Fixing DNS Replication issues
Posted on 2011-03-22
A previous network engineer Added a new server to our Domain about a year ago prior to me arriving. This server was then promoted to a DC. We have two different Site locations but one Domain (2003) in a single forest (2000). The original DC holding the FSMO roles are located in the other site. The DC the new server replaced was then removed from site 2. I've been working on cleaning up DNS entries over the past few months and users have reported they have been having website loading issues for a year now. This can be reproduced on all machines except the DC in site 2. The issue does not affect Site 1. The website will almost always fail to load the 1st time, even simple sites such as google.com. If they are able to download a file it will download fast without any issues though. This seems to be a replication issue between AD on the two DC's.
Running DCDiag reports:
Starting test: Replications
[Replications Check,CCHSDL380] A recent replication attempt failed:
From CCSMS-FS1 to CCHSDL380
The replication generated an error (8606):
Insufficient attributes were given to create an object. This object
may not exist because it may have been deleted and already garbage collected.
The failure occurred at 2011-03-22 10:09:09.
The last success occurred at (never).
22455 failures have occurred since the last success.
......................... CCHSDL380 failed test Replications
Repadmin reports the same issue.
In DNS the records in both zones are incorrect and don't show records from either zone that have been added within the past year.
When running NTDSUTIL Metadata cleanup the old DC is not listed. From all of the helpful information on this site it seems that one of the only ways to resolve this issue is to DCPROMO /forceremoval then to rejoin it back as a DC.
Is there any alternative that can be done to resolve this issue?
The current DC OS's are as follows:
Site 1: 2003R2
Site 2: 2008R2
Sites are VPN connected through their Firebox's