Promote DC from secondary to primary problem

Hello All,

I have 2 DCs on my network, uis1win1 is primary and uis1asr5 is secondary. Recently I change the role between them, I promote uis1asr5 to primary and uis1win1 is now secondary. After I done that, I ran dcdiag /fix and see the following error:

Can you please advice me what and how to fix it?
+++++++++++++++++++++++++++++
Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Default-First-Site-Name\UIS1ASR5
      Starting test: Connectivity
         ......................... UIS1ASR5 passed test Connectivity

Doing primary tests
   
   Testing server: Default-First-Site-Name\UIS1ASR5
      Starting test: Replications
         [Replications Check,UIS1ASR5] A recent replication attempt failed:
            From UIS1WIN1 to UIS1ASR5
            Naming Context: DC=Uismag,DC=com
            The replication generated an error (8606):
            Insufficient attributes were given to create an object.  This object may not exist because it may have been deleted and already garbage collected.
            The failure occurred at 2010-03-29 10:57:23.
            The last success occurred at 2010-02-01 16:54:04.
            13088 failures have occurred since the last success.
         REPLICATION-RECEIVED LATENCY WARNING
         UIS1ASR5:  Current time is 2010-03-29 10:57:47.
            DC=Uismag,DC=com
               Last replication recieved from UIS1WIN1 at 2010-02-01 16:54:04.
         ......................... UIS1ASR5 passed test Replications
      Starting test: NCSecDesc
         ......................... UIS1ASR5 passed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\UIS1ASR5\netlogon)
         [UIS1ASR5] An net use or LsaPolicy operation failed with error 1203, No network provider accepted the given network path..
         ......................... UIS1ASR5 failed test NetLogons
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\uis1win1.Uismag.com, when we were trying to reach UIS1ASR5.
         Server is not responding or is not considered suitable.
         ......................... UIS1ASR5 failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... UIS1ASR5 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... UIS1ASR5 passed test RidManager
      Starting test: MachineAccount
         ......................... UIS1ASR5 passed test MachineAccount
      Starting test: Services
         ......................... UIS1ASR5 passed test Services
      Starting test: ObjectsReplicated
         ......................... UIS1ASR5 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... UIS1ASR5 passed test frssysvol
      Starting test: frsevent
         ......................... UIS1ASR5 passed test frsevent
      Starting test: kccevent
         An Error Event occured.  EventID: 0xC02507C4
            Time Generated: 03/29/2010   10:47:01
            (Event String could not be retrieved)
         ......................... UIS1ASR5 failed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 03/29/2010   10:50:26
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 03/29/2010   10:50:27
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 03/29/2010   10:50:27
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00000457
            Time Generated: 03/29/2010   10:50:27
            (Event String could not be retrieved)
         ......................... UIS1ASR5 failed test systemlog
      Starting test: VerifyReferences
         ......................... UIS1ASR5 passed test VerifyReferences
   
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   
   Running partition tests on : Uismag
      Starting test: CrossRefValidation
         ......................... Uismag passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Uismag passed test CheckSDRefDom
   
   Running enterprise tests on : Uismag.com
      Starting test: Intersite
         ......................... Uismag.com passed test Intersite
      Starting test: FsmoCheck
         ......................... Uismag.com passed test FsmoCheck
 
arron9112003Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

arron9112003Author Commented:

.........

    Computer Name: UIS1ASR5
    DNS Host Name: uis1asr5.Uismag.com
    System info : Microsoft Windows Server 2003 R2 (Build 3790)
    Processor : x86 Family 6 Model 23 Stepping 10, GenuineIntel
    List of installed hotfixes :
        KB923561
        KB924667-v2
        KB925398_WMP64
        KB925902-v2
        KB926122
        KB927891
        KB929123
        KB930178
        KB932168
        KB933729
        KB933854
        KB936357
        KB936782
        KB938127
        KB938127-IE7
        KB938464-v2
        KB941569
        KB942830
        KB942831
        KB943055
        KB943460
        KB943545
        KB944338-v2
        KB944653
        KB945553
        KB946026
        KB948496
        KB949014
        KB950760
        KB950762
        KB950974
        KB951066
        KB951748
        KB952004
        KB952069
        KB952954
        KB953298
        KB954155
        KB954600
        KB955069
        KB955759
        KB955839
        KB956572
        KB956802
        KB956803
        KB956844
        KB957097
        KB958469
        KB958644
        KB958687
        KB958690
        KB958869
        KB959426
        KB960225
        KB960715
        KB960803
        KB960859
        KB961063
        KB961371-v2
        KB961373
        KB961501
        KB963027
        KB963027-IE7
        KB967715
        KB967723
        KB968389
        KB968537
        KB968816
        KB969059
        KB969805
        KB969897-IE8
        KB969898
        KB969947
        KB970238
        KB970430
        KB970483
        KB971032
        KB971180-IE8
        KB971468
        KB971486
        KB971557
        KB971633
        KB971657
        KB971737
        KB971961-IE8
        KB972270
        KB973037
        KB973354
        KB973507
        KB973525
        KB973540
        KB973687
        KB973815
        KB973825
        KB973869
        KB973904
        KB973917-v2
        KB974112
        KB974318
        KB974392
        KB974571
        KB975025
        KB975254
        KB975467
        KB975560
        KB975713
        KB976098-v2
        KB976325-IE8
        KB976662-IE8
        KB977165
        KB977290
        KB977914
        KB978037
        KB978207-IE8
        KB978251
        KB978262
        KB978706
        KB979306
        Q147222


Netcard queries test . . . . . . . : Passed



Per interface results:

    Adapter : 10.10.10.69

        Netcard queries test . . . : Passed


Global results:


Domain membership test . . . . . . : Failed
    [WARNING] Ths system volume has not been completely replicated to the local machine. This machine is not working properly as a DC.


NetBT transports test. . . . . . . : Passed
    List of NetBt transports currently configured:
        NetBT_Tcpip_{C69E2CC6-BC8A-4B1C-8F77-3BCB29192081}
    1 NetBt transport currently configured.


DNS test . . . . . . . . . . . . . : Passed
    [WARNING] The DNS entries for this DC are not registered correctly on DNS server '10.10.10.4'. Please wait for 30 minutes for DNS server replication.
    PASS - All the DNS entries for DC are registered on DNS server '10.10.10.69' and other DCs also have some of the names registered.


The command completed successfully
0
msmamjiCommented:
By moving primary and secondary, I am assuming that you are taking about moving FSMO Roles.
It seems UIS1ASR5 is not replicating with UIS1WIN1, UIS1ASR5 senses lingering objects in UIS1WIN1 for your domain partition DC=Uismag,DC=com
It also seems that UIS1ASR5 is not advertizing its sysvol share, and therefore wouldn't be able to cater logon requests. One more issue that is evident from the logs is that SRV records for UIS1ASR5 are missing from 10.10.10.4 DNS server.
to which DC does the IP 10.10.10.4 IP belong to? and 10.10.10.69 belong to?  
Can you post the Dcdiag output from the other server UIS1WIN1 as well.

Regards,
Shahid
0
arron9112003Author Commented:
10.10.10.4 is belong to uis1win1
10.10.10.69 is belong to uis1asr5

I'm having problem running dcdiag on uis1win1 because it a 64bit machine and I can't find instalation media to install support tool for it. I will keep looking for it.

Thank you for responding.
0
Cloud Class® Course: Amazon Web Services - Basic

Are you thinking about creating an Amazon Web Services account for your business? Not sure where to start? In this course you’ll get an overview of the history of AWS and take a tour of their user interface.

arron9112003Author Commented:
So how do I transfer the sysvol from uis1win1 to uis1asr5? also the SRV record?
0
msmamjiCommented:
you can run dcdiag remotely using
dcdiag /s:uis1win1

dcdiag command reference
http://technet.microsoft.com/en-us/library/cc731968(WS.10).aspx

kindly get the dcdiag output for uis1win1.
Will followup in the morning with the way forward.

regards,
Shahid
0
arron9112003Author Commented:
Hello Shahid,

Thanks for your respond. Here is an out put of uis1win1


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Default-First-Site-Name\UIS1WIN1
      Starting test: Connectivity
         ......................... UIS1WIN1 passed test Connectivity

Doing primary tests
   
   Testing server: Default-First-Site-Name\UIS1WIN1
      Starting test: Replications
         [Replications Check,UIS1WIN1] A recent replication attempt failed:
            From UIS1ASR5 to UIS1WIN1
            Naming Context: DC=ForestDnsZones,DC=Uismag,DC=com
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2010-03-30 18:51:00.
            The last success occurred at 2010-03-30 12:59:55.
            1 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,UIS1WIN1] A recent replication attempt failed:
            From UIS1ASR5 to UIS1WIN1
            Naming Context: CN=Schema,CN=Configuration,DC=Uismag,DC=com
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2010-03-30 18:51:00.
            The last success occurred at 2010-03-30 12:59:55.
            1 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,UIS1WIN1] A recent replication attempt failed:
            From UIS1ASR5 to UIS1WIN1
            Naming Context: CN=Configuration,DC=Uismag,DC=com
            The replication generated an error (1908):
            Could not find the domain controller for this domain.
            The failure occurred at 2010-03-30 18:51:00.
            The last success occurred at 2010-01-19 18:42:37.
            3706 failures have occurred since the last success.
            Kerberos Error.
            A KDC was not found to authenticate the call.
            Check that sufficient domain controllers are available.
         [Replications Check,UIS1WIN1] A recent replication attempt failed:
            From UIS1ASR5 to UIS1WIN1
            Naming Context: DC=Uismag,DC=com
            The replication generated an error (8614):
            The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.
            The failure occurred at 2010-03-30 19:18:17.
            The last success occurred at 2010-01-19 18:45:07.
            3101 failures have occurred since the last success.
         REPLICATION-RECEIVED LATENCY WARNING
         UIS1WIN1:  Current time is 2010-03-30 19:30:59.
            CN=Configuration,DC=Uismag,DC=com
               Last replication recieved from UIS1ASR5 at 1982-07-16 18:52:01.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days!
            DC=Uismag,DC=com
               Last replication recieved from UIS1ASR5 at 1982-07-16 18:54:30.
               WARNING:  This latency is over the Tombstone Lifetime of 180 days!
         ......................... UIS1WIN1 passed test Replications
      Starting test: NCSecDesc
         ......................... UIS1WIN1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... UIS1WIN1 passed test NetLogons
      Starting test: Advertising
         ......................... UIS1WIN1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... UIS1WIN1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... UIS1WIN1 passed test RidManager
      Starting test: MachineAccount
         ......................... UIS1WIN1 passed test MachineAccount
      Starting test: Services
         ......................... UIS1WIN1 passed test Services
      Starting test: ObjectsReplicated
         ......................... UIS1WIN1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... UIS1WIN1 passed test frssysvol
      Starting test: frsevent
         There are warning or error events within the last 24 hours after the

         SYSVOL has been shared.  Failing SYSVOL replication problems may cause

         Group Policy problems.
         ......................... UIS1WIN1 failed test frsevent
      Starting test: kccevent
         An Error Event occured.  EventID: 0xC00007FA
            Time Generated: 03/30/2010   19:18:17
            (Event String could not be retrieved)
         ......................... UIS1WIN1 failed test kccevent
      Starting test: systemlog
         An Error Event occured.  EventID: 0x80001778
            Time Generated: 03/30/2010   18:49:01
            Event String: The previous system shutdown at 12:57:41 PM on

         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:49
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:49
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:49
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:49
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:50
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:51
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 03/30/2010   18:51:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC25A001D
            Time Generated: 03/30/2010   18:51:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x0000042D
            Time Generated: 03/30/2010   18:51:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0x00004E8A
            Time Generated: 03/30/2010   18:52:53
            (Event String could not be retrieved)
         ......................... UIS1WIN1 failed test systemlog
      Starting test: VerifyReferences
         ......................... UIS1WIN1 passed test VerifyReferences
   
   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
   
   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
   
   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
   
   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
   
   Running partition tests on : Uismag
      Starting test: CrossRefValidation
         ......................... Uismag passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Uismag passed test CheckSDRefDom
   
   Running enterprise tests on : Uismag.com
      Starting test: Intersite
         ......................... Uismag.com passed test Intersite
      Starting test: FsmoCheck
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         ......................... Uismag.com failed test FsmoCheck
0
msmamjiCommented:
My assesment
UIS1ASR5:
is not accepting replications with partner UIS1WIN1
doesnot have the Netlogon and Sysvol shares shared, therefore is not advertizing itself as a domain controller. (UIS1ASR5 is not servicing user request for logon authentication, you can confirm this by running "set l" on command line on any computer in the domain and check the result, it most probably will be saying logonserver: UIS1WIN1)
UIS1ASR5 SRV records are not properly advertized in UIS1WIN1 DNS or probably inaccessible by UIS1ASR5.

UIS1WIN1:
is complaining about not able to find the KDC. Make sure KDC service is started on the server.
It is not replicating with UIS1ASR5 and complaining about tombstone being crossed with replication.
For some reason, it is not able to find FSMO role holder information.

Its seems to me that you might have to demote and promote your UIS1ASR5 dc. Here the deal, it won't go down properly and you might have demote using DCPROMO /FORCEREMOVAL
and then do a metadata cleanup for UIS1ASR5.

However, the health of you UIS1WIN1 is also not perfect. It is unable to find a KDC and unable to determine FSMO roles holder. You need to make sure these problems are catered for before moving forward with demoting UIS1ASR5.

Make sure KDC service is running on UIS1WIN1 and move the FSMO roles back to UIS1WIN1.

Regards,
Shahid
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.