TraineeGeek Posted July 21, 2015 Posted July 21, 2015 (edited) Hi, this week we've had workstations losing their trust with the domain, some multiple times a day. I looked in the Event Viewer on our 3 domain controllers and there were lots of errors reported by the win2003 server, replication errors. Event Type: Warning Event Source: NtFrs Event Category: None Event ID: 13508 Date: 18/07/2015 Time: 14:23:17 User: N/A Computer: DC Description: The File Replication Service is having trouble enabling replication from PDC to DC for c:\windows\sysvol\domain using the DNS name pdc.domain.town.sch.uk. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name PDC.domain.town.sch.uk from this computer. [2] FRS is not running on name.domain.town.sch.uk. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 21 07 00 00 !... ALSO Event Type: Error Event Source: NTDS Replication Event Category: Replication Event ID: 1864 Date: 20/07/2015 Time: 15:40:35 User: NT AUTHORITY\ANONYMOUS LOGON Computer: DC Description: This is the replication status for the following directory partition on the local domain controller. Directory partition: DC=ForestDnsZones,DC=domain,DC=town,DC=sch,DC=uk The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals. More than 24 hours: 2 More than a week: 2 More than one month: 2 More than two months: 2 More than a tombstone lifetime: 0 Tombstone lifetime (days): 180 Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled. To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe. You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency ". For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. It was always my intention to demote our Win2003 server today so that is what I did. I tried to run dcpromo but it errored with a logon failure, so I ran dcpromo /forceremove then removed entries in AD Comp & User and AD Sites & Services. Removed the NS from DNS then ran dcdiag.exe everything passed except for:- Starting test: SystemLog A warning event occurred. EventID: 0x000003F6 Time Generated: 07/21/2015 11:17:22 Event String: Name resolution for the name domain.town.sch.uk timed out af ter none of the configured DNS servers responded. A warning event occurred. EventID: 0x00001695 Time Generated: 07/21/2015 11:17:46 Event String: Dynamic registration or deletion of one or more DNS records associat ed with DNS domain 'domain.town.sch.uk.' failed. These records are used by other computers to locate this server as a domain controller (if the specifi ed domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition). ......................... PDC failed test SystemLog I'm wondering why we've got workstations randomly losing their trusts? Is AD healthy apart from the above error? Just got another losing trust The session setup from computer 'WIN7PWPSNB99' failed because the se curity database does not contain a trust account 'WIN7PWPSNB99$' referenced by t he specified computer. Many thanks TG Edited July 21, 2015 by TraineeGeek
3s-gtech Posted July 21, 2015 Posted July 21, 2015 Start by scouring DNS and AD for old entries. Your clients may be trying to use the old DC. Then start with ADSIEdit, start in the Default naming context and have a poke around. Then check the Configuration nodes for any errant entries. 1
featured_spectre Posted July 21, 2015 Posted July 21, 2015 We had this after we renamed a lot of machines due to moving rooms etc. We ended up taking them off the domain, clearing the DNS and ADUC, then re-added them. 1
ITGURU Posted July 21, 2015 Posted July 21, 2015 We had this after we renamed a lot of machines due to moving rooms etc. We ended up taking them off the domain, clearing the DNS and ADUC, then re-added them. When we rename machines, we change the name and put back on a workgroup. The Network ID wizard is then run to add back to the domain. Never had any problems doing it this way. 1
featured_spectre Posted July 21, 2015 Posted July 21, 2015 Normally I'd do this, but the person that actually renamed them didn't do that, so I've said in the future they should. 1
ITGURU Posted July 21, 2015 Posted July 21, 2015 Normally I'd do this, but the person that actually renamed them didn't do that, so I've said in the future they should. Also then means they'll show up in your new computers OU rather than being renamed in their existing OU, which you may want to move elsewhere to pick up different policies. 1
TraineeGeek Posted July 21, 2015 Author Posted July 21, 2015 Thanks, lots of sound advice. I need to change the way I do some things.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now