Link to home
Start Free TrialLog in
Avatar of tp-it-team
tp-it-team

asked on

Some Domain Controller concerns

Hello
Recently I had a strange situation where one of my DCs didn't have a current copy of Group Policy objects so PCs authenticating to it didn't behave as expected. Took me some time to figure it out. I restarted the problematic DC (and after that, 2 others) and everything went back to normal.
Now I have a folder:
\\dc\SYSVOL\domain\NtFrs_PreExisting___See_EventLog
on 2 of my 3 DCs but afaik, everything is replicating properly.

I could not find a reason for it yet.

What should I do ?

Also, I did dns check and everything is fine but I have some warnings related to missing AAAA records for domain controllers. Should I just ignore it ? I don't really want to disable ipv6 as I read a lot conflicting advices - some people say disable, some - do not.

Thanks
Avatar of Robert
Robert
Flag of United States of America image

First the easy one, If your not using IPV6 disable it as it does you no good. I always disable it on all machines as we do not use it in my environment.

I would recommend running dcdiag and repadmin to try to find where your issues are. Those tools are the best method for identifying AD replication issues. 
If you have missing A records then it can cause issues. Double check in DNS and verify if the record exist and is correct.
I would think you would be having a lot of issues if you were actually missing a DNS record.
Another thing to check is that there isn't a time difference between the DC's.

Avatar of tp-it-team
tp-it-team

ASKER

dcdiag only fails on rodc test, and system log test on one of the Dcs but that's due to some non critical errors. repadmin /replsummary shows no errors. All A records are present, just AAAA records missing.
No time difference and time synchronisation works all right.
Are there any recent errors in the FRS event logs of any of your DCs? Note that there could be errors stemming from the reboots, but if you see anything unusual in there, feel free to post it here.

The NtFrs_PreExisting___See_EventLog folder is a sort of conflict-resolution mechanism. Its presence indicates that there was a problem with FRS at one time, but it's most likely been resolved now. Stuff that was in the normal FRS folder hierarchy at the time the issue was resolved has been moved to the NtFrs_PreExisting___See_EventLog folder hierarchy, as a sort of backup in case there's something important in there that would have otherwise been overwritten.

You can ignore those folders for now. If you discover something missing from FRS that should be there (a Group Policy template file or script file, for example), you can dig through NtFrs_PreExisting___See_EventLog to see if it's in there.

OK, so I found event 13559 followed by 13508 until I rebooted all my DCs one by one. The error stopped about month ago and I didnt experience any problems which could indicate inconsistent Group Policy.
I found this article https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/ntfrs-error-event-13559-replication-stops which says, in a nutshell, that I should move away from FRS which I'm actually doing at the moment.
That article also mentions creating empty file NTFRS_CMD_FILE_MOVE_ROOT but since 1 month passed, I'm not going to do it.

In that case, can I just safely delete (or move) NtFrs_PreExisting___See_EventLog folder using explorer ? Or is the process more complicated ?
Sorry for taking so long to respond. Yes, you can delete it through File Explorer (storing a copy somewhere first if you want to be extra cautious), or you can leave it as-is. It's not hurting anything, although it does take up a little space.

Hi
I tried to copy these files into safe location and then delete but doing both things, I get an error saying that I need to be an administrator to do it, even if I'm logged as domain admin. Any ideas ?
Have you tried taking ownership of the files, or  from a CMD or Powershell prompt with run-as-admin or take ownership perhaps, i.e. right click folder, advanced, change owner..
Yes, I know that normally you should try these things, but we are talking a special case here so I would rather not experiment but hear from someone who knows the process and can say for sure.
ASKER CERTIFIED SOLUTION
Avatar of Steve Knight
Steve Knight
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial