[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 205
  • Last Modified:

When adding a user to a security group it takes up to 12 hours to replicate in citrix with powerfuse

When i add a user to a security group for an application, it takes up to 12 hours to replicate before the user gets it in citrix with powerfuse. When adding the user to a security group on a folder it will work directly. We are running Citrix 4.5 and Powerfuse 8 SR7 on 4 W2k3 64 bit machines
Does somebody know what to do, to reduce the replication time?
0
PonLogistiek
Asked:
PonLogistiek
  • 9
  • 8
1 Solution
 
Darius GhassemCommented:
Please read over this link. One of the fixes is below.

Enumerating Active Directory users could take a long time which should be fixed in your verison. Are you fully updated?

http://www.resug.com/res-powerfuse-2008-sr7-is-out
0
 
PonLogistiekAuthor Commented:
Tnx dariusg,
I am gonna ckeck this out! But we also found out that there are sync problems between our domain cont. and the 3 sub domain controllers ... But i will place that as a new question.
0
 
PonLogistiekAuthor Commented:
@darius,

Yes we are fully updated to version 2008R7. Still seems to have the problems. Any more ideas?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Darius GhassemCommented:
If you are having issues with your domain then this problem is most likley related.
0
 
PonLogistiekAuthor Commented:
Do you have any option we could check for fixing this issue?

Only thing me try what doesnt always work in this matter, is a GPUPDATE /FORCE. That command only seems to be for updating your changed policies.
0
 
Darius GhassemCommented:
What problems are you seeing on your domain? Run dcdiag the post results for a DC>
0
 
PonLogistiekAuthor Commented:
Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: DC\Server
      Starting test: Connectivity
         ......................... Server passed test Connectivity

Doing primary tests

   Testing server: DC\Server
      Starting test: Replications
         ......................... **INFRASERVER** passed test Replications
      Starting test: NCSecDesc
         ......................... **INFRASERVER** passed test NCSecDesc
      Starting test: NetLogons
         ......................... **INFRASERVER** passed test NetLogons
      Starting test: Advertising
         ......................... **INFRASERVER** passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... **INFRASERVER** passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... **INFRASERVER** passed test RidManager
      Starting test: MachineAccount
         ......................... **INFRASERVER** passed test MachineAccount
      Starting test: Services
         ......................... **INFRASERVER** passed test Services
      Starting test: ObjectsReplicated
         ......................... **INFRASERVER** passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... **INFRASERVER** passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... **INFRASERVER** failed test frsevent
      Starting test: kccevent
         ......................... **INFRASERVER** passed test kccevent
      Starting test: systemlog
         ......................... **INFRASERVER** passed test systemlog
      Starting test: VerifyReferences
         ......................... **INFRASERVER** passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : DOMAIN
      Starting test: CrossRefValidation
         ......................... DOMAIN passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DOMAIN passed test CheckSDRefDom

   Running enterprise tests on : DOMAIN.NL
      Starting test: Intersite
         ......................... DOMAIN.NL passed test Intersite
      Starting test: FsmoCheck
         ......................... DOMAIN.NL passed test FsmoCheck
0
 
Darius GhassemCommented:
So, you are failing SYSVOL replication. Please post ipconfig /all.
0
 
PonLogistiekAuthor Commented:
Windows IP Configuration

   Host Name . . . . . . . . . . . . : Server
   Primary Dns Suffix  . . . . . . . : DOMAIN.NL
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : DOMAIN.NL

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
   Physical Address. . . . . . . . . : 00-50-56-86-2B-D8
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 10.32.17.162
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 10.32.17.1
   DNS Servers . . . . . . . . . . . : 10.32.17.162
                                       10.32.17.163
                                       10.32.17.161
   Primary WINS Server . . . . . . . : 10.32.17.163
   Secondary WINS Server . . . . . . : 10.32.17.162
                                       10.32.17.161
0
 
Darius GhassemCommented:
What Events do you have under FRS in the Event Viewer?
0
 
PonLogistiekAuthor Commented:
#1:

DNS name server03.DOMAIN.NL. FRS will keep retrying.
 Following are some of the reasons you would see this warning.
 
 [1] FRS can not correctly resolve the DNS name server03.DOMAIN.NL from this computer.
 [2] FRS is not running on server03.DOMAIN.NL.
 [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.
 
 This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


#2

The File Replication Service has enabled replication from SERVER03 to SERVER02 for c:\windows\sysvol\domain after repeated retries.
0
 
PonLogistiekAuthor Commented:
I also saw something strange at our Directory Service Event Viewer:

The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
 
Directory partition:
CN=Configuration,DC=DOMAIN,DC=NL
 
There is insufficient site connectivity information in Active Directory Sites and Services for the KCC to create a spanning tree replication topology. Or, one or more domain controllers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible domain controllers.
 
User Action
Use Active Directory Sites and Services to perform one of the following actions:
- Publish sufficient site connectivity information so that the KCC can determine a route by which this directory partition can reach this site. This is the preferred option.
- Add a Connection object to a domain controller that contains the directory partition in this site from a domain controller that contains the same directory partition in another site.
 
If neither of the Active Directory Sites and Services tasks correct this condition, see previous events logged by the KCC that identify the inaccessible domain controllers.

0
 
Darius GhassemCommented:
Can you ping server03? Do you have the msdcs folder delegated? If it is you will see the folder grayed out under the domain.com zone and you will have a msdcs.domain.com zone.
0
 
PonLogistiekAuthor Commented:
Yep i can ping our server03. And our _msdcs zone is not delegated. Should this be delegated?
0
 
Darius GhassemCommented:
No, if you have all your DNS servers with the msdcs folder listed under domain.com and it is not grayed out then you are good but make sure you have records listed.
0
 
PonLogistiekAuthor Commented:
Anything else we could check since you said we are ok?

The problem is also ittermittent, its not here all the time. We have "good days" & "bad days". Where we have more bad then good.
0
 
Darius GhassemCommented:
Usuaully when it is intermittent means network or DNS issues.

So, you are sure that all DNS servers have the msdcs folder listed as a folder under the domain.com zone with data within it?
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

  • 9
  • 8
Tackle projects and never again get stuck behind a technical roadblock.
Join Now