Link to home
Start Free TrialLog in
Avatar of virusbcn
virusbcn

asked on

Error replication between DC sites in AD

Hello, i have one domain and one forest in my AD, the servers are W2K3, i have 4 sites defined in sites and services everyone with your subnet, in every site have one DC/GC, the sites are connected through VPN routers, everything it's working correct until the last 5/09/12 i have problems in AD, now i have one site disconnected the main site where i have the 5 fsmo roles. The main site it's called "Madrid" and site with problems it's called "valldaura" i view this in this site.

C:\Program Files\Support Tools>repadmin /showvector /latency DC=DomainDnsZones,D
C=chicote,DC=local
Caching GUIDs.
..
db3c5588-0173-4eb0-9430-229a406a05f4 @ USN    148473 @ Time 2007-12-13 18:55:41
15cfd981-b906-4492-871a-74b502599483 @ USN    172213 @ Time 2008-02-04 16:18:24
765f20fc-eb46-4ab4-9e71-29f53e70d807 @ USN  13673339 @ Time 2012-08-02 11:55:40
2af714c1-2264-4ff9-a66c-33a2d2426898 @ USN     25302 @ Time 2012-08-02 13:48:12
Madrid\CHIxxxSRV                    @ USN    637718 @ Time 2012-09-05 10:28:29
Cubelles\CHIxxx4SRV                 @ USN   4542230 @ Time 2012-09-14 20:07:26
Marina\CHIxxx3SRV                   @ USN   6945833 @ Time 2012-09-14 20:17:55
Valldaura\CHIxxx2SRV                @ USN   4621066 @ Time 2012-09-14 20:23:17

This post is a continuation of this -> https://www.experts-exchange.com/questions/27857888/Exchange-2007-and-Exchange-2000.html?anchorAnswerId=38399993#a38399993
Avatar of virusbcn
virusbcn

ASKER

how can i force the replication Valldaura->Madrid ¿???
Avatar of Miguel Angel Perez Muñoz
I suggest check replication on Valldarura DC using dcdiag /test:replications
Thank you Drashiel this is the output of dcdiag in site Valldaura DC ->

C:\Documents and Settings\administrador>dcdiag /test:replications

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Valldaura\chixxxte2SRV
      Starting test: Connectivity
         ......................... chixxxte2SRV passed test Connectivity

Doing primary tests

   Testing server: Valldaura\chixxxte2SRV
      Starting test: Replications
         ......................... chixxxte2SRV passed test Replications

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : chixxxte

   Running enterprise tests on : chixxxte.local

C:\Documents and Settings\administrador>
Look at this:
Madrid\CHIxxxSRV                    @ USN    637718 @ Time 2012-09-05 10:28:29
Cubelles\CHIxxx4SRV                 @ USN   4542230 @ Time 2012-09-14 20:07:26
Marina\CHIxxx3SRV                   @ USN   6945833 @ Time 2012-09-14 20:17:55
Valldaura\CHIxxx2SRV                @ USN   4621066 @ Time 2012-09-14 20:23:17

USN on Cubelles and Valldaura are so far from Marina and Madrid. Can you run "dcdiag" on Madrid, Cubelles and Valldaura?
This output it's from site "Madrid", it seems to be correct ->



C:\Documents and Settings\Administrador.chixxxte>dcdiag /test:replications

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Madrid\chixxxteSRV
      Starting test: Connectivity
         ......................... chixxxteSRV passed test Connectivity

Doing primary tests

   Testing server: Madrid\chixxxteSRV
      Starting test: Replications
         ......................... chixxxteSRV passed test Replications

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : chixxxte

   Running enterprise tests on : chixxxte.local

C:\Documents and Settings\Administrador.chixxxte>
And this is from site "Marina" it seems to be bad ....


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Marina\chixxxte3SRV
      Starting test: Connectivity
         ......................... chixxxte3SRV passed test Connectivity

Doing primary tests
   
   Testing server: Marina\chixxxte3SRV
      Starting test: Replications
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte3SRV
            Naming Context: DC=ForestDnsZones,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 17:34:23.
            The last success occurred at 2012-08-02 11:45:47.
            4439 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxte2SRV to chixxxte3SRV
            Naming Context: DC=ForestDnsZones,DC=chixxxte,DC=local
            The replication generated an error (-2146893022):
            El nombre principal de destino es incorrecto.
            The failure occurred at 2012-09-17 17:37:59.
            The last success occurred at 2012-09-03 23:17:59.
            1322 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte3SRV
            Naming Context: DC=DomainDnsZones,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 17:34:23.
            The last success occurred at 2012-08-02 11:45:46.
            4439 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxte2SRV to chixxxte3SRV
            Naming Context: DC=DomainDnsZones,DC=chixxxte,DC=local
            The replication generated an error (-2146893022):
            El nombre principal de destino es incorrecto.
            The failure occurred at 2012-09-17 17:37:59.
            The last success occurred at 2012-09-03 23:17:58.
            1322 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte3SRV
            Naming Context: CN=Schema,CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 17:34:23.
            The last success occurred at 2012-08-02 11:45:46.
            4439 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxte2SRV to chixxxte3SRV
            Naming Context: CN=Schema,CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (-2146893022):
            El nombre principal de destino es incorrecto.
            The failure occurred at 2012-09-17 17:37:59.
            The last success occurred at 2012-09-03 23:17:57.
            1322 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte3SRV
            Naming Context: CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 17:34:22.
            The last success occurred at 2012-08-02 11:45:45.
            4439 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxte2SRV to chixxxte3SRV
            Naming Context: CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (-2146893022):
            El nombre principal de destino es incorrecto.
            The failure occurred at 2012-09-17 17:37:59.
            The last success occurred at 2012-09-03 23:17:50.
            1322 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte3SRV
            Naming Context: DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 17:34:23.
            The last success occurred at 2012-08-02 11:45:37.
            4439 failures have occurred since the last success.
         [Replications Check,chixxxte3SRV] A recent replication attempt failed:
            From chixxxte2SRV to chixxxte3SRV
            Naming Context: DC=chixxxte,DC=local
            The replication generated an error (-2146893022):
            El nombre principal de destino es incorrecto.
            The failure occurred at 2012-09-17 17:37:59.
            The last success occurred at 2012-09-03 23:17:58.
            1323 failures have occurred since the last success.
         REPLICATION-RECEIVED LATENCY WARNING
         chixxxte3SRV:  Current time is 2012-09-17 17:44:46.
            DC=ForestDnsZones,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:59.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:22.
            DC=DomainDnsZones,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:58.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            CN=Schema,CN=Configuration,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:57.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            CN=Configuration,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:49.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:58.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
         REPLICATION-RECEIVED LATENCY WARNING

          Source site:

         CN=NTDS Site Settings,CN=Valldaura,CN=Sites,CN=Configuration,DC=chixxxte,DC=local

          Current time: 2012-09-17 17:44:46

          Last update time: 2012-09-03 23:03:07

          Check if source site has an elected ISTG running.

          Check replication from source site to this server.
         REPLICATION-RECEIVED LATENCY WARNING

          Source site:

         CN=NTDS Site Settings,CN=Madrid,CN=Sites,CN=Configuration,DC=chixxxte,DC=local

          Current time: 2012-09-17 17:44:46

          Last update time: 2012-08-02 11:51:39

          Check if source site has an elected ISTG running.

          Check replication from source site to this server.
         ......................... chixxxte3SRV passed test Replications
   
   Running partition tests on : ForestDnsZones
   
   Running partition tests on : DomainDnsZones
   
   Running partition tests on : Schema
   
   Running partition tests on : Configuration
   
   Running partition tests on : chixxxte
   
   Running enterprise tests on : chixxxte.local
And this from site "Cubelles" bad too...


Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests
   
   Testing server: Cubelles\chixxxte4SRV
      Starting test: Connectivity
         ......................... chixxxte4SRV passed test Connectivity

Doing primary tests
   
   Testing server: Cubelles\chixxxte4SRV
      Starting test: Replications
         [Replications Check,chixxxte4SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte4SRV
            Naming Context: DC=ForestDnsZones,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 18:01:45.
            The last success occurred at 2012-08-02 11:50:46.
            4440 failures have occurred since the last success.
         [Replications Check,chixxxte4SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte4SRV
            Naming Context: DC=DomainDnsZones,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 18:01:45.
            The last success occurred at 2012-08-02 11:50:46.
            4440 failures have occurred since the last success.
         [Replications Check,chixxxte4SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte4SRV
            Naming Context: CN=Schema,CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 18:01:43.
            The last success occurred at 2012-08-02 11:50:44.
            4440 failures have occurred since the last success.
         [Replications Check,chixxxte4SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte4SRV
            Naming Context: CN=Configuration,DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 18:01:42.
            The last success occurred at 2012-08-02 11:50:44.
            4440 failures have occurred since the last success.
         [Replications Check,chixxxte4SRV] A recent replication attempt failed:
            From chixxxteSRV to chixxxte4SRV
            Naming Context: DC=chixxxte,DC=local
            The replication generated an error (8452):
            Va a quitarse el contexto de nombres o ‚ste no est  duplicado.
            The failure occurred at 2012-09-17 18:01:35.
            The last success occurred at 2012-08-02 11:50:40.
            4440 failures have occurred since the last success.
         REPLICATION-RECEIVED LATENCY WARNING
         chixxxte4SRV:  Current time is 2012-09-17 18:04:51.
            DC=ForestDnsZones,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:59.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:22.
            DC=DomainDnsZones,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:58.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            CN=Schema,CN=Configuration,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:57.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            CN=Configuration,DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:49.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
            DC=chixxxte,DC=local
               Last replication recieved from chixxxte2SRV at 2012-09-03 23:17:58.
               Last replication recieved from chixxxteSRV at 2012-08-02 11:53:21.
         REPLICATION-RECEIVED LATENCY WARNING

          Source site:

         CN=NTDS Site Settings,CN=Valldaura,CN=Sites,CN=Configuration,DC=chixxxte,DC=local

          Current time: 2012-09-17 18:04:51

          Last update time: 2012-09-03 23:03:07

          Check if source site has an elected ISTG running.

          Check replication from source site to this server.
         REPLICATION-RECEIVED LATENCY WARNING

          Source site:

         CN=NTDS Site Settings,CN=Madrid,CN=Sites,CN=Configuration,DC=chixxxte,DC=local

          Current time: 2012-09-17 18:04:51

          Last update time: 2012-08-02 11:51:39

          Check if source site has an elected ISTG running.

          Check replication from source site to this server.
         ......................... chixxxte4SRV passed test Replications
   
   Running partition tests on : ForestDnsZones
   
   Running partition tests on : DomainDnsZones
   
   Running partition tests on : Schema
   
   Running partition tests on : Configuration
   
   Running partition tests on : chixxxte
   
   Running enterprise tests on : chixxxte.local
Any news ???  :-(
The last success occurred at 2012-08-02 11:45:46 this seems to be not replicating since so many days
Please check your replication connections in sites and services and make sure you have configuered dns correctly use below recommendation

How we should Configuere DNS on our DC :-->

Every DNS server should Point to its own IP as a primary DNS and DNS located in remote site as a secondary DNS in TCP/IP properties
All the unused NIC's to be disabled
Valid DNS Ip from ISP to be configuered in DNS forwarders Do not configuere local DNS in forwarders
Public DNS IP's Should not be used at any NIC Card except Forwarders
Domain Controllers should not be multi-homed
Running VPN server and RRas server makes the DC multihomed refer http://support.microsoft.com/default.aspx?scid=kb;en-us;272294


If anything above is incorrect please correct it and run "ipconfig /flushdns & ipconfig /registerdns " and restart DNS service using "net stop dns & net start dns"

DNS best practices
http://technet.microsoft.com/en-us/library/cc778439(v=WS.10).aspx

Checklist: Deploying DNS for Active Directory
http://technet.microsoft.com/en-us/library/cc757116(v=ws.10)
Thank you sarang_tinguria but the DNS it's configured ok and i don't have RRAS, only VPN routers how can you see in my first post.

Pleaseeeee, can any help me ???
I think this DC´s has un synchronized a lot of time and requires non authoritative restoration.Try this on one affected server:
http://technet.microsoft.com/en-us/library/cc784922(WS.10).aspx
Thank you Drashiel for your quickly answer :-) , i have only 2 weeks backup ago of system state  :-(  
How I can force replication from another DC?
Make non authoritative restoration: http://technet.microsoft.com/en-us/library/cc784922(WS.10).aspx
This procedure copy all data from healthy DC and set up to date affected DC.
After, check replication on machine where you do non authoritative restoration.
I'm sorry drashiel, i'm not sure understand you ... you're telling me that -> backup system state of DC good and restore in the other DC with another name that is on another site???
Forget your backup... think that is vanished, does not exist. Hard drive where is has damaged, can not be accessed.
Now, make an non authoritative restoration on Valldaura: http://technet.microsoft.com/en-us/library/cc784922(WS.10).aspx
Then, when Valldaura DC share again sysvol and netlogon, test your replication between Valldaura and Madrid.
If your prefer, could tell you in spanish ;)
Thank you Drashiel, in 30 minutes i make a backup system state of valldaura, restart in directory services restore mode and restore a backup and restart normally to others dc replicate to this DC, it's correct ???  ;-)

In spanish better for me, but i write in english too for future search.


Gracias Drashiel, en media hora hago backup, restauro en "services restore directory" y reinicio para que se repliquen todos de nuevo, ojalá funcione  !!!!  :-)

Cruzo los dedos  ;-)
Don´t need backup but is a good practice. Steps are easy and restoration is made in a few minutes (depends of your network speed). Then run dcdiag /test:replications to test replication and if it´s works, can be done on the other affected DC´s. I have done this procedure when have similar problems between sites when VPN goes down for a few days.

Good luck.

Lo del backup es siempre buena idea. Los pasos son sencillos y la restauración tarda unos pocos minutos (depende de la velocidad de la red). Después ejecuta dcdiag /test:replications para ver si la replicación funciona y si está correcto, lo puedes hacer en los demás controladores que tienen el mismo problema. Esto ya lo he hecho más veces, a veces la VPN se cae y me ocurre lo mismo, pero con la restauración se soluciona.

Buena suerte y no dejes de comentarme.
Malas noticias Drashiel, he reiniciado remotamente uno de los servidores afectados en "services restore directory" y luego lo he vuelto a reiniciar en "normal", lo he dejado un tiempo e intentado refrescar conexiones y nada, he vuelto a reiniciar y he recuperado el backup que había hecho minutos antes, he vuelto a reiniciar normal y ahora no me deja entrar, me dice "acceso denegado" tras entrar como administrador, no tengo manera de entrar ...  ¿??

Bad news Drashiel, i remotely restart one of bad servers in Directory Services Restore Mode and after restart normally, i cant not view any changes i try to refresh replications but not have anything, after i try too in Directory Services Restore Mode and restore a backup made minutes ago, restart normally and ...  now i can not enter with administrator they say "denegate access"
Hiciste el procedimiento de restauración no autoritativa??? después del proceso no tienes que reiniciar, simplemente tienes que rearrancar los servicios detenidos. Me temo que ese DC va a necesitar una restauración no autoritativa, pero para poder entrar vas a tener que, reiniciar, pulsar F8 y seleccionar "modo de restauración de Active directory. Para ello tienes que usar la clave que inicialmente se introdujo en el DC cuando se promocionó a controlador de dominio. No uses el backup, eso sólo es por si la máquina no arrancara y hubiera que reinstalarla.

Have you done non authoritative restoration?. Once procedure is complete, reboot is not required, only need start stopped services. I´m afraid you need to do a non authoritative restoration, but to do logon must to reboot, press F8 during start and select "Active directory restoration mode. To logon, must to use password provided when this server was promote to DC. Don´t use backup, use only if reinstall is required on this server.
He seguido el procedimiento que me indicabas -> http://technet.microsoft.com/en-us/library/cc784922%28WS.10%29.aspx   aquí no veo nada de rearrancar servicios detenidos, pone arrancar en modo recuperación de directorio -> recuperar backup -> reiniciar o eso he entendido yo :-(  
Cuando he arrancado en modo directorio he tenido que poner la contraseña de la instalación del dcpromo

I follow this -> http://technet.microsoft.com/en-us/library/cc784922%28WS.10%29.aspx  i dont view anything about restart services, i view restart in service directory mode -> restore backup and restart   :-(
When i restart in this mode i put the password of the install of dcpromo.
Arranca en modo de restauración e intenta una restauración no autoritativa siguiendo este procedimiento: http://support.microsoft.com/kb/290762
Reinicia al terminar

Start on Active Directory restoration mode and follow this procedure: http://support.microsoft.com/kb/290762
Restart at end.
Lo que me pasas es el burflags d2-d4 ??? esto recuerdo haberlo utilizado otras veces pero no hace falta reiniciar en modo restauración, no  ¿???   el problema es que no puedo entrar remotamente y está físicamente lejos ...  intentaré por otros medios...


What I spend is the d2-d4 BurFlags??? I remember having used it sometimes but no need to restart restoration mode, no Do??? the problem is that I can log in remotely and physically far ... try by other means ...
Como no puedes entrar usando las credenciales normales, tendrás que arrancar asi, a ver si hay suerte y puedes hacer logon para hacer la restauración. Efectivamente normalmente se hace con la máquina arrancada en modo normal pero este es un caso especial. Puedes hacer lo del burflag en Cubelles a ver si recuperamos este DC? ahora mismo sospecho que sólo funcionan dos, Madrid y Marina. El resto tienen un USN tan diferente que creo que no están validando.

Since you can not logon using standard credentials, must to start DC on this mode. Luckily can do logon and made non auth restoration. Usually this procedure is made with DC started normal mode but this is an special case. Can do burflag procedure on Cubelles DC? I think only runs Madrid and Marina, other has USN very different to validate users.
ASKER CERTIFIED SOLUTION
Avatar of virusbcn
virusbcn

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
It's only works