Techdw Posted October 31, 2014 Posted October 31, 2014 Guys, I seem to have a problem with my MainDC1, Group policy do not pull across and I get the following shown in the screen shots. I can ping the DC from any PC and I can ping any other server from the MainDC1. Any help would be great. Thanks
Techdw Posted November 1, 2014 Author Posted November 1, 2014 Yeah, Netlogon errors Log Name: System Source: NETLOGON Date: 01/11/2014 02:07:11 Event ID: 5722 Task Category: None Level: Error Keywords: Classic User: N/A Computer: DC1.DOMAIN NAME.local Description: The session setup from the computer COMPUTER01 failed to authenticate. The name(s) of the account(s) referenced in the security database is COMPUTER01$. The following error occurred: Access is denied. Event Xml: 5722 2 0 0x80000000000000 69685 System DC1.domain.local COMPUTER01 COMPUTER01$ %%5 220000C0
ful56_uk Posted November 1, 2014 Posted November 1, 2014 What os are the dc's Also have you run dcdiag
Techdw Posted November 1, 2014 Author Posted November 1, 2014 (edited) Microsoft Windows [Version 6.2.9200] © 2012 Microsoft Corporation. All rights reserved. C:\Users\administrator.DOMAIN>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = DC1 * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: DOMAIN\DC1 Starting test: Connectivity ......................... DC1 passed test Connectivity Doing primary tests Testing server: DOMAIN\DC1 Starting test: Advertising ......................... DC1 passed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC1 passed test FrsEvent Starting test: DFSREvent ......................... DC1 passed test DFSREvent Starting test: SysVolCheck ......................... DC1 passed test SysVolCheck Starting test: KccEvent A warning event occurred. EventID: 0x80000B46 Time Generated: 11/01/2014 07:51:57 Event String: The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a cleartext (non-SSL/TLS-encrypted) connection. E ven if no clients are using such binds, configuring the server to reject them wi ll improve the security of this server. ......................... DC1 passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DC1 passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DC1 passed test MachineAccount Starting test: NCSecDesc ......................... DC1 passed test NCSecDesc Starting test: NetLogons ......................... DC1 passed test NetLogons Starting test: ObjectsReplicated ......................... DC1 passed test ObjectsReplicated Starting test: Replications ......................... DC1 passed test Replications Starting test: RidManager ......................... DC1 passed test RidManager Starting test: Services ......................... DC1 passed test Services Starting test: SystemLog A warning event occurred. EventID: 0x000727A5 Time Generated: 11/01/2014 07:49:27 Event String: The WinRM service is not listening for WS-Management requests. A warning event occurred. EventID: 0x80050004 Time Generated: 11/01/2014 07:51:39 Event String: Broadcom NetXtreme Gigabit Ethernet: The network link is down. Chec k to make sure the network cable is properly connected. A warning event occurred. EventID: 0x80050004 Time Generated: 11/01/2014 07:51:39 Event String: Broadcom NetXtreme Gigabit Ethernet #2: The network link is down. C heck to make sure the network cable is properly connected. A warning event occurred. EventID: 0x00001796 Time Generated: 11/01/2014 07:52:04 Event String: Microsoft Windows Server has detected that NTLM authentication is pr esently being used between clients and this server. This event occurs once per b oot of the server on the first time a client uses NTLM with this server. A warning event occurred. EventID: 0x000003F6 Time Generated: 11/01/2014 07:52:14 Event String: Name resolution for the name _ldap._tcp.DOMAIN._sites.ForestDnsZo nes.DOMAIN.local. timed out after none of the configured DNS server s responded. A warning event occurred. EventID: 0x00002724 Time Generated: 11/01/2014 07:52:16 Event String: This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses. A warning event occurred. EventID: 0x00001795 Time Generated: 11/01/2014 07:52:27 Event String: The program lsass.exe, with the assigned process ID 568, could not a uthenticate locally by using the target name ldap/ForestDnsZones.DOMAIN.local. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name. An error event occurred. EventID: 0x0000165B Time Generated: 11/01/2014 07:52:55 Event String: The session setup from computer 'COMPUTER01' failed because the securit y database does not contain a trust account 'COMPUTER01$' referenced by the specifi ed computer. A warning event occurred. EventID: 0x00001696 Time Generated: 11/01/2014 07:52:57 Event String: Dynamic registration or deregistration of one or more DNS records fa iled with the following error: An error event occurred. EventID: 0x000016AD Time Generated: 11/01/2014 07:55:00 Event String: The session setup from the computer COMPUTER01 failed to authenticate. The following error occurred: An error event occurred. EventID: 0x00000457 Time Generated: 11/01/2014 07:59:02 Event String: Driver PRINTERRM01 required for printer !!PRINTSERVER .DOMAIN.local!PRINTERRM02 is unknown. Contact the adminis trator to install the driver before you log in again. ......................... DC1 failed test SystemLog Starting test: VerifyReferences ......................... DC1 passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : DOMAIN Starting test: CheckSDRefDom ......................... DOMAIN passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DOMAIN passed test CrossRefValidation Running enterprise tests on : DOMAIN.local Starting test: LocatorCheck ......................... DOMAIN.local passed test LocatorCheck Starting test: Intersite ......................... DOMAIN.local passed test Intersite C:\Users\administrator.DOMAIN>netdiag /fix 'netdiag' is not recognized as an internal or external command, operable program or batch file. C:\Users\administrator.DOMAIN>dcdiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = DC1 * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: DOMAIN\DC1 Starting test: Connectivity ......................... DC1 passed test Connectivity Doing primary tests Testing server: DOMAIN\DC1 Starting test: Advertising ......................... DC1 passed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC1 passed test FrsEvent Starting test: DFSREvent ......................... DC1 passed test DFSREvent Starting test: SysVolCheck ......................... DC1 passed test SysVolCheck Starting test: KccEvent ......................... DC1 passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DC1 passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DC1 passed test MachineAccount Starting test: NCSecDesc ......................... DC1 passed test NCSecDesc Starting test: NetLogons ......................... DC1 passed test NetLogons Starting test: ObjectsReplicated ......................... DC1 passed test ObjectsReplicated Starting test: Replications ......................... DC1 passed test Replications Starting test: RidManager ......................... DC1 passed test RidManager Starting test: Services ......................... DC1 passed test Services Starting test: SystemLog ......................... DC1 passed test SystemLog Starting test: VerifyReferences ......................... DC1 passed test VerifyReferences Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : DOMAIN Starting test: CheckSDRefDom ......................... DOMAIN passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DOMAIN passed test CrossRefValidation Running enterprise tests on : DOMAIN.local Starting test: LocatorCheck ......................... DOMAIN.local passed test LocatorCheck Starting test: Intersite ......................... DOMAIN.local passed test Intersite Edited November 1, 2014 by Techdw
MrKJLS Posted November 1, 2014 Posted November 1, 2014 What's your firewall configuration like? Have you tried it with the firewall switched off?
MrKJLS Posted November 1, 2014 Posted November 1, 2014 Already tried turning the firewall off Is that on both sides DC1 and DC2?
Techdw Posted November 1, 2014 Author Posted November 1, 2014 Is that on both sides DC1 and DC2? Yes, on DC1 and DC2
MrKJLS Posted November 1, 2014 Posted November 1, 2014 How are they configured in the AD Sites and Services?
Techdw Posted November 1, 2014 Author Posted November 1, 2014 Just noticed this as well. Pic attached
MrKJLS Posted November 1, 2014 Posted November 1, 2014 (edited) Have you tried GPRESULT /H ? Also how is your DNS configured, that can cause issues sometimes. I found this article on TechNet about SID translation issue - Troubleshooting SID translation failures from the obvious to the not so obvious - Ask the Directory Services Team - Site Home - TechNet Blogs Edited November 1, 2014 by MrKJLS
Techdw Posted November 1, 2014 Author Posted November 1, 2014 AD Sites and Services, DC1 replication with DC2 DC2 replication with DC1 Both are global Catalogues
3s-gtech Posted November 2, 2014 Posted November 2, 2014 Is your JET database replicating correctly between the DCs? On 2012 this breaks all the damn time, and has to be manually restarted unless you change some settings. When it breaks, replication stops and your DCs play up. Event logs should show it. 2012 R2 DCs don't suffer from this in the same way (they auto fix the issue).
gjefferies Posted November 10, 2014 Posted November 10, 2014 Looks like a DNS issue to me, are your DCs configured as DNS Servers? Have you pointed them to each other for DNS?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now