Replication issue

[jonathon28]

Had big problems when I came into work yesterday.

 

I think we have 2 issues:

 

Found out that the 2 domain controllers are not replicating with each other.

The 'computer password' that is authenticated against Active Directory is expiring after 30 days and making the machine fall off the domain.

 

It was exactly 30 days ago when I did an upgrade on the physical host with a new datastore. Restored the DC with VeeamZip and everything worked fine. Happy Days.

 

We have had issues with computers not logging on and falling off the domain since yesterday. Target account is invalid and trust relationship between this workstation and the domain controller has failed.

 

I've tried taking client off the domain and rejoining but it looks like it goes successfully but you get an error message after the 'Welcome to the *domain' saying target account invalid. It restarts and lets you log onto domain but the PC does not appear ANYWHERE in AD on the Primary DC but does on the Secondary DC.

 

I created a test user account on DC2 and it does not appear in DC1.

 

We have limited access. Some people are able to get on and access certain things.

 

When I've tried to force replication I get the message The destination and source sever is currently rejecting replication requests.

 

Any ideas?

[Domino]

You restored a DC? which one had the FSMO roles at the time?

 

If you've a working domain controller in the domain I'd never recommend restoring another, there's too much chance of issues when it comes back : Domain Controller Recovery

 

In all honesty, I'd say blow away the restored DC, remove it from AD using ADSIedit and then build a new server and DCpromo it.

[jonathon28]

Took the PDC off the host to upgrade storage on the physical server.

Added new storage, Created new RAID, Created new Datastore in VMWare. Restored PDC to host using VeeamZip.

Started dc1 back up.

Ran updates on all servers.

Everything has worked fine for the last 30 days. (Or appeared to)

 

DC1 has the FSMO roles.

DC1 is the only DNS server.

DC2 appears to be working fine.

 

Will I have to transfer FSMO roles to DC2 and make it a global catalogue server.

[Domino]

It could just be that it's tombstoned itself due to the restore - If you run repadmin /options on the two DCs does DISABLE_OUTBOUND_REPL or DISABLE_INBOUND_REPL appear?

[jonathon28]

This is what it says:

 

DC1 - IS-GC DISABLE_INBOUND-REPL DISABLE_OUTBOUND_REPL

 

DC2 - IS_GC

[Domino]

Okay, so they're both currently global catalogs, which is good.

 

But those options on DC1 means it's considered itself out of date, and stopped replication after being restored. If you're confident everything else is working properly, you can remove those options and see if it replicates properly with "repadmin /options -DISABLE_OUTBOUND_REPL" and "repadmin /options -DISABLE_INBOUND_REPL"

[jonathon28]

Sorry Domino, 'remove those options' by running those commands?

[Domino]

Yes, those commands will remove the replication disable on DC1, where is the server FQDN for DC1

[jonathon28]

Ok. So I've entered the commands you stated and I think everything is back to normal.

 

Is there a way I can check the replication is now working. Other than I have noticed that AD has now sync'd across and PCs are now joining the domain correctly.

[Domino]

if you run "repadmin /replsummary" it'll tell you the current delta, but likely be skewed by the large amount of fails lately - and 'repadmin /showrepl' will tell you the last replication results

[jonathon28]

That's great, Looks as if it's working. Thank you very much for your help. I imagined it being a lot worse and having 300 computers to re-add to a domain!