Windows Server 2008 backup domain controller replication problem

I made the very foolish mistake of not demoting a primary domain controller (server1).  I just wiped the server clean, so unfortunately there is no bring it back.  Fortunately there is a backup domain controller (server2).  I used that backup domain controller to seize the five roles.   I've gone through and removed the old primary domain controller from active directory and performed a metadata cleanup.  

I am now putting to place what I would like to be the new primary domain controller (server3).  I've setup a new domain controller, but have yet to transfer the 5 roles.  My problem is that the sysvol and netlogon shares are not created.  It appears there is a problem replicating the information from the server2 to server3.  

I have tried the BlurFlags D2 fix, but didn't have much luck.  I didn't do the D4 fix on server2 as I didn't want to risk running in problems losing the only copy of Sysvol & netlogon I have.

All operating systems are Windows Server 2008 R2.  The deleted domain controller (server1) was SBS2008.

I'm really stuck and could use some help.  Thanks very much.
SupermanTBAsked:
Who is Participating?
 
arnoldCommented:
If scripts does not exist in c:\windows\sysvol\sysvol\domainname\ netlogon can not be shared because the directory that it shares Scripts is not there.

Copy out the Scripts folder from the pre_existing and recheck.
0
 
arnoldCommented:
is the error related to replication deals with a jrnl_ error that includes instructions including a registry change to correct?
Follow those instructions once you stop/restart as indicated, the sysvol/netlogon should appear.  

Look at the event log to see what is preventing sysvol/netlogon from being brought up. Check server2 for errors as well, the journal error might be on the now primary server.
0
 
SupermanTBAuthor Commented:
I do get the error below on server2.  I see the registry fix suggestion at the bottom.  Is that what you're talking about?

Assuming I do that fix, are the backup DCs just going to start replicating?  I don't see where is says to stop/start any services.  I would just like to be able to check whether it's working.

Thanks very much.

Replica set name is    : "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"
 Replica root path is   : "c:\windows\sysvol\domain"
 Replica root volume is : "\\.\C:"
 A Replica set hits JRNL_WRAP_ERROR when the record that it is trying to read from the NTFS USN journal is not found.  This can occur because of one of the following reasons.
 
 [1] Volume "\\.\C:" has been formatted.
 [2] The NTFS USN journal on volume "\\.\C:" has been deleted.
 [3] The NTFS USN journal on volume "\\.\C:" has been truncated. Chkdsk can truncate the journal if it finds corrupt entries at the end of the journal.
 [4] File Replication Service was not running on this computer for a long time.
 [5] File Replication Service could not keep up with the rate of Disk IO activity on "\\.\C:".
 Setting the "Enable Journal Wrap Automatic Restore" registry parameter to 1 will cause the following recovery steps to be taken to automatically recover from this error state.
 [1] At the first poll, which will occur in 5 minutes, this computer will be deleted from the replica set. If you do not want to wait 5 minutes, then run "net stop ntfrs" followed by "net start ntfrs" to restart the File Replication Service.
 [2] At the poll following the deletion this computer will be re-added to the replica set. The re-addition will trigger a full tree sync for the replica set.
 
WARNING: During the recovery process data in the replica tree may be unavailable. You should reset the registry parameter described above to 0 to prevent automatic recovery from making the data unexpectedly unavailable if this error condition occurs again.
 
To change this registry parameter, run regedit.
 
Click on Start, Run and type regedit.
 
Expand HKEY_LOCAL_MACHINE.
Click down the key path:
   "System\CurrentControlSet\Services\NtFrs\Parameters"
Double click on the value name
   "Enable Journal Wrap Automatic Restore"
and update the value.
 
If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
arnoldCommented:
Follow the instructions to resolve this error. and your replication issue should be resolved.
Yes, once you clear the journaling error on server2, the replication issues will be cleared as well.
Server2 is the reference server. It is having an issue that is preventing the replication to the new server from starting.

note The Warning:
 
make sure to change the value back to 0 for "Enable Journal Wrap Automatic Restore" right after you restart the ntfrs service.

You do not want this process to automatically run when the system is rebooted or the service is restarted.

Did your SBS2008 was an upgrade from an SBS2003?

once you are done and replication is restored. you should look into migrating away from sysvol/netlogon being replicated using NTFRS.  there is a process you would need to go through to prepare them to transition to DFS-R as the replicating mechanism. (DFS-R superior to NTFRS)
0
 
arnoldCommented:
oh, make sure your new server has the windows 2003 file share components (I think it is a feature of filesharing) installed (you need the ntfrs services for the replication)

Here is a reference to transitioning from ntfrs to dfs-R if you want to look at and consider for future......

http://blogs.technet.com/b/notesfromthefield/archive/2008/04/27/upgrading-your-sysvol-to-dfs-r-replication.aspx
0
 
SupermanTBAuthor Commented:
I followed your instructions in your previous post before I got your most recent post.

It is possible the SBS 2008 was an upgrade from SBS 2003.  That predates me.  The functional level is 2003, so likely.

I probably kicked off the instructions about 3 minutes ago.  I do not see the Sysvol or Netlogon shares on server2 now.  From reading another post on the web, that looks to be normal.  I suppose it takes a few minutes to recreate?
0
 
SupermanTBAuthor Commented:
Does it take a particular amount of time for those shares to be recreated?
0
 
arnoldCommented:
Yes, it takes about five to 10 minutes for the journal rebuild to clear this error.
Then it takes a bit of time for the replication detection process to run its course (presumably your server3 has the ntfrs service/feature installed).

You should consider raising the functional level to 2008, what OS workstations do you have?
raising the level will add control feature through GPO/GPP.
By now the sysvol/netlogon should be replicated and available on the server3. There is no rush to migrate/transition the new server to be the master. Functionally it makes little difference, is there a reason why you are rushing to make the new as the master?
make sure to using AD sites and services, NTDS settings for both to have the Global Catalog option checked.
0
 
SupermanTBAuthor Commented:
I don't see the shares yet on any server.  Any way I can check if it's in the act of replicating?
0
 
arnoldCommented:
double check your file services to make sure "windows 2003 file services" (add role services) are installed on the new server3. Without those, ntfrs services are not available on your system and no replication of sysvol/netlogon is possible.
0
 
SupermanTBAuthor Commented:
Windows 2003 Files services was not installed.  I have just installed it.  what now?

Currently have no active directory
0
 
arnoldCommented:
what do you mean, server2 should be functional and running.  once the windows 2003 file services are installed, ntfrs service status should replicate. Your lack of AD might mean you did not update your DHCP server scope options to push the server2 IP as name server and/or the IP in name server in statically configured IPs still uses the old server's IP.

The TWO DCs that you now have should have their own IP and the other DC's IP in the name server list.
The DHCP service scope options for name server should also reflect both IPs that will be push to the DHCP clients.
0
 
SupermanTBAuthor Commented:
I ran that registry fix on server2.  when I did that, the netlogon & sysvol shares immediately disappeared and have not reappeared.  

The servers do not handle DHCP.  That is being managed by the router.  It is possible that the DHCP role was installed on the SBS2008 server, but if so, it was not in use.
0
 
arnoldCommented:
Check the event log to see what if anything it reports. it should be back within 5 to 10 minutes.

Double check to confirm where your DHCP clients get their Ips from. If you have one near by, runing ipconfig /all | find "DHCP"
Should return a line with the IP of the DHCP server. If the IP is the same as the default gateway, it will point to the Router. If it is a different IP, it will point to the server that has the DHCP responsibility.
0
 
SupermanTBAuthor Commented:
I really don't see much in the Event Viewer.  I see an error message, 13508 with the info below.

The File Replication Service is having trouble enabling replication from server3 to server2 for c:\windows\sysvol\domain using the DNS name server3.domain.local. FRS will keep retrying.
 Following are some of the reasons you would see this warning.  

The DHCP is definitely coming from the router...not the server.  I checked using your command prompt to be sure
0
 
arnoldCommented:
Check what DNS servers each system points to. On which server are you seeing the FRS error on?  Did you already install the windows 2003 file services on server3 and is the service started?
Presumably, sysvol/netlogon returned/reappeared on server2.
0
 
SupermanTBAuthor Commented:
The DNS is pointed to server2.  I see the FRS error on server2.  The sysvol/netlogon has not reappeared on server2, which is giving me a small heart attack.

I installed the 2003 file services on server3.  I did some Googling, but couldn't find the name of the service that is supposed to be running.

If you don't mind, I'd like to focus on getting sysvol/netlogon working on server2.  That is a rather large problem if that doesn't get back up and running.
0
 
arnoldCommented:
on server3 there should be an NTFRS service.

Server2
What if any errors do you see in eventlog on server2? beside FRS replication failures?
the share is one thing, the data is in c:\windows\sysvol

If anything is preventing it from coming up, there should be an error/indication what might be going on.
did you stop and restart the ntfrs on server2 following the registry change?

try
dcdiag
repadmin /showreps
0
 
SupermanTBAuthor Commented:
On server3, I do not see the NTFRS service.

There is data in c:\windows\sysvol.  It is just not shared.  

There's really not much in the event viewer.  The dcdiag came up with some errors as i would expect with AD not working.  The repadmin /showreps looks good.  

I really need to get AD on this server up and running.  Would the D4 fix get things moving?  It might make sense to do that so I can actually get some sleep tonight.  Thoughts?
0
 
arnoldCommented:
I've seen it take some time to rebuild, but should be back .... I think the longest I've seen it missing was about 30 minutes depending on how much data/processing it had to go through.
sysvol a share for c:\windows\sysvol\sysvol
netlogon a share for c:\windows\sysvol\sysvol\domainname\scripts

If it is not being brought up, there has to be an error indicating why the netlogon/sysvol is being prevented from being brought up.
0
 
SupermanTBAuthor Commented:
so you think I should just share those directories?  I've never done it manually before
0
 
arnoldCommented:
can you post the output of net start from either server
after making the registry change, did you run net  stop ntfrs? then net start ntfrs ? at which point you changed the registry back to 0 as indicated by the Warning?
What is the registry key value for "Enable Journal Wrap Automatic Restore"?

on server3 net start ntfrs. Look at its event log.

If something is preventing netlogon from being shared, there has to be an event log indicating what the issue is.

Does the dcdiag error indicate/show the old SBS name?
0
 
SupermanTBAuthor Commented:
for the netlogon, you have this listed
 c:\windows\sysvol\sysvol\domainname\scripts

When I look at my server, I have
 c:\windows\sysvol\sysvol\domainname\

At that level there are two folders.
Do_NOT_REMOTE_NtFrs_PreInstall_Directory
NtFrs_PreExisting__See_EventLog

When I click on the NtFrs_PreExisting__See_Event Log,  I get the following folders
Scripts, ClientAgent, Policies

Should I share that scripts folder at NetLogon?
0
 
SupermanTBAuthor Commented:
I'll get you answers to those questions in your post.  I just want to focus on getting active directory working
0
 
arnoldCommented:
can you open ADUC and enumerate.
The sysvol/netlogon are shares where login script/gpos are.
While it is possible to share them manually, Identifying what might be preventing them from being  shared is...

Do you have a domain workstation near by where you can test whether you can login with user credentials?

Has the FRS replication to server3 started? Does server3 have netlogon/sysvol shared?

the Pre_existing is from which server? server2 or server3?

Did you make server3 master of all the roles prior to the fixing the replication issue?
0
 
SupermanTBAuthor Commented:
I got a bit ancy and ran the BurFlags D4 fix.  When I did that, sysvol was shared on server2.  I looked immediately at server3 and it was installed there as well.

netlogon is not shared at either location.  Fortunately all users can login now and Active Directory is working.

I never changed the roles to server3.  Server2 has all the roles.

Any ideas on how to get that netlogon working?
0
 
SupermanTBAuthor Commented:
I'm breathing easy now that AD is working
0
 
arnoldCommented:
you may have to copy the files back out from
NtFrs_PreExisting__See_EventLog
from both c:\windows\sysvol\sysvol
domain
staging
staging areas

and c:\windows\sysvol\sysvol\domainname the three you Scripts, Policies and ClientAgent
0
 
SupermanTBAuthor Commented:
Then rerun the D4 fix?
0
 
SupermanTBAuthor Commented:
I've copied the data into the folder, but no netlogon share.  I would think I would have to do something first?
0
 
arnoldCommented:
When you run the D4 fix, did you mark server3 with the D2 setting in the same registry key?

The only time you will get _Existing is when the replication goes in the wrong direction.
copy, do not move the three directories and see whether first it will replicate the data accross to server3. Then you can rerun the net stop ntfrs, net start ntfrs to make sure both sysvol and netlogon come up.
0
 
SupermanTBAuthor Commented:
I did not do server3 with d2 yet.  

It does appear it replicated to server3 after copying over the data.  I did the ntfrs stop/start, but don't see netlogon on any server
0
 
arnoldCommented:
the event log should reflect an error if netlogon is not being shared why that is the case.
what is the output from dcdiag?
(you would need to update the router's DHCP settings to push both server's IP as name servers)

I think when you run the D4 fix, the seconary DC's ntfrs was still running and that led to the "clearing"

reboot server3 to see whether it will bring up the netlogon share now that the folders/files are there. This is less risky that the next suggestion.

stop ntfrs on server3
rerun D4 fix on server2
see if net logon comes up on server2/
0
 
SupermanTBAuthor Commented:
Restarting server3 did the trick.  As soon as I did, netlogon appeared.  I am restarting server2 now to see if netlog also appears.  I'm not terribly concerned about server2 as I will be demoting it shortly (in the next few days) and tossing it in the trash.
0
 
arnoldCommented:
IMHO, you should have two Dcs if possible.

Glad to hear you're back up and running.
0
 
SupermanTBAuthor Commented:
Server2 restarted and netlogon is present.  I'm looking good.  I'll be demoting that server2 sometime in the next few days and kicking it out the door.

Thank you sincerely for your help.  I'm off to get some sleep!
0
 
SupermanTBAuthor Commented:
I will be replacing server2 with a new domain controller.  So two DCs for sure.  Thanks again!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.