2008 r2 Replicated Domain Controller in an odd state after attempted bare metal migration.

Steven
Steven used Ask the Experts™
on
Hi Team,

I'm working on a project that involves utilizing VEEAM Agent to create bare metal backups and migrate them over to a new cloud data center. Everything so far has gone exceptional but as expected I've ran into an issue trying to migrate my secondary DC. After a few DNS issues we decided it was best to brig the old local DC VM back online. Things started working again but now the DCs are in a slightly different state.

I originally noticed a warning on my primary DC - "this server is the owner of FSMO but does not consider it valid". Also numerous errors on the primary about kerberos syncing to the secondary and that the secondary was not available / not the right name; etc. All of these issues, after Googling, pointed toward numerous different causes, so as dubious as I was I just decided to reboot both server; primary first, then secondary.

The strange part is now, replication works, I don't have any errors, and best practice analyzer isn't coughing anything up - but the secondary DC allows me to edit and modify DNS and ADUC records whereas before they were locked down, perhaps due to the replication rules. The records could only be edited from the primary DC.

I'm afraid this odd behavior is the result of a larger issues that I I'm unable to pin down. Should I be concerned? Everything seems to be working; new records replicate in both directions and SOA is incremented correctly.

Any advice or things to look for is appreciated. Also tips on migrating secondary virtual DCs is welcome.

Thank you
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
MaheshArchitect
Distinguished Expert 2018

Commented:
How many total Dcs you have?
what do you mean by secondary DC

If it is ADC, its not secondary DC

Can you run dcdiag /v on both Dcs from elevated cmd and post output here

also what is output of netdom query fsmo on both DCs, does output is same or different?
StevenSystems Administrator

Author

Commented:
@Mahesh

My primary DC is holds the FSMO roles and it's where I add ADUC entries, DNS, it does DHCP, and certs, etc. The secondary is just replicated from DC01 for ADUC and DNS. Nothing more.

FSMO

DC01

Schema master                      DC01
Domain naming master       DC01
PDC                                          DC01
RID pool manager                 DC01
Infrastructure master           DC01

The command completed successfully.

DC02 (Correction, in editing the outputs for censoring I accidentally entered the wrong DC name . These FSMO output are the same.)

Schema master                      DC01
Domain naming master        DC01
PDC                                          DC01
RID pool manager                  DC01
Infrastructure master            DC01

The command completed successfully.


DCDIAG /V


DC01 and DC02 are attached. Please let me know if I should copy / paste the results here.
I did my best to remove any identifiable information. Let me know if I missed anything.

Thank you
dc01_dcdiag.txt
dc02_dcdiag.txt
StevenSystems Administrator

Author

Commented:
If the machine you attempted to moved had the FSMO roles already on it, and you attempted to restore the machine to a new environment then you had two machines with the same FSMO roles on your network. This would cause the type of conflict you are describing. You can only have One of each of the FSMO roles on your network or your domain will not function properly.

That technically shouldn't have been the case since I was moving the secondary DC, DC02. DC01 should have retained all FSMO roles since it wasn't touched.
Architect
Distinguished Expert 2018
Commented:
dcdiag showing clean output

Your statement is confusing
The strange part is now, replication works, I don't have any errors, and best practice analyzer isn't coughing anything up - but the secondary DC allows me to edit and modify DNS and ADUC records whereas before they were locked down, perhaps due to the replication rules. The records could only be edited from the primary DC.

Since this is PDC and ADC scenario, you must be able to modify dns on both servers? don't you?
If you are not able to, then its issue

If now AD replication is OK (from dcdiag OP) and if dns is able to modify on both servers, just keep both servers under observations and ensure you are able to modify dns on both servers all the time and no action is required
StevenSystems Administrator

Author

Commented:
Thank you experts. I will monitor my DCs for any more issues.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial