Problem with active directory every morning at 6:00am on Windows server 2003 PDC.
Posted on 2009-05-01
For a few weeks now, our role holding domain controller has had issues with the directory service. There are countless different issues, but they are resolved by a reboot.
The following day, however, the problem comes back at exactly 6:00am. I can't seem to find anything that occurs at that point, as all the backups take place 12 hours earlier. Replication is at standard time intervals and nothing I can is obviously wrong. Here is one of the event log messages at the very beginning of the issue at 6:00am:
The description for Event ID ( 1 ) in Source ( LGTO_Sync ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: , Flush Completed.
This is of course not very helpful, but is the first indication of an issue in the system log. Then I get the following:
NTDS (412) NTDSA: An attempt to write to the file "C:\WINDOWS\NTDS\edb.log" at offset 3468288 (0x000000000034ec00) for 512 (0x00000200) bytes failed after 5 seconds with system error 1784 (0x000006f8): "The supplied user buffer is not valid for the requested operation. ". The write operation will fail with error -1011 (0xfffffc0d). If this error persists then the file may be damaged and may need to be restored from a previous backup.
This would appear to be a storage issue, but the server is a virtual one sitting on a SAN (ESX server 3.5). I have moved the entire virtual machine storage to another volume and this has not helped. I have ran Windows disk checks and they have come up fine. I have searched on the 10-15 different event log messages and they all seem to be generic resultant messages of the directory service being down, and nothing to with specific causes. I have various KDC messages about the security account manager, but again this is no doubt due to AD being down.
Any help would be gladly appreciated as to what could be scheduled at 6 every day and could cause this DS error. It is way beyond my knowledge.