[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1064
  • Last Modified:

URGENT Active directory will not start on any domain controller

Hello all

I have a site I have inherited with two dc's. I wasnt aware that they have never had frs working on the second dc. The first dc rebooted unexpectedly and the frs starting logging journal wrap errors but has nothing to replcate with to fix itself. The data is still in the sysvol folder but has been renamed. I can recreate the policies if need be as there isnt that much there but cant get ad to start, any suggestions here would be great as I have no idea how to proceed. Is it possible to reset a domains policies back to defaults ? Has anyone ever done such a thing ? Any help is greatly appreciated
0
Jarrod
Asked:
Jarrod
  • 10
  • 3
  • 2
2 Solutions
 
JarrodAuthor Commented:
Just before anbody asks, I do have backups but the problem already existed when I made backups mandatory so any restore would have the same issue
0
 
balmasriCommented:
In order to re-fix the default domain GPO & Default Domain Controllers GPOs.
0
 
balmasriCommented:
If you mean reset the default domain policies
dcgpofix /target:Domain
dcgpofix /target:DC
dcgpofix /target:both
see the link:
http://www.windowsitpro.com/Article/ArticleID/41878/41878.html
   
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
snusgubbenCommented:
Since the FRS hasn't been working the last 60 days i assume and you don't have a good system state backup, I suggest you remove the "secondary" DC.

If it's been more then 60 days since they replicated they get tombstoned.

I suggest you keep the DC that holds the FSMO.

Start/Run -> netdom query FSMO

Since it's tombstoned you can't gracefully dcpromo the !sec.DC!. You need to do a "dcpromo /forceremoval" (on console to the DC you will remove), then do a metadata cleanup on the consol on the other DC to remove the "sec.DC" metadata from AD.

After this is done, re-initialize FRS replica set with the "burflag" method. (D2). When it's up and running, reinstall the "sec.DC" and promote it to an additional DC.

Just make sure you got (DHCP), DNS, (WINS) and Global Catalog on the remaining DC. (and offcourse the 5 FSMO roles).

Metadata cleanup: http://support.microsoft.com/default.aspx?scid=kb;EN-US;216498
Burflag: http://support.microsoft.com/kb/290762/en-us


SG


0
 
JarrodAuthor Commented:
Hi snusgubben

Thanks for the reply, unfortunately because frs wasnt starting on either of the two dc's it meant nothing active directory based was playing ball. So I couldnt even logon to a server as i was getting the message domain is unavailable. If i could logon I was actually planning to do that. I think I may have found a way to get AD going again though will post back shortly
0
 
JarrodAuthor Commented:
Hi Balmasri

Thats exactly what I was looking for, however my problem has changed slightly as AD isnt quite playing ball
0
 
JarrodAuthor Commented:
Ok I managed to get AD going again by delving deep into the registry and forcing the sysvolready key to be 1 on both servers, and manually creating my sysvol and netlogon shares. Now I at least have ad running and processing logons so users can get into the network. Both servers say that cant replicate for FRS with each other, but DS replication is running fine. Both event logs have the 13508 server1 cant replicate to server 2 and vice versa which is from my understanding back where I started. So I guess now I might have a read through the burflag link and see if it might allow to force the both server to play ball.

Failing that the reason I wanted to try resetting the GPO's to default was that i suspected it was some kind of strange permissions issue somewhere that I couldnt find. Thanks for all your help so far and the quick responses !
0
 
JarrodAuthor Commented:
Im thinking after reading through the burflags article that it may not be the one for me as technically frs hasnt replicated properly for at least 6 months. Going  back to when I first took this network over there was a single DC, I noticed that the single dc only ever logged an ntfrs is starting event but never a started event in the logs, event though the service did start. After bringing a second DC online it would never start frs properly giving the cant repliacte events and I was then told that my predecessor had the same issue because of some crash many moons ago. So now im wondering about resetting the gpo's to see if it solves my issue
0
 
snusgubbenCommented:
Your DCs hasn't replicated for six month and belive me; they will not start replicating again without a good backup or removing a DC out of the domain and fix the remaining.

How did you re-create the SYSVOL and NETLOGON?

If you made those share manually it's a bad idea. The DCs will never replicate SYSVOL because SYSVOL is infact a DFS share and should be created automatic by the DCs.


SG
0
 
JarrodAuthor Commented:
I agree that it was a bad idea, but it was either have no active directorhy and 100 users screaming at me, or recreate the shares manually and tweak the registry to get frs to at least start and active directory to run. The DC's replicate AD traffic fine just not FRS. As i said there is no backup with frs ever working as it was before I started. Removing the second dc is easy enough but I have done this before and frs still doesnt start correctly on the primary dc. It doesnt give any errors, but it also doesnt confirm frs starts ok, it just states that it is starting only. So im now grabbing some diagnostic tools from microsoft to see if it sheds and light on the problem
0
 
snusgubbenCommented:
Run: "dcdiag /v /e /c > dcdiag.txt & dcdiag.txt"

and you'll see your domain errors.


SG
0
 
JarrodAuthor Commented:
Ive run dcdiag and it passed all tests bar the frsevent one which I would have expected but it doesnt give me much to go on

 Starting test: frsevent
         * The File Replication Service Event log test
         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         An Warning Event occured.  EventID: 0x800034C4
            Time Generated: 02/22/2009   22:40:03
            (Event String could not be retrieved)
0
 
JarrodAuthor Commented:
I found an frsdiag tool from microsoft and it seems to be a lot more indepth for the frs problems. It passes all tests bar

Checking for suspicious file Backlog size...
      ERROR : File Backlog TO server "DOMAIN\MYSERVER" is : 413  :: Unless this is due to your schedule, this is a problem

Which im guessing just means it hasnt replicated yet. More interesting in the logs that the tool produces i found these lines

\\MYSERVER\C$\WINDOWS\debug\NtFrs_0001.log:<FrsIssueJournalAsyncRead:      3612:  9335: S4: 06:01:39> ReadUsnJournalData  - NTStatus 00000103, USN = 00000001 0236bb60  WStatus: ERROR_IO_PENDING
\\MYSERVER\C$\WINDOWS\debug\NtFrs_0001.log:<CfgRegReadDWord:               2908:  2571: S5: 06:05:25> ERROR - RegQueryValueEx Failed.  WStatus: ERROR_FILE_NOT_FOUND

So im guessing im missing a registry key or the security on that key is wrong ?
0
 
JarrodAuthor Commented:
Ive now done some more searching and found that my staging folder on the primary server has a lot of files in it, presumably the ones its waiting to replicate that are stuck. I recently compared the folder security in the sysvol share with another server and adjusted the acl's to match as some of them were not correct but am not sure where to head from here. I was hoping that might have got things working
0
 
JarrodAuthor Commented:
Hi Guys

My problem is solved. Many thanks to both of you, the final solution was to use the burflags in the registry as per the ms article. The reason for the point split was because my original question was answered by balmasri before I found AD wasnt starting at all, but I wouldnt have solved it without the link to the article provided by snusgubben. Once again many thanks
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 10
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now