Solved

AD KCC Error

Posted on 2013-06-10
2
2,763 Views
Last Modified: 2013-09-03
I have Active directory 2008 R2 and I am seeing this errors on only one domain controller.  I checked some  forums that indicated objects no longer in use and found some in Sites and Services.  I waited 24 hrs but still getting the errors.   Has anyone ran into these errors and what would be the cause?  Here are the errors/warning:


Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          6/10/2013 9:29:23 AM
Event ID:      1865
Task Category: Knowledge Consistency Checker
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      XXXXXXX
Description:
The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
 
Sites:
CN=XXXXXXXXX,CN=Sites,CN=Configuration,DC=XXXX,DC=XXX
 
 
 
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          6/10/2013 9:29:23 AM
Event ID:      1311
Task Category: Knowledge Consistency Checker
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      XXXXXXX
Description:
The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
 
Directory partition:
CN=Configuration,DC=XXXX,DC=XXX
 
There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers.
 
Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          6/10/2013 9:29:23 AM
Event ID:      1566
Task Category: Knowledge Consistency Checker
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      XXXXXX
Description:
All directory servers in the following site that can replicate the directory partition over this transport are currently unavailable.
 
Site:
CN=XXXXXXX,CN=Sites,CN=Configuration,DC=XXXX,DC=XXX
Directory partition:
CN=Configuration,DC=XXXX,DC=XXX
Transport:
CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=XXXX,DC=XXX
0
Comment
Question by:hbpub
  • 2
2 Comments
 
LVL 24

Accepted Solution

by:
Sandeshdubey earned 500 total points
ID: 39234879
It seems to be DNS name resolution issue or or necessary ports are not fully opened between locations or network connectivity issue.Portquery is free tool from the MS which can be downloaded and installed to verify the necessary ports are opened or not.
 
Also, disable local windows firewall service, by default it is enabled in vista/windows 2008 and above. Check the network connectivity and latency.
 Disable Windows Firewall:http://technet.microsoft.com/en-us/library/cc766337(WS.10).aspx
 
Best practices for DNS client settings on DC and domain members.
http://abhijitw.wordpress.com/2012/03/03/best-practices-for-dns-client-settings-on-domain-controller/

Active Directory and Active Directory Domain Services Port Requirements.
 http://technet.microsoft.com/en-us/library/dd772723%28WS.10%29.aspx
 
Troubleshooting Event ID 1311: Knowledge Consistency Checker:
 http://support.microsoft.com/kb/214745
 
Event ID 1566 — Network Name Resource Availability:
http://technet.microsoft.com/en-us/library/dd353930(WS.10).aspx
 
Event ID 1865 — KCC Replication Path Computation:
 http://technet.microsoft.com/en-us/library/cc756648(WS.10).aspx
 
Can you post the following to further help us diagnose this?
 
•Unedited ipconfig /all from each DC
•A PortQry result- (just post any "FILTERED" or "NOT LISTENING" in the results)
 •Dcdiag /q and repadmin /replsum output

Reference link:http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/9a65c9f3-9f5e-4284-ad57-b838680cf0c5

Hope this helps
0
 
LVL 24

Expert Comment

by:Sandeshdubey
ID: 39234888
In addition if there are intances of server which  is removed from network and still present in AD then run metadata cleanup to remove the same.

Complete Step by Step Guideline to Remove an Orphaned Domain controller (including seizing FSMOs, running a metadata cleanup, and more)
http://msmvps.com/blogs/acefekay/archive/2010/10/05/complete-step-by-step-to-remove-an-orphaned-domain-controller.aspx
0

Join & Write a Comment

As network administrators; we know how hard it is to track user’s login/logout using security event log (BTW it is harder now in windows 2008 because user name is always “N/A” in the grid), and most of us either get 3rd party tools, or just make our…
Mapping Drives using Group policy preferences Are you still using old scripts to map your network drives if so this article will show you how to get away for old scripts and move toward Group Policy Preference for mapping them. First things f…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now