2008 r2 Replicated Domain Controller in an odd state after attempted bare metal migration.

Hi Team,

I'm working on a project that involves utilizing VEEAM Agent to create bare metal backups and migrate them over to a new cloud data center. Everything so far has gone exceptional but as expected I've ran into an issue trying to migrate my secondary DC. After a few DNS issues we decided it was best to brig the old local DC VM back online. Things started working again but now the DCs are in a slightly different state.

I originally noticed a warning on my primary DC - "this server is the owner of FSMO but does not consider it valid". Also numerous errors on the primary about kerberos syncing to the secondary and that the secondary was not available / not the right name; etc. All of these issues, after Googling, pointed toward numerous different causes, so as dubious as I was I just decided to reboot both server; primary first, then secondary.

The strange part is now, replication works, I don't have any errors, and best practice analyzer isn't coughing anything up - but the secondary DC allows me to edit and modify DNS and ADUC records whereas before they were locked down, perhaps due to the replication rules. The records could only be edited from the primary DC.

I'm afraid this odd behavior is the result of a larger issues that I I'm unable to pin down. Should I be concerned? Everything seems to be working; new records replicate in both directions and SOA is incremented correctly.

Any advice or things to look for is appreciated. Also tips on migrating secondary virtual DCs is welcome.

Thank you
StevenSystems AdministratorAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MaheshArchitectCommented:
How many total Dcs you have?
what do you mean by secondary DC

If it is ADC, its not secondary DC

Can you run dcdiag /v on both Dcs from elevated cmd and post output here

also what is output of netdom query fsmo on both DCs, does output is same or different?
StevenSystems AdministratorAuthor Commented:
@Mahesh

My primary DC is holds the FSMO roles and it's where I add ADUC entries, DNS, it does DHCP, and certs, etc. The secondary is just replicated from DC01 for ADUC and DNS. Nothing more.

FSMO

DC01

Schema master                      DC01
Domain naming master       DC01
PDC                                          DC01
RID pool manager                 DC01
Infrastructure master           DC01

The command completed successfully.

DC02 (Correction, in editing the outputs for censoring I accidentally entered the wrong DC name . These FSMO output are the same.)

Schema master                      DC01
Domain naming master        DC01
PDC                                          DC01
RID pool manager                  DC01
Infrastructure master            DC01

The command completed successfully.


DCDIAG /V


DC01 and DC02 are attached. Please let me know if I should copy / paste the results here.
I did my best to remove any identifiable information. Let me know if I missed anything.

Thank you
dc01_dcdiag.txt
dc02_dcdiag.txt
StevenSystems AdministratorAuthor Commented:
If the machine you attempted to moved had the FSMO roles already on it, and you attempted to restore the machine to a new environment then you had two machines with the same FSMO roles on your network. This would cause the type of conflict you are describing. You can only have One of each of the FSMO roles on your network or your domain will not function properly.

That technically shouldn't have been the case since I was moving the secondary DC, DC02. DC01 should have retained all FSMO roles since it wasn't touched.
MaheshArchitectCommented:
dcdiag showing clean output

Your statement is confusing
The strange part is now, replication works, I don't have any errors, and best practice analyzer isn't coughing anything up - but the secondary DC allows me to edit and modify DNS and ADUC records whereas before they were locked down, perhaps due to the replication rules. The records could only be edited from the primary DC.

Since this is PDC and ADC scenario, you must be able to modify dns on both servers? don't you?
If you are not able to, then its issue

If now AD replication is OK (from dcdiag OP) and if dns is able to modify on both servers, just keep both servers under observations and ensure you are able to modify dns on both servers all the time and no action is required

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
StevenSystems AdministratorAuthor Commented:
Thank you experts. I will monitor my DCs for any more issues.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Virtualization

From novice to tech pro — start learning today.