Solved

AD Replication Errors - Between Two Domain Controllers

Posted on 2013-05-17
2
385 Views
Last Modified: 2013-09-16
I'm having quite an issue that began a few days ago.  Let me just lay out exactly what happened - also I've inherited this environment, please keep that in mind.

1st DC - Windows Server 2003 R2 Std
2nd DC - Windows Server 2008 R2 Ent

In the last couple days, when a user boots up and attempts to log in from any workstation I have recently freshly installed encounters a Trust error upon login.  So, I logged in as local admin and rejoined to the domain - however when the Trust failed multiple times across several machines I dug deeper.  

On one of the workstations, I checked event viewer and found this:

Log Name:      System
Source:        NETLOGON
Date:          5/16/2013 12:06:07 PM
Event ID:      3210
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      WIN7-2083.Domain.DomainName.com
Description:
This computer could not authenticate with \\BDCName.Domain.DomainName.com, a Windows domain controller for domain DOMAIN, and therefore this computer might deny logon requests. This inability to authenticate might be caused by another computer on the same network using the same name or the password for this computer account is not recognized. If this message appears again, contact your system administrator.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NETLOGON" />
    <EventID Qualifiers="0">3210</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-05-16T17:06:07.000000000Z" />
    <EventRecordID>52991</EventRecordID>
    <Channel>System</Channel>
    <Computer>WIN7-2083.Domain.DomainName.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>DOMAIN</Data>
    <Data>\\BDCName.Domain.DomainName.com</Data>
    <Binary>220000C0</Binary>
  </EventData>
</Event>

So for some reason, it led me to believe that this workstation was authenticating directly to the 2nd DC versus the 1st DC.

Looking at the PDC Event Viewer, I found this error:

The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
 
Directory partition:
CN=Configuration,DC=Domain,DC=DomainName,DC=com
 
There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers.
 
User Action
Perform one of the following actions:
- Publish sufficient site connectivity information so that the KCC can determine a route by which this directory partition can reach this site. This is the preferred option.
- Add a Connection object to a directory service that contains the directory partition in this site from a directory service that contains the same directory partition in another site.
 
If neither of the tasks correct this condition, see previous events logged by the KCC that identify the inaccessible directory servers.

Followed by:
The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
 
Sites:
CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Domain,DC=DomainName,DC=com
 
 
 
 
 
 


So I looked on the 1st DC to find almost identical errors:

The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
 
Sites:
CN=Jackson,CN=Sites,CN=Configuration,DC=Domain,DC=DomainName,DC=com
 

I'm not entirely sure what caused these replication (I think?) start occuring.  It's literally been in the last few days.  I'm guessing at this point, they both are not communicating with each other properly.  If I make a change on one DC, it should show up on the other DC right?  For example changing user properties on the 1st DC should shortly show up on the 2nd DC as well?  

What steps can I take to really get this resolved?
0
Comment
Question by:aoiadmin
2 Comments
 
LVL 39

Accepted Solution

by:
footech earned 203 total points
Comment Utility
First thing I always recommend when encountering problems on a DC (especially anything to do with replication), is to run the following commands (on each DC).
dcdiag /v
dcdiag /v /test:dns
repadmin /showrepl
I would also suggest installing and running the AD Replication Status Tool which can be found here.
http://www.microsoft.com/en-us/download/details.aspx?id=30005
0
 
LVL 10

Assisted Solution

by:Pramod Ubhe
Pramod Ubhe earned 202 total points
Comment Utility
have you tried this command -

Repadmin /kcc server1.mydomain.com

it will re-initiate KCC to discover the replication topology.
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now