Leon Nichols
asked on
Seized FSMO roles did not replicate to second DC
Had and old SBS server that died. I seized the FSMO roles from the old SBS to the new DC. However our remote site 2012 r2 server still shows the old SBS server as the FSMO holder and thus having all kinds of replication issues.
Would the best / easiest option be to demote the remote DC and re-join it to the domain? Or is there some way to get it to see the changes to the FSMO without it trying to take the roles itself using ntdsutil?
Would the best / easiest option be to demote the remote DC and re-join it to the domain? Or is there some way to get it to see the changes to the FSMO without it trying to take the roles itself using ntdsutil?
ASKER
Yes I did specify the replacement. On the new server it shows proper:
C:\Windows\system32>netdom query fsmo
Schema master SM-SRV-DC.specialty.local
Domain naming master SM-SRV-DC.specialty.local
PDC SM-SRV-DC.specialty.local
RID pool manager SM-SRV-DC.specialty.local
Infrastructure master SM-SRV-DC.specialty.local
The command completed successfully.
However on the remote server it looks like this:
C:\Windows\system32>netdom query fsmo
Schema master SM-SRV-DC.specialty.local
Domain naming master SM-SRV-SBS.specialty.local
PDC SM-SRV-SBS.specialty.local
RID pool manager SM-SRV-DC.specialty.local
Infrastructure master SM-SRV-DC.specialty.local
The command completed successfully.
C:\Windows\system32>netdom
Schema master SM-SRV-DC.specialty.local
Domain naming master SM-SRV-DC.specialty.local
PDC SM-SRV-DC.specialty.local
RID pool manager SM-SRV-DC.specialty.local
Infrastructure master SM-SRV-DC.specialty.local
The command completed successfully.
However on the remote server it looks like this:
C:\Windows\system32>netdom
Schema master SM-SRV-DC.specialty.local
Domain naming master SM-SRV-SBS.specialty.local
PDC SM-SRV-SBS.specialty.local
RID pool manager SM-SRV-DC.specialty.local
Infrastructure master SM-SRV-DC.specialty.local
The command completed successfully.
I'd go with the output from the remaining DC...the one you're replacing the SBS server with.
ASKER
The issues is I need to have the remote server see the new FSMO roles master on the PDC and Domain Naming Master. Right now users at the remote site cannot access anything on the server at the main site. Getting The Target account name is incorrect which would normally be DNS issues but I have checked dns and I can access the drives by IP.
Also when I check Active Directory Replication I get errors that the server is unreachable pointing to the old sbs server.
Also when I check Active Directory Replication I get errors that the server is unreachable pointing to the old sbs server.
Ah I see what you're saying sorry I'm a little slow on the uptake apparently. What errors do you get when running repadmin /syncall from both DCs? Any chance you can just spin up a new DC in the same site as the SBS DC?
Run DCDIAG /C /E /V on BOTH DCs and fix any errors found that are not expected.
Clean out ALL references to the SBS server and it's IP (hopefully you didn't try to reuse the SBS IP).
Clean out ALL references to the SBS server and it's IP (hopefully you didn't try to reuse the SBS IP).
Would the best / easiest option be to demote the remote DC and re-join it to the domain? Or is there some way to get it to see the changes to the FSMO without it trying to take the roles itself using ntdsutil?Yes, quick to rebuild.
You can also try:
Stop KCC
Run NETDOM RESETPWD
Start KCC
ASKER
Sorry for the late update, had other things to attend to.
Lee, I will try running the DCDIAG on both shortly to see what shows up and post back.
Lee, I will try running the DCDIAG on both shortly to see what shows up and post back.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Shawn,
Originally I had issues opening DNS, was getting Access Denied so I performed the KCC steps you mentioned which got me access back to DNS but still showed incorrect FSMO information.
If DCDIAG shows too may error will most likely go with the rebuild.
Originally I had issues opening DNS, was getting Access Denied so I performed the KCC steps you mentioned which got me access back to DNS but still showed incorrect FSMO information.
If DCDIAG shows too may error will most likely go with the rebuild.
What does repadmin /showrepl show on the remote DC? Specifically, how long has it been since the last successful replication?
Instead of
repadmin /showrepl
runrepadmin /showrepl * > out.txt
and post out.txt
ASKER
Sorry for the delay in getting back to everyone. Surprising to me I went ahead and tried running
Stop KCC
Run NETDOM RESETPWD
Start KCC
For a second time and it worked. Don't know why the first time I ran it did not fix everything but the second time did correct the issue and replication between the DC's worked.
Thank you everyone!
Stop KCC
Run NETDOM RESETPWD
Start KCC
For a second time and it worked. Don't know why the first time I ran it did not fix everything but the second time did correct the issue and replication between the DC's worked.
Thank you everyone!
netdom query fsmo