Solved

How to force active directory replication from one DC to another

Posted on 2014-03-18
43
2,431 Views
Last Modified: 2014-03-24
I am having issues replicating AD from one DC to another. Both servers are Windows Server 2008 R2 SP1. I have used the GUI option in sites and service to force replication. I have also tried repadmin, and ntsdutil.

I have also posed the question here

I have created a youtube video Here

Thanks for your time.
0
Comment
Question by:nate0187
  • 26
  • 9
  • 8
43 Comments
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937522
Hi,

Try this...

use the regedit command to view the registry on a domain controller. The setting for replication consistency is stored in the registry in the Strict Replication Consistency entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters.

Values for this entry are as follows:

    Value: 1 (0 to disable)

    Default: 1 (enabled) in a new Windows Server 2003 or Windows Server 2008 forest; otherwise 0.

    Data type: REG_DWORD

If the value is 0, use the following procedure to change the value to 1 on a specific domain controller or on all domain controllers.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937538
@Santosh

Does it matter which DC change the value on or do it for both? Also the value for that on DC zeus is 1
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937556
Do 0 on both.... Once done set back to 1.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937600
@ Santosh

After I set both values to 0

What should I try running again? I have tried a few different things.
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937608
Try to Replicate from site n services.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937633
Same error on Zeus, but it did work on Mars.
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39937663
You can download the "Active Directory Replication Tool"  and check for errors and look at this link "Troubleshooting Active Directory Replication Problems" to see if you have any errors pertaining to that link.

The Active Directory Replication Status Tool (ADREPLSTATUS) analyzes the replication status for domain controllers in an Active Directory domain or forest. ADREPLSTATUS displays data in a format that is similar to REPADMIN /SHOWREPL * /CSV imported into Excel but with significant enhancements.


Expose Active Directory replication errors occurring in a domain or forest
Prioritize errors that need to be resolved in order to avoid the creation of lingering objects in Active Directory forests
Help administrators and support professionals resolve replication errors by linking to Active Directory replication troubleshooting content on Microsoft TechNet
Allow replication data to be exported to source or destination domain administrators or support professionals for offline analysis
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937677
@comfortjeanius

I have already downloaded that tool. It was in the beginning of the video.
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39937702
What error are you getting?
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937747
One report says:

Failed to collect data against node "Mars.cs.local"

Domain controller "Mars.cs.local" doe not exist or can not be contacted.

I also have a csv file of other errors, that I have attached.
ADReplicationStatus.2014.3.18.13.csv
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39937779
What happens when you run this command in an elevated cmd prompt?
repadmin /showreps

Open in new window

0
 
LVL 2

Author Comment

by:nate0187
ID: 39937790
Some screen shots of the errors using the Active Directory Replication Status Tool.
AD-Tool-Error.png
AD-Tool-Error-2.png
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937801
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.WIN-IHRL0IKH1PH>repadmin /showreps
Default-First-Site-Name\ZEUS
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 1bf52388-c25c-4f0b-8c53-773550ea2e37
DSA invocationID: 1bf52388-c25c-4f0b-8c53-773550ea2e37

==== INBOUND NEIGHBORS ======================================

DC=CS,DC=local
    Default-First-Site-Name\MARS via RPC
        DSA object GUID: e1d9c8da-a93e-4552-9d51-374d3f818abc
        Last attempt @ 2014-03-18 13:45:01 failed, result 1727 (0x6bf):
            The remote procedure call failed and did not execute.
        586 consecutive failure(s).
        Last success @ 2014-03-17 13:59:32.

CN=Configuration,DC=CS,DC=local
    Default-First-Site-Name\MARS via RPC
        DSA object GUID: e1d9c8da-a93e-4552-9d51-374d3f818abc
        Last attempt @ 2014-03-18 12:52:39 failed, result 1727 (0x6bf):
            The remote procedure call failed and did not execute.
        25 consecutive failure(s).
        Last success @ 2014-03-17 13:59:32.

CN=Schema,CN=Configuration,DC=CS,DC=local
    Default-First-Site-Name\MARS via RPC
        DSA object GUID: e1d9c8da-a93e-4552-9d51-374d3f818abc
        Last attempt @ 2014-03-18 12:53:17 failed, result 1727 (0x6bf):
            The remote procedure call failed and did not execute.
        26 consecutive failure(s).
        Last success @ 2014-03-17 13:59:32.

DC=DomainDnsZones,DC=CS,DC=local
    Default-First-Site-Name\MARS via RPC
        DSA object GUID: e1d9c8da-a93e-4552-9d51-374d3f818abc
        Last attempt @ 2014-03-18 12:52:01 failed, result 1256 (0x4e8):
            The remote system is not available. For information about network tr
oubleshooting, see Windows Help.
        30 consecutive failure(s).
        Last success @ 2014-03-17 13:59:32.

DC=ForestDnsZones,DC=CS,DC=local
    Default-First-Site-Name\MARS via RPC
        DSA object GUID: e1d9c8da-a93e-4552-9d51-374d3f818abc
        Last attempt @ 2014-03-18 12:52:01 failed, result 1256 (0x4e8):
            The remote system is not available. For information about network tr
oubleshooting, see Windows Help.
        27 consecutive failure(s).
        Last success @ 2014-03-17 13:59:32.

Source: Default-First-Site-Name\MARS
******* 584 CONSECUTIVE FAILURES since 2014-03-17 13:59:32
Last error: 1727 (0x6bf):
            The remote procedure call failed and did not execute.
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937882
hi,

Pls check if you are able to resolve mars.cs.local.

pls run DCDIAG /test:DNS
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937927
DCDIAG /test:DNS  On DC Zeus:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.WIN-IHRL0IKH1PH>DCDIAG /test:DNS

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = Zeus
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\ZEUS
      Starting test: Connectivity
         ......................... ZEUS passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\ZEUS

      Starting test: DNS

         DNS Tests are running and not hung. Please wait a few minutes...
         ......................... ZEUS passed test DNS

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : CS

   Running enterprise tests on : CS.local
      Starting test: DNS
         ......................... CS.local passed test DNS

C:\Users\Administrator.WIN-IHRL0IKH1PH>
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937928
DCDIAG /test:DNS  DC Mars:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.CS>DCDIAG /test:DNS

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = MARS
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\MARS
      Starting test: Connectivity
         ......................... MARS passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\MARS

      Starting test: DNS

         DNS Tests are running and not hung. Please wait a few minutes...
         ......................... MARS passed test DNS

   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : CS

   Running enterprise tests on : CS.local
      Starting test: DNS
         Summary of test results for DNS servers used by the above domain
         controllers:

            DNS server: 2001:500:1::803f:235 (h.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:1::803f:235

            DNS server: 2001:500:2d::d (d.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:2d::d

            DNS server: 2001:500:2f::f (f.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:2f::f

            DNS server: 2001:500:3::42 (l.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:500:3::42

            DNS server: 2001:503:ba3e::2:30 (a.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:503:ba3e::2:30

            DNS server: 2001:503:c27::2:30 (j.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:503:c27::2:30

            DNS server: 2001:7fd::1 (k.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:7fd::1

            DNS server: 2001:7fe::53 (i.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:7fe::53

            DNS server: 2001:dc3::35 (m.root-servers.net.)
               1 test failure on this DNS server
               PTR record query for the 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa failed on the DNS server 2001:dc3::35

         ......................... CS.local passed test DNS

C:\Users\Administrator.CS>
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937940
Hi,

As per logs, root hints are not working on Mars, please update it.  http://technet.microsoft.com/en-us/library/cc730735.aspx
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937953
@santosh

So I need to copy the root hits from the server zeus right? Then what ipconfig /flushdns, and retry DCDIAG /test:DNS
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39937977
yes, then Run Active Directory Replication Status Tool.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39937991
@Santosh

Alright I will do that now. What about server zeus? It shows the same root hit record as mars?
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39937998
Lets make sure DNS resolution is working:
ping -a <ip address>

Open in new window


Plus make sure on the problematic server check this registry and make sure you have all four:
Registry EntryHKLM/SOFTWARE/Microsoft/Rpc/Clientprotocols

Plus run this commands as well:
repadmin /replsummary

Open in new window


Plus check "Active Directory and Active Directory Domain Services Port Requirements"

Default Port Range
In a domain that consists of Windows Server® 2003–based domain controllers, the default dynamic port range is 1025 through 5000. Windows Server 2008 R2 and Windows Server 2008, in compliance with Internet Assigned Numbers Authority (IANA) recommendations, increased the dynamic port range for connections. The new default start port is 49152, and the new default end port is 65535. Therefore, you must increase the remote procedure call (RPC) port range in your firewalls. If you have a mixed domain environment that includes a Windows Server 2008 R2 and Windows Server 2008 server and Windows Server 2003, allow traffic through ports 1025 through 5000 and 49152 through 65535.

Plus see if RPC is running, but here a link on "Restricting Active Directory replication traffic and client RPC traffic to a specific port" and this "Dynamic Ports in Windows Server 2008 and Windows Vista (or: How I learned to stop worrying and love the IANA)"

The remote procedure call failed and did not execute
The RPC failure that is reported in error 1727 may occur because RPC needs a port that is blocked. Faulty packets, port filtering, and firewall rules may block a port when the firewall or the network router is configured incorrectly.
You can download PortQryUI to check to see if the port is listening

portqry -n <ip address> -e 135 -p TCP

Open in new window


for a range
portqry -n <ip address> -e 135,49152-65535 -p TCP

Open in new window


Plus you can run netstat command to see if it is "Listening":
netstat -aon |FIND/I "listening" |FIND "135"

Open in new window


NOTE: Back up the registry before making changes.
One option is to adjust MaxUserPort to specify the highest port number that TCP can assign when an application requests an available user port from the system.

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Data type = REG_DWORD
Port range = 5000 – 65534

You can also adjust TcpMaxDataRetransmissions. TCP packets expect an acknowledgment from the receiving end. If there’s no acknowledgment before the timer expires, then the packets are retransmitted, up to the TcpMaxDataRetransmissions times.
Do not go below the value of 3
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Data type = REG_DWORD
Valid range = 0 - 0xFFFFFFFF (hexadecimal)
Default = 5

Plus try....
dcdiag /test:Replications

Open in new window

and
dcdiag /fix

Open in new window

0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39938003
every server has same set of root hints server. its just matter of  name resolution.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938016
@comfortjeanius

Thanks for your response, I will check that
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938018
@Santosh

So I leave zeus root hits as is then?
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39938034
yes, as no issue with Zeus as per report.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938053
@Santosh

I updated the root hits on Mars. Cleared DNS cashe, and updated server data files on both DC. I ran Active Directory Replication Status Tool, and DCDIAG /test:DNS

Everything is the same. Doesn't look like the root hits made a difference.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938079
@ comfortjeanius

I checked both DC reg, and they both have the entries that were in your screen shot.

I ran repadmin /replsummary, here is what it came back with:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.WIN-IHRL0IKH1PH>repadmin /replsummary
Replication Summary Start Time: 2014-03-18 15:22:51

Beginning data collection for replication summary, this may take awhile:
  .....


Source DSA          largest delta    fails/total %%   error
 MARS              01d.01h:23m:19s    5 /   5  100  (1726) The remote procedure
call failed.


Destination DSA     largest delta    fails/total %%   error
 ZEUS              01d.01h:23m:19s    5 /   5  100  (1726) The remote procedure
call failed.


Experienced the following operational errors trying to retrieve replication info
rmation:
          55 - MARS.CS.local

C:\Users\Administrator.WIN-IHRL0IKH1PH>


There are only Server 2008 R2 on the network, and we never had an issue with the servers replicating before, so I don't think the ports are the issue.

Running dcdiag /fix now
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39938092
Did you install anything before the replication start failing?
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938115
@comfortjeanius

Nope, nothing but updates. I just checked control panel, nothing look out of place
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938124
dcdiag /fix on DC Mars

C:\Users\Administrator.CS>dcdiag /fix

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = MARS
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\MARS
      Starting test: Connectivity
         ......................... MARS passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\MARS
      Starting test: Advertising
         ......................... MARS passed test Advertising
      Starting test: FrsEvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... MARS passed test FrsEvent
      Starting test: DFSREvent
         ......................... MARS passed test DFSREvent
      Starting test: SysVolCheck
         ......................... MARS passed test SysVolCheck
      Starting test: KccEvent
         ......................... MARS passed test KccEvent
      Starting test: KnowsOfRoleHolders
         [ZEUS] DsBindWithSpnEx() failed with error 1818,
         The remote procedure call was cancelled..
         Warning: ZEUS is the Schema Owner, but is not responding to DS RPC
         Bind.
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39938134
Is the RPC service is "Started" set "Automatic" and RPC Locator "Started" set "Automatic"?

Plus check this article "Troubleshooting “RPC server is unavailable” error, reported in failing AD replication scenario.".

From this article, "2008 R2 DFS Replication Error", it has the same error Error: 1726 (The remote procedure call failed.)
Turns out, the ISP had to come install some hardware to resolve time out issues.  They upgraded our speed a few weeks ago, and we have not been getting near that, plus a lot of network latency.

The timeouts were almost dead on with the errors.  Once they installed the new hardware, DFS finished replicating as it should, and has not thrown anymore errors.
0
 
LVL 13

Expert Comment

by:Santosh Gupta
ID: 39938142
pls run on mars,


netsh int ip reset resetlog.txt
netsh winsock reset

if still not works then pls share the patches that you installed or try to uninstall one by one.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938143
@comfortjeanius

On both DCs, the RPC Locator is set to manual and has not be started, but the RPC service set to automatic and has been started
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938146
@Santosh

I ran:

netsh int ip reset resetlog.txt
netsh winsock reset

It asked me to reboot the server, so I did.

Also I am not sure what you mean about:

"share the patches that you installed or try to uninstall one by one"
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39938159
From the problematic workstation on a elevated cmd prompt.

Type: ntdsutil -------> Press Enter
 ntdsutil: prompt --------->type: Metadata cleanup ------->Press Enter
metadata cleanup: prompt -------->type: Connections  --------> Press Enter
Connections: prompt  -------->type: type Connect to server localhost  --------> Press Enter

This will test RPC
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938181
@Santosh

netsh int ip reset resetlog.txt
netsh winsock reset

Removed my IP address, Mask, and Gateway from my NIC. I am glad I was onsite, other wise that server would have been down till I could have physically set it back.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39938223
@Santosh, and @Comfortjeanius

Mars is booting up now, it may take it a few. It looks like it is trying to replicate. I will post back on here if:

netsh int ip reset resetlog.txt
netsh winsock reset

Open in new window


and

Type: ntdsutil -------> Press Enter
 ntdsutil: prompt --------->type: Metadata cleanup ------->Press Enter
metadata cleanup: prompt -------->type: Connections  --------> Press Enter
Connections: prompt  -------->type: type Connect to server localhost  --------> Press Enter

Open in new window

0
 
LVL 2

Author Comment

by:nate0187
ID: 39938485
Mars is still applying user settings. I will post back once it has completed.
0
 
LVL 2

Author Comment

by:nate0187
ID: 39939607
@Santosh

netsh int ip reset resetlog.txt
netsh winsock reset
 

Open in new window


That didn't help any, or at least not with the replication issue
0
 
LVL 2

Author Comment

by:nate0187
ID: 39939614
@Comfortjeanius

I tested localhost on Mars, this is what I got:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Administrator.CS>ntdsutil
ntdsutil: Metadata cleanup
metadata cleanup: Connections
server connections: Connect to server localhost
Binding to localhost ...
Connected to localhost using credentials of locally logged on user.
server connections:

Open in new window

0
 
LVL 2

Accepted Solution

by:
nate0187 earned 0 total points
ID: 39939752
I have to remove the LiveQoS NDIS Filter Driver from IPV4 on the NIC on both servers. I only removed the filter from IPV4 since I am not using IPV6. After that I rebooted Mars. I went to sites and services, and I was able to replicate from both servers.
0
 
LVL 14

Expert Comment

by:comfortjeanius
ID: 39939827
That is great!!!
0
 
LVL 2

Author Closing Comment

by:nate0187
ID: 39949811
I figured out what the issue was, and I solved the problem.
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Suggested Solutions

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Resolve DNS query failed errors for Exchange
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now