Avatar of Steven
Steven
 asked on

2008 r2 Replicated Domain Controller in an odd state after attempted bare metal migration.

Hi Team,

I'm working on a project that involves utilizing VEEAM Agent to create bare metal backups and migrate them over to a new cloud data center. Everything so far has gone exceptional but as expected I've ran into an issue trying to migrate my secondary DC. After a few DNS issues we decided it was best to brig the old local DC VM back online. Things started working again but now the DCs are in a slightly different state.

I originally noticed a warning on my primary DC - "this server is the owner of FSMO but does not consider it valid". Also numerous errors on the primary about kerberos syncing to the secondary and that the secondary was not available / not the right name; etc. All of these issues, after Googling, pointed toward numerous different causes, so as dubious as I was I just decided to reboot both server; primary first, then secondary.

The strange part is now, replication works, I don't have any errors, and best practice analyzer isn't coughing anything up - but the secondary DC allows me to edit and modify DNS and ADUC records whereas before they were locked down, perhaps due to the replication rules. The records could only be edited from the primary DC.

I'm afraid this odd behavior is the result of a larger issues that I I'm unable to pin down. Should I be concerned? Everything seems to be working; new records replicate in both directions and SOA is incremented correctly.

Any advice or things to look for is appreciated. Also tips on migrating secondary virtual DCs is welcome.

Thank you
VirtualizationStorage SoftwareWindows Server 2008DNSActive Directory

Avatar of undefined
Last Comment
Steven

8/22/2022 - Mon
Mahesh

How many total Dcs you have?
what do you mean by secondary DC

If it is ADC, its not secondary DC

Can you run dcdiag /v on both Dcs from elevated cmd and post output here

also what is output of netdom query fsmo on both DCs, does output is same or different?
Steven

ASKER
@Mahesh

My primary DC is holds the FSMO roles and it's where I add ADUC entries, DNS, it does DHCP, and certs, etc. The secondary is just replicated from DC01 for ADUC and DNS. Nothing more.

FSMO

DC01

Schema master                      DC01
Domain naming master       DC01
PDC                                          DC01
RID pool manager                 DC01
Infrastructure master           DC01

The command completed successfully.

DC02 (Correction, in editing the outputs for censoring I accidentally entered the wrong DC name . These FSMO output are the same.)

Schema master                      DC01
Domain naming master        DC01
PDC                                          DC01
RID pool manager                  DC01
Infrastructure master            DC01

The command completed successfully.


DCDIAG /V


DC01 and DC02 are attached. Please let me know if I should copy / paste the results here.
I did my best to remove any identifiable information. Let me know if I missed anything.

Thank you
dc01_dcdiag.txt
dc02_dcdiag.txt
Steven

ASKER
If the machine you attempted to moved had the FSMO roles already on it, and you attempted to restore the machine to a new environment then you had two machines with the same FSMO roles on your network. This would cause the type of conflict you are describing. You can only have One of each of the FSMO roles on your network or your domain will not function properly.

That technically shouldn't have been the case since I was moving the secondary DC, DC02. DC01 should have retained all FSMO roles since it wasn't touched.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
ASKER CERTIFIED SOLUTION
Mahesh

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Steven

ASKER
Thank you experts. I will monitor my DCs for any more issues.