active directory USN rollback

i have 3 servers

1- (DC1) primary ad with all rules and GC windows 2008 r2

2- (DC2) secondary ad windows 2012

3- (EX1) exchange server 2010 windows 2008 r2

before one month i restored dc1 from snapshot in vmware and the problems start appear, then i searched in internet and after 2 days i did that

1- Stop the NTFRS service

2- Start up regEdit Drill down to HKLM\System\CurrentControlSet\Services\NTDS\Parameters Modify the RegKey “Database restored from backup” = 1

3- Drill down to HKLM\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process Modify the RegKey BurFlags to D2

4- Reboot the server

that fixed my problem, but yesterday i added a new user to dc1 and its appear in dc2 and ex1 then added email address in exchange but it seems that domain users cannot see this user and the outlook show that user does not exist when i try to setup email, and the user not found when i try to add folder permission and i can't login to email via owa

but after i shutdown dc2 everything back to normal and email work without any problem

so its clear that there is a USN rollback problem but i have a lot of configuration in dc1, so my question is: can i demote dc2 then repromote to fix USN number between two server even if the problem in dc1 not dc2 ?

sorry for my english and thank you
m musaAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Radhakrishnan RSenior Technical LeadCommented:
Hi,

It looks like the DC1 has got corrupted sysvol, the procedure you did earlier was just rebuild the sysvol itself (D2) burflag method. What you should have done is On the server which has a good copy of Sysvol, mark the Sysvol structure as the Source and then rebuild the structure.

To confirm whether the DC1 is still in journal wrap, go to event viewer>>File replication logs. If you are getting the error then follow the steps;

To rebuild the sysvol structure on a server which is not replicating correctly, stop the File Replication Service on all domain controllers, configure the BurFlags registry keys, and then restart the File Replication Service by following these steps

Click Start, and then Run.
In the Open box, type cmd and click Ok.
In the Command box, type net stop ntfrs.
Click Start, and then Run.
In the Open box, type regedit and then click Ok.
Locate the following subkey in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
In the right-hand pane, double-click BurFlags.
On the server which has a good copy of Sysvol, mark the Sysvol structure as the Source, by following these steps:

In the Edit DWORD Value dialog box, type D4 and then click Ok.
Close the Registry Editor, and then switch to the command box.
In the command box, type net start ntfrs.
Close the command box.
Once the File Replication Service has started on the source server, on all other domain controllers:

In the Edit DWORD Value dialog box, type D2 and then click Ok.
Close the Registry Editor, and then switch to the command box.
In the command box, type net start ntfrs.
Close the command box.

Still if you see the replication errors, then you may need to demote and promote the server (after seizing the fsmo roles to second DC).
0
m musaAuthor Commented:
thank you for quick reply
there was no error in event logs at all but USN number for dc1 (on dc2) is higher than it is in dc1 so there is no replication to make error
as i remember when i do dcdiag from dc1 witch i restored i got no errors but from dc2 i got error inbound replications from dc1 but can't remember the error text or number
and how can i tell witch server has corrupted sysvol ?

thanks in advanced
0
Radhakrishnan RSenior Technical LeadCommented:
Hi,

When there is a sysvol corruption on a DC, it will report into event log (FRS logs). If you are sure that the server falls under USN rollback then the option would be restore from systemstate or demote and promote. I would recommend to demote and promote the DC.

Before than that refer this article https://support.microsoft.com/en-in/help/875495/how-to-detect-and-recover-from-a-usn-rollback-in-windows-server-2003 and confirm the USN rollback.

You need to consider the following scenario in this case

1) Sieze the roles to 2nd DC (transfer won't work)
2) dcpromo /force removal
3) Metdata cleanup to remove the failed DC
4) Remove all the DNS entries from all the zones
5) Join back the server to domain or directly run dcpromo to promote as DC
6) Transfer back all the roles

Good luck
0
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

m musaAuthor Commented:
what i exactly did is that:
restore dc1 only from snapshot then the next day i undone the restore and back to original copy that was working before restore and the problems start appears so that i am sure there is a usn rollback but i wander if the only problem that the usn number between two server why not demote the second one or remove it and create a new secondary server because the primary one has a huge files and configuration, the new server may fix the usn numbers.
note that now if i turn on the secondary server its work fine and if i change user password from dc1 or dc2 its changed in the user's accounts that mean 2 servers sync in someways.
so the last advise please what should i do
thanks again
0
Radhakrishnan RSenior Technical LeadCommented:
Okay. If you create an user in 2nd DC, will that replicate to 1st DC? and vice versa?
Also, if you create a text file under sysvol folder, is that replicating too?

Did you read the article which I posted earlier and ran the command to compare the vector ID?
0
m musaAuthor Commented:
Okay. If you create an user in 2nd DC, will that replicate to 1st DC? and vice versa?  : yes its replicate and vice versa
Also, if you create a text file under sysvol folder, is that replicating too? : yes text file appear if i create it on dc1 or dc2

Did you read the article which I posted earlier and ran the command to compare the vector ID?
/showvector from dc1 show that:
DC1 USN 2583870 @ time 2017-11-1 22:45
DC2 USN 3068128 @ TIME 2017-11-1 22:42
and both number keep changing

/showvector from dc2 show that:
DC1 USN 2389556 @ time 2017-10-17 18:40 and that number did not change at all
DC2 USN 3068137 @ TIME 2017-11-1 22:45 that number keep changing

note both servers  in (users and computers - domain controller organisation unit) show that dc type GC
0
Radhakrishnan RSenior Technical LeadCommented:
Hi,

See your DC1 has lower value than DC2, so it's definitely falls under USN rollback. It may work for some time but can be completely broken at any point of time, so better demote and promote DC1.

Good luck
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
m musaAuthor Commented:
ok i'll demote and repromote  the dc1 but why sieze  not transfer, if i do transfer how to check if its done
0
Radhakrishnan RSenior Technical LeadCommented:
Hi,

You can try transfer but most of the time it won't work. Once you transferred 'netdom query fsmo' and see it's holds the correct server.
0
m musaAuthor Commented:
thank you :)
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.