Solved

AD sync issues

Posted on 2014-10-09
6
37 Views
Last Modified: 2016-03-16
We're currently on exchange 2003 sp2.  Our exchange and ad are on the same server.  We are working with consultants to upgrade but in the meantime we're experiencing problems.  We have not upgraded or implemented anything yet.  Late last week our server rebooted itself 3 times.  FYI, automatic updates is turned off.  It stopped doing that but now we're finding some ldap syncs breaking with 3rd party software.   FYI, we've not changed anything.  We have 3 domain controllers.  They are virtualized.  

I'm seeing a lot of NetBT event ID 4321 errors.   . .  could not be registered on the interface with IP address domain controller.  The machine with the IP address primary domain controller did not allow the name to be claimed by the machine.  And event id 2093 and 1864.  Worried if we're having replication problems.  Don't even know where to start. Any help would be appreciated.
0
Comment
Question by:GCBIT
  • 4
  • 2
6 Comments
 
LVL 1

Expert Comment

by:TORLYSIT
ID: 40371368
You may want to check and make sure your WINS servers are healthy? Check to see if the IP address(es) of your primary and secondary WINS server(s) on the server's network adapter are correct.

Also, check to see if your WINS servers are reporting any errors of their own?

I would definitely recommend you separate your DC and Exchange servers.
0
 

Author Comment

by:GCBIT
ID: 40371420
Just find out my admin made a snapshot of the server, tried to update the vmware tools.  It didn't work so he went back to the snapshot.  I think this is what caused the problem.  I found this article http://support.microsoft.com/kb/2023007 and trying to figure out what to do.
0
 

Author Comment

by:GCBIT
ID: 40371425
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:GCBIT
ID: 40371441
i don't think that's it.  We're not getting event id 2095.  Just found out he had installed symantec shortly before the issues starting happening.  So we receive event id 2093 and 1864 every night around 9:58 pm.
0
 
LVL 1

Accepted Solution

by:
TORLYSIT earned 500 total points
ID: 40371466
Event ID 1864 just advises that the DC has not recieved a replication in 24 hours.

If the second article you posted is correct, you need to resync the DC. There is no real easy way.

1. DCPROMO and demote the DC. (MAKE SURE YOU TRANSFER FSMO ROLES OFF THIS BOX FIRST!)
2. Shut down the demoted server.
3. Log onto another DC on your domain and do a Metadata cleanup. (http://support2.microsoft.com/kb/216498)
4. Restart the demoted DC
5. Promote it back to DC and reconfigure as before.

If the DC was snapshoted and reset, the AD database it came back with was not the one that AD was expecting and caused some sync issues.

Domain Controllers are one of the few servers where a snapshot is not recommended. Backup your LDAP database and restore it onto a fresh Domain Controller in the event of catastrophe. If you have more than one DC, just promote a server to DC and pick up where you left off.
0
 

Author Comment

by:GCBIT
ID: 40377150
looks like we have 3 domain controllers:
server A runs all the FSMO roles & is the GD
server B is the server that was reverted to snapshot and has exchange and ad
server C runs our intranet

Would I just demote server b or server b & c?
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now