Primary Domain Controller not replicating SYSVOL to Secondary Domain Controller

[datar]

Hi Guys,

 

I'm getting an issue in a few schools now where there can be a Windows Server 2008 R2/2012 primary domain controller, and I have added a second using Hyper-V 2012 or 2012 R2.

 

However the secondary domain controller doesn't advertise due to the fact that the SYSVOL folders aren't replicating from the PDC onto the SDC.

 

One school had this issue with 2008 R2 to 2012 R2 and I managed to resolve it by flushing the DNS, restarting the DNS and Netlogon services on both servers. Since then this has worked a treat.

 

However some schools have 2012 and 2012 R2 and yet they aren't replicating the SYSVOL folder. Trying my previous solution on this isn't working in this case.

 

These domain controllers are nothing special.

 

Most are standalone servers running roles such as AD, DHCP, DNS and WDS

Some are virtualised on VMware Esxi 5.1/5.3 which were trying to move away from.

 

I've tried commands such as DCDIAG /FIX and REPADMIN /SYNCALL.

 

However I did "DCDIAG /test:CheckSecurityStatus /source:DC1" and I got the error telling me that it didn't respond, which kind of leads me to think it is an issue with the PDC.

 

I am also wondering if any one else has had any issues similar to this using Server 2012 products. I have tried to replicate the error in a virtual lab on Hyper-V and VMware, but I only have issues when I use Esxi 5.1 hosting 2012. Our Esxi 5.1 servers have 2008 R2 on them for the most part.

[HPlum78]

If you can run DCDiag /test:DNS /v /e > C:\DCDiagTest.txt and send the output file to me I will take a look and see if I can shed some light on it.

[datar]

Sorry for the delay, got a free second to run the test at the site I wanted.

 

This is the result, real names obfuscated.

 

DCDIAGTEST.txt

[Michael]

Hi Guys,

 

I'm getting an issue in a few schools now where there can be a Windows Server 2008 R2/2012 primary domain controller, and I have added a second using Hyper-V 2012 or 2012 R2.

 

However the secondary domain controller doesn't advertise due to the fact that the SYSVOL folders aren't replicating from the PDC onto the SDC.

 

One school had this issue with 2008 R2 to 2012 R2 and I managed to resolve it by flushing the DNS, restarting the DNS and Netlogon services on both servers. Since then this has worked a treat.

 

However some schools have 2012 and 2012 R2 and yet they aren't replicating the SYSVOL folder. Trying my previous solution on this isn't working in this case.

 

These domain controllers are nothing special.

 

Most are standalone servers running roles such as AD, DHCP, DNS and WDS

Some are virtualised on VMware Esxi 5.1/5.3 which were trying to move away from.

 

I've tried commands such as DCDIAG /FIX and REPADMIN /SYNCALL.

 

However I did "DCDIAG /test:CheckSecurityStatus /source:DC1" and I got the error telling me that it didn't respond, which kind of leads me to think it is an issue with the PDC.

 

I am also wondering if any one else has had any issues similar to this using Server 2012 products. I have tried to replicate the error in a virtual lab on Hyper-V and VMware, but I only have issues when I use Esxi 5.1 hosting 2012. Our Esxi 5.1 servers have 2008 R2 on them for the most part.

 

It's odd you have this across a few sites. I have many sites with multiple 2008 R2 Servers replicating without any issues.

 

One thing that springs to mind is the firewall built into Windows Server. You're most likely behind a managed firewall, so it should be safe to switch it off or even better, force it off with a GPO.

 

Presumably DNS is working correctly and DNS is replicating between both servers? This is one of the most common reasons why replications fail.

 

I presume also your Domain and Forest Functional levels are 2008 R2, seeing as you have a mixed 2008 R2, 2012 and 2012 R2 servers.

 

Have you tried setting up another 2012 or 2012 R2 server at one site (physical or virtual) to test whether they replicate OK?

[datar]

We have various setups as each member of staff sets up something in their own flavour. I.e VMware rather than Hyper-V

 

The majority of our sites run Server 2012 now. And we only have issues between 2012 to 2012/2012 R2 setups at the moment.

 

Some of our older setups run on Server 2008, 2008 R2 and have no issues replicating to Server 2012/2012 R2.

 

We seem to think it's an issue with SMB 3.0 in 2012 and VMware, as it mostly our VMware ESXI setup that have this issue.

 

We have tested this in Hyper-V and we have no issues with replication, Physical to Virtual also runs without a hitch. It only seems to be Virtual to Virtual when we are using a VMware Hypervisor and a Hyper-V Platform.

 

We do have one school with an old HP Tower Server running Server 2012 and it doesn't replicate to a Server 2012 R2 which is on Hyper-V 2012 R2.

 

Edit: Forgot to mention that our servers do have Firewalls disabled. As we have our own or use LEA firewalls.

Edited October 24, 2013 by datar
Firewalls

[HPlum78]

I seem to remember reading about version numbers for VMWare and various server editions sometime ago, a patch was released to solve replication issues. I will have a dig about when I get a min, problem is I no longer use VMWare kit so it will have been a passing interest rather than me needing to know!

[datar]

I seem to remember reading about version numbers for VMWare and various server editions sometime ago, a patch was released to solve replication issues. I will have a dig about when I get a min, problem is I no longer use VMWare kit so it will have been a passing interest rather than me needing to know!

 

Any insight will be greatly appriciated. It's just frustrating at times seeing these systems configured correctly but not working as expected.

 

We have just migrated one site from a 2008 R2 to a 2012 R2 domain without any issues from VMware to Hyper-V which makes me think more of it being an issue with SMB 3.0 in 2012 running on VMware.

[Michael]

Windows Server 2012 is fully supported on ESXi 5.1, but you could also try ESXi 5.5. Personally however I think Hyper-V is the way to go. It's made by Microsoft themselves, so you're inevitably going to have less problems when performing OS upgrades from say 2008 R2 to 2012 R2.