We help IT Professionals succeed at work.

Replication issue on Secondary Domain Controller

Hi

I have added a secondary domain controller at our branch office and created a site and replication setting for it, however the vpn connectivity between the two branches is intermittent, ie. we lose connectivity at least 4 to 5 times a day.

There is only one domain that is being used.

The problem I am having is when there is no vpn site connectivity, the users at our branch office are not able to access resources from the secondary domain controller, like the print server and file server (therefore they are unable to print or access any shared files) because the Secondary DC tries to authenticate the users by contacting the Primary DC. The Secondary DC is also a Global Catalog Server.

Is there a solution to this problem?

Is it possible for the Secondary DC to authenticate users without contacting the Primary DC?

Comment
Watch Question

Distinguished Expert 2018

Commented:
First, to clarify, the concept of "primary" domain controllers went away with Windows 2000. That is an NT era terminiology that refuses to die. AD, for most purposes, is a multi-master topology. It has a "PDC Emulator" role for backwards compatibility, but that only comes into play if you still have NT4 servers on your network. If these are both 2003 machines, you can stop thinking of one as primary and the other as secondary.

So, with that in mind, two things decide if a domain controller can service requests.

1) Is it a global catalog server. It sounds like you've got this one covered, but still...double check.
2) Is it healthy. A DC will only perform DC tasks if it has decided it is in a healthy state.

The IT Health Scanner (a download from MS) can help spot problems, as can the command "dcdiag" on the domain controller that isn't working.  Run these tools and resolve their errors. Post back here if you get stuck on an error or need to know the best way to resolve it.
my first guess is that the secondary dc is not a global catalog.

Author

Commented:
This is the first DC Server.

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Durban\DC1
      Starting test: Connectivity
         ......................... DC1 passed test Connectivity

Doing primary tests

   Testing server: Durban\DC1
      Starting test: Replications
         ......................... DC1 passed test Replications
      Starting test: NCSecDesc
         ......................... DC1 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC1 passed test NetLogons
      Starting test: Advertising
         ......................... DC1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... DC1 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... DC1 passed test RidManager
      Starting test: MachineAccount
         ......................... DC1 passed test MachineAccount
      Starting test: Services
            NtFrs Service is stopped on [DC1]
         ......................... DC1 failed test Services
      Starting test: ObjectsReplicated
         ......................... DC1 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... DC1 passed test frssysvol
      Starting test: frsevent
         ......................... DC1 passed test frsevent
      Starting test: kccevent
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:51
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:51
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:51
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:35:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:52
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:40:54
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:53
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:54
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:54
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:54
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:54
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:55
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:45:55
            (Event String could not be retrieved)
         ......................... DC1 failed test kccevent
      Starting test: systemlog
         ......................... DC1 passed test systemlog
      Starting test: VerifyReferences
         ......................... DC1 passed test VerifyReferences

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : domain
      Starting test: CrossRefValidation
         ......................... domain passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... domain passed test CheckSDRefDom

   Running enterprise tests on : domain.local
      Starting test: Intersite
         ......................... domain.local passed test Intersite
      Starting test: FsmoCheck
         ......................... domain.local passed test FsmoCheck


This is the second server that I have created


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Johannesburg\DC2
      Starting test: Connectivity
         ......................... DC2 passed test Connectivity

Doing primary tests

   Testing server: Vereeniging\DC2
      Starting test: Replications
         ......................... DC2 passed test Replications
      Starting test: NCSecDesc
         ......................... DC2 passed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\DC2\netlogon)
         [DC2] An net use or LsaPolicy operation failed with error 1203, No n
etwork provider accepted the given network path..
         ......................... DC2 failed test NetLogons
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\DC1.domain.local
, when we were trying to reach DC2.
         Server is not responding or is not considered suitable.
         ......................... DC2 failed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... DC2 passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... DC2 passed test RidManager
      Starting test: MachineAccount
         ......................... DC2 passed test MachineAccount
      Starting test: Services
         ......................... DC2 passed test Services
      Starting test: ObjectsReplicated
         ......................... DC2 passed test ObjectsReplicated
      Starting test: frssysvol
         ......................... DC2 passed test frssysvol
      Starting test: frsevent
         ......................... DC2 passed test frsevent
      Starting test: kccevent
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:58
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:58
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:46:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:47:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:51:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:51:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:51:59
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:52:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:52:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:52:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:52:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:00
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:01
            (Event String could not be retrieved)
         An Error Event occured.  EventID: 0xC0000470
            Time Generated: 06/13/2010   09:57:02
            (Event String could not be retrieved)
         ......................... DC2 failed test kccevent
      Starting test: systemlog
         ......................... DC2 passed test systemlog
      Starting test: VerifyReferences
         ......................... DC2 passed test VerifyReferences

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : domain
      Starting test: CrossRefValidation
         ......................... domain passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... domain passed test CheckSDRefDom

   Running enterprise tests on : domain.local
      Starting test: Intersite
         ......................... domain.local passed test Intersite
      Starting test: FsmoCheck
         ......................... domain.local passed test FsmoCheck
Distinguished Expert 2018

Commented:
There ya go, you have a very important failed test on your remote DC:

Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\DC2\netlogon)
         [DC2] An net use or LsaPolicy operation failed with error 1203, No n
etwork provider accepted the given network path..
         ......................... DC2 failed test NetLogons

You also have this:

 Starting test: Advertising
         Warning: DsGetDcName returned information for \\DC1.domain.local
, when we were trying to reach DC2.


If it is contacting DC2 and getting a response from DC1, that is a sign of a DNS issue.  Start there, check your DNS servers (locally and remotely) and make sure a record wasn't put in place as a "workaround" and then never removed.

And to reiterate, the IT Health Scanner can help as well. Sometimes its output is easier to read than dcdiag.


Author

Commented:
Thanks, however I do not have a DNS Server on DC2, only on DC1, DC2's DNS Address is DC1.

Do I have to create a second DNS Server on DC2?
Distinguished Expert 2018

Commented:
You don't have to, but if your VPN link is flaky, how do you expect clients to find your domain controller if their DNS is down...which it would be if the link is down.

Realistically though, this is beside the point. dcdiag just does tests. It can get bad DNS info from DC1 just as easily as it can from DC2. So the error it is reporting is still valid. It deson't matter *which* DNS server gave it bad info, but it tried to contact DC2 for advertising and got a response from DC1, which points to a DNS issue.
first start ntfrs service on dc1

then bounce dc2 and wait 30 minutes and run this again
also go around any dns by setting lmhost entries on both servers. when replication runs dns should follow

Author

Commented:
I sorted out a part of the problem. The File Replication service was not running on DC1, it was disabled.

After that was fixed, IT Health Scanner only reported one error on DC1, which says there is no PDC Role on DC2.

When I run the scanner on DC2, it skips all the test. How do I fix the DNS problem on DC2?
Distinguished Expert 2018

Commented:
Fire replication can take time, especially over a slow link. Wait for a bit and see if the problem resolves.
as mentioned before. setup LMHOST entry for direct result... the rest will have to wait.
when dealing with replication patients is a must..
you can set the LMHost by going to the file c:\windows\system32\drivers\etc\hosts
edit that file with any txt editor and add a line at the bottom
the line should be
192.xxxxxxxxx        DC1
where dc1's ip address  then a tab and then the dc1 computername .
remember when dealing with DNS / (LM)HOSTS that DNS is last in picking order.
 

Author

Commented:
Thanks p_nuts

Just a few questions.

Should I edit the lmhost on DC1 and DC2?

Will this be correct for DC1 and DC2:
192.168.0.1        DC1.domain.local PRE
192.168.10.1      DC2.domain.local
dc2 should be enough take the pre line out

just ip tab hostname on a new line. then save the file and do a ping
oh and don't put in the domainname.

192.168.0.1        dc1

that's it

Author

Commented:
I have demoted DC2 because the branch office was down for two days.

Now when I run dcdiag on DC1, I am not getting any errors, however the users at the branch office cannot connect to our exchange server which is at our head office. They get this error at event viewer:

Windows cannot obtain the domain controller name for your computer network. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

I think that those computers are still trying to contact DC2, I have tried restarting them, flushed and registered the DNS, added their subnet to our site in AD Sites and Services (Now there is only one site), removed all NTDS settings, no replication should occur now as there is only 1 DC. Removed DC2  object from AD Sites and Services Snap IN.

Still not getting anywhere.
Distinguished Expert 2018
Commented:
Go and pull any hosts and lmhosts changes you've done. I decided to step out of the conversation when that road was being travelled, but it sounds like it hasn't gotten you anywhere, so time to get back to basics.  If DNS is working properly then there isn't a need to use hosts files.  So lets undo that then we'll start doing some troubleshooting from the client side.
Part of me thinks that even undoing the hosts changes will help though.
ok .. you demoted the dc2 but probably that went wrong..

you need to do a cleanup on dc1

follow the steps in this article
http://support.microsoft.com/kb/216498

you need to make sure the dc2 is properly removed!

then check in sites and services that your secondary site and the subnet are created.
make sure that frs service etc are running on DC1

Logon to dc2
setup the IP address with a fixed IP and point the primary dns to itself and the secondary dns to dc1
promote dc2.. if it gives you an error that it can't find the domain change the dns to first dc1 no secondary.. and remember to change that back later.

after the promotion go in sites and services and open site 2 right click dc2 and select properties and make sure Global Catalog is checked.

if you don't want dc2 to be a dc anymore..

check the dhcp settings to the clients

the lmhost settings haven't been done on the clients so that's no help..

you need to make sure that the dhcp server is telling the clients to go to dc1 again.

Author

Commented:
Thanks for the help.

I am starting a new thread now as I have removed the second DC and our users at the branch office cannot get connected to exchange 2010 at our head office. I have disable RPC encryption on exchange, but that does not make a difference.

Thanks again.
Distinguished Expert 2018

Commented:
Feel free to post a link to your new question if you want me to follow it.  I haven't noticed it show up yet, but I obviously still get notices for this question. I'd be happy to help if you want.