-8ddf-34
DC invocationID: a734b6dd-61f1-41ca-8daf-de
Source: Default-First-Site-Name\ne
******* 1 CONSECUTIVE FAILURES since 2009-02-23 11:08:52
Last error: -2146893022 (0x80090322):
The target principal name is incorrect.
Naming Context: DC=ForestDnsZones,DC=NEWWA
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: DC=NEWWAY,DC=local
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: DC=DomainDnsZones,DC=NEWWA
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: CN=Configuration,DC=NEWWAY
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: CN=Schema,CN=Configuration
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Default-First-Site-Name\EN
DC Options: (none)
Site Options: (none)
DC object GUID: f916f0ee-0d67-4dba-8ddf-34
DC invocationID: a734b6dd-61f1-41ca-8daf-de
Source: Default-First-Site-Name\ne
******* 1 CONSECUTIVE FAILURES since 2009-02-23 11:08:52
Last error: -2146893022 (0x80090322):
The target principal name is incorrect.
Naming Context: DC=ForestDnsZones,DC=NEWWA
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: DC=NEWWAY,DC=local
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: DC=DomainDnsZones,DC=NEWWA
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: CN=Configuration,DC=NEWWAY
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
Naming Context: CN=Schema,CN=Configuration
Source: Default-First-Site-Name\ne
******* WARNING: KCC could not add this REPLICA LINK due to error.
"Target Principal Name is incorrect is due to broken secure channel"
Go ahead and reset secure channel from "ENGINEERSERV" by executing following command
netdom resetpwd /server:<Name of PDC> /userd:domain_name\adminis
Go ahead and reset secure channel from "ENGINEERSERV" by executing following command
netdom resetpwd /server:<Name of PDC> /userd:domain_name\adminis
ASKER
I tried this and still no joy. I am thinking it is a deeper issue with DNS. I have users reporting log in issues and trouble conecting to mapped drives using the servername but if i switch the mapped drives to IP address of the server then it works. I am losing patience with this server. I am starting to think DNS was messed up during the transfer somehow. Reloading is not an option so I am going to have to troubleshoot DNS til I can find the answer. If you are interested in helping me troubleshoot DNS I would appreciate it...if not, I understand :)
Thanks for you help thus far.
Thanks for you help thus far.
DNS troubleshooting
1)Test whether Ur client/DC can resolve SRV records properly
==========================
go to the command prompt of Ur client or problem DC and type the following command
nslookup
>set q=srv
>_ldap._tcp.Newway.local
>_kerberos._tcp.Newway.loc
>_gc._tcp.Newway.local
If the above commads are showing all Ur DC's IP and name properly..then DNS is fine
for replication purpose get GUID from DNS console and try to ping with GUID._msdcs.Newway.local
Let me know the results
1)Test whether Ur client/DC can resolve SRV records properly
==========================
go to the command prompt of Ur client or problem DC and type the following command
nslookup
>set q=srv
>_ldap._tcp.Newway.local
>_kerberos._tcp.Newway.loc
>_gc._tcp.Newway.local
If the above commads are showing all Ur DC's IP and name properly..then DNS is fine
for replication purpose get GUID from DNS console and try to ping with GUID._msdcs.Newway.local
Let me know the results
ASKER
Will do..give me a bit, have a busy morning.
ASKER
Here is something strange: Now all of a sudden I have 2 entries for the CNAME in DNS on the PDC:
off8a...._msdcs.newway.loc
and
681acf.._msdcs.newway.loca
This is also on the Engineerserv.
I don't know which one is correct...
off8a...._msdcs.newway.loc
and
681acf.._msdcs.newway.loca
This is also on the Engineerserv.
I don't know which one is correct...
could you ping with the cname and check replication also.To check which one is correct,Open Active directory sites and services,Under Sites>Default-First-Site-N
ASKER
I can ping 681acfc0-8017-4a14-894f-c3
I'm a bit confused...under Sites>Default-First-Site-N
So if I go to the Sites>Default-First-Site-N
I'm a bit confused...under Sites>Default-First-Site-N
So if I go to the Sites>Default-First-Site-N
ASKER
Where is this 0ff8a stuff coming from? Why do i have this in my DNS as a CNAME for my NEWSERV?
ASKER
UGH...I can ping 0ff8a6aa-633a-4f3f-a62c-80
You will be able to ping to that ID since it is CNAME,pointing ti NEWServ host address....Could I get the GUIDs of NEwSrv and EngineerSRV from NTDS Settings properties.Just I wanna make sure that these 2 GUIDS are registered under DNS.
ASKER
From under Engineerserv NTDS properties: 681acfc0-8017-4a14-894f-c3
From under NewServ NTDS properties: 39eacdd2-d7c6-424e-9fcb-76
Sorry havnt gotten back to you. Been a heckofa couple weeks.
From under NewServ NTDS properties: 39eacdd2-d7c6-424e-9fcb-76
Sorry havnt gotten back to you. Been a heckofa couple weeks.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
If the Update is from NewSrv,rename c:\windows\System32\config
ASKER
Finally am getting back to this problem. I had a question for you before i setup Wireshark. The primary server NewServ has 2 GUID entries for itself in DNS. Will the above method help me figure out which of the 2 is the correct one or is there an easier way?
copying Ur prev post
From under Engineerserv NTDS properties: 681acfc0-8017-4a14-894f-c3
From under NewServ NTDS properties: 39eacdd2-d7c6-424e-9fcb-76
39eacdd2-d7c6-424e-9fcb-76
From under Engineerserv NTDS properties: 681acfc0-8017-4a14-894f-c3
From under NewServ NTDS properties: 39eacdd2-d7c6-424e-9fcb-76
39eacdd2-d7c6-424e-9fcb-76
you can send netmon trace and c:\windows\System32\config
ASKER
Chris,
I'm having problems getting the trace run. Prob cuz I don't know enough about how to do it. :(
I will keep working on it since i am running out of time on the tombstone date! :)
I'm having problems getting the trace run. Prob cuz I don't know enough about how to do it. :(
I will keep working on it since i am running out of time on the tombstone date! :)
ASKER
Chris,
I no longer get the rogue GUID in DNS but I still can not replicate. The Directory Service Event Log event ID 1925 tells me: (notice the incorrect source domain controller address)
The attempt to establish a replication link for the following writable directory partition failed.
Directory partition:
DC=NEWWAY,DC=local
Source domain controller:
CN=NTDS Settings,CN=NEWSERV,CN=Ser
Source domain controller address:
b720044f-abc6-4355-8499-f8
Intersite transport (if any):
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.
User Action
Verify if the source domain controller is accessible or network connectivity is available.
Additional Data
Error value:
2148074274 The target principal name is incorrect.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------> I have tried to remove the spn value with no luck. How do I find where that value keeps coming from?
I no longer get the rogue GUID in DNS but I still can not replicate. The Directory Service Event Log event ID 1925 tells me: (notice the incorrect source domain controller address)
The attempt to establish a replication link for the following writable directory partition failed.
Directory partition:
DC=NEWWAY,DC=local
Source domain controller:
CN=NTDS Settings,CN=NEWSERV,CN=Ser
Source domain controller address:
b720044f-abc6-4355-8499-f8
Intersite transport (if any):
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.
User Action
Verify if the source domain controller is accessible or network connectivity is available.
Additional Data
Error value:
2148074274 The target principal name is incorrect.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-----------> I have tried to remove the spn value with no luck. How do I find where that value keeps coming from?
ASKER
Thanks for the help! It was greatly appreciated. I have corrected this problem but I have found another. I will enter another question in the spirit of fairplay. Thanks again!
How do you know it's the wrong GUID? Kind of need to know how you arrived at that conclusion to be able to help.
Chris