lafleur1977 Posted June 12, 2014 Posted June 12, 2014 Hello, I have been trying to demote one of our domain controllers but it failed and I received an error during the process "the parameter is incorrect". Great So I have been running dcdiag on the dc and have gotten the following output: Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = DC2 * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: domain\DC2 Starting test: Connectivity ......................... DC2 passed test Connectivity Doing primary tests Testing server: domain\DC2 Starting test: Advertising ......................... DC2 passed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC2 passed test FrsEvent Starting test: DFSREvent ......................... DC2 passed test DFSREvent Starting test: SysVolCheck ......................... DC2 passed test SysVolCheck Starting test: KccEvent ......................... DC2 passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DC2 passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DC2 passed test MachineAccount Starting test: NCSecDesc ......................... DC2 passed test NCSecDesc Starting test: NetLogons ......................... DC2 passed test NetLogons Starting test: ObjectsReplicated ......................... DC2 passed test ObjectsReplicated Starting test: Replications ......................... DC2 passed test Replications Starting test: RidManager ......................... DC2 passed test RidManager Starting test: Services ......................... DC2 passed test Services Starting test: SystemLog ......................... DC2 passed test SystemLog Starting test: VerifyReferences Some objects relating to the DC DC2 have problems: [1] Problem: Conflict Mangled Value Base Object: CN=DC2,CN=Servers,CN=domain,CN=Sites,CN=Configuration,DC=DC2 ,DC=lancs,DC=sch,DC=uk Base Object Description: "Server Object" Value Object Attribute: serverReference Value Object Description: "DC Account Object" Mangled Value: CN=DC2\0ACNF:c4d7004a-df88-4f1c-8354-b7727f02f823,OU=Domain Contro lers,DC=domain,DC=lancs,DC=sch,DC=uk Recommended Action: Check that there is not more than one DC Account Objects for this DC, and if so clean up the older duplicates. ......................... DC2 failed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : domain Starting test: CheckSDRefDom ......................... domain passed test CheckSDRefDom Starting test: CrossRefValidation ......................... domain passed test CrossRefValidation Running enterprise tests on : domain.lancs.sch.uk Starting test: LocatorCheck ......................... domain.lancs.sch.uk passed test LocatorCheck Starting test: Intersite ......................... domain.lancs.sch.uk passed test Intersite The verifyreferences test fails and inparticular I have noticed that the domain controllers name appears differently as it should be DC2 but it says CN=DC2\0ACNF:c4d7004a-df88-4f1c-8354-b7727f02f823. So I checked the OU its located in in AD and strangely enough its displayed as DC2CNF:c4d7004a-df88-4f1c-8354-b7727f02f823 but when I open the object its DNS and computer name are DC2. Would anybody be able to help me with this? Thanks
Michael Posted June 12, 2014 Posted June 12, 2014 This definitely looks like a computer object issue - either the SID you see is from another DC labelled DC2 or there used to another labelled DC2 which wasn't properly demoted. I'm also speculating that your existing DCs are not replicating correctly? Have you tried manually forcing a replication through Sites and Services? 1
lafleur1977 Posted June 12, 2014 Author Posted June 12, 2014 As far as I am aware replication between the other 2 DC's we have is fine although there are some replication warning in the dcdiag tests. I have forced a replication to the DC2 and it worked okay. I was looking at amending the cn attribute on the objects attribute editor but I am unsure of the consequences. Thanks
Michael Posted June 12, 2014 Posted June 12, 2014 I really wouldn't advise doing that. Is DC2 your role holder? If it isn't, I'd probably advise burflags, but then again it's odd that your replications are working... I can't quite work that one out. 1
kevin_lane Posted June 12, 2014 Posted June 12, 2014 What does sites and services say do they give you the propper name or its guid also do you have any issues with dns e.g can you see your SOA and its propper name any issues with pupils or staff logging on have you had any time sync problems 1
lafleur1977 Posted June 13, 2014 Author Posted June 13, 2014 I really wouldn't advise doing that. Is DC2 your role holder? If it isn't, I'd probably advise burflags, but then again it's odd that your replications are working... I can't quite work that one out. No DC2 isn't the role holder. It its GC but all the operations master roles are on a new server. I will have a look into burflags but it is odd as the replications appear to be working. Basically the reason behind this is that we noticed some slow downs with our Internet and was checking the logs on our router/proxy which indicated some errors communicating with DC2. Our proxy uses AD authentication to filter based on user group. So we turned authentication of and our internet performance improved. As we have two other DC's we decided that it would be best to try and demote DC2.
lafleur1977 Posted June 13, 2014 Author Posted June 13, 2014 What does sites and services say do they give you the propper name or its guid also do you have any issues with dns e.g can you see your SOA and its propper name any issues with pupils or staff logging on have you had any time sync problems Sites and services shows the proper name, DC2, however when I opened the properties it says invalid whereas our other two DC's show their name and domain. No DNS issues as far as I can see. I can see the SOA on each DC in DNS and each DC resolves the domain correctly displaying all DNS servers. No issues with logons or time. The only problem we are having is with our proxy possibly causing us intermittent slow downs for internet performance (see above reply). Thanks
lafleur1977 Posted June 13, 2014 Author Posted June 13, 2014 Hey guys, Thanks for your help. I have now fixed the problem by amending the entries for the server name in ADSI edit. The dcdiag report is now showing as all passed and I can dcpromo the server. In sites and services > DC2 > properties the fields are no longer invalid and are populated correctly. Thanks for your advise and pointing me in the right direction
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now