asked on vent IDs 1869 ,1655 ,1869, 1126 Global Catalog errors on main DC
Hi,
On my main DC (PDC) I have started to sporadically get event ID 1869 ,1655 ,1869, 1126 global catalog errors They last for a few hours, once an hour
The only changes that I recently did were added a self signed certificate to that DC. (I did it to try and configure LDAPS) and upgraded DFL/FFL from 2003 to 2008R2
I did repadmin/ replsum and everything looks good. I dont hear any complaints from end users. This is the only DC that I am getting these errors on.
What could be causing these errors?
I have attached the errors in even viewer.
Thank you.
gc_error.PNG
On my main DC (PDC) I have started to sporadically get event ID 1869 ,1655 ,1869, 1126 global catalog errors They last for a few hours, once an hour
The only changes that I recently did were added a self signed certificate to that DC. (I did it to try and configure LDAPS) and upgraded DFL/FFL from 2003 to 2008R2
I did repadmin/ replsum and everything looks good. I dont hear any complaints from end users. This is the only DC that I am getting these errors on.
What could be causing these errors?
I have attached the errors in even viewer.
Thank you.
gc_error.PNG
* LDAPSActive DirectoryDNSWindows Server 2008
Last Comment
Mahesh
ASKER
Thank you Mahesh.
Yesterday I restarted the KDC service on all the DC's and that seemed to have fixed the problem. I dont see the event errors anymore.
It sounds a little similar to this article.
https://www.urtech.ca/2011/08/solved-an-authenication-error-has-occured-the-encryption-type-requested-is-not-supported-by-the-kdc/
Can I assume that it wont come back?
Yesterday I restarted the KDC service on all the DC's and that seemed to have fixed the problem. I dont see the event errors anymore.
It sounds a little similar to this article.
https://www.urtech.ca/2011/08/solved-an-authenication-error-has-occured-the-encryption-type-requested-is-not-supported-by-the-kdc/
Can I assume that it wont come back?
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
If server holding PDC FSMO role, you can transfer FSMO to other DC and run below command to check if successful:
nltest /dsgetdc:domain.com
nltest /dclist:domain.com
nltest /sc_Query:domain.com
nltest /sc_verify:domain.com
if last two commands fails, you can run:
nltest /sc_reset:domain.com
nltest /sc_Change_Pwd:domain.com
If command successful, check directory service event logs for successful GC located and ignore previous error messages