Netlogon Replication

[LansITGuy]

Morning all.

 

Just wondering if anyone has seen this before.

 

Two DCs (DC1 and DC2). Long standing AD servers. By chance I have noticed that netlogon replication is only working one way. If I add a file to \\DC1\Netlogon, it shows in DC2. If I add a file to \\DC2\Netlogon, that file does not show in DC1.

 

Adding via the \\\Netlogon path shows the file in DC2 and not DC1.

 

I've run a number of tests on DCDIAG and there seem to be no major issues. Yesterday, there were some DNS errors (RReg Failed), but following a restart, those issues are now cleared. After the restart, Netlogon changes were replicated correctly, but this morning, we are back to the same issue of files not going from DC1 to DC2.

 

Logins are running fine and I can't spot anything else out of the ordinary. In today's DCDIAG, the only warnings we are are:

 

A warning event occurred. EventID: 0x00009016

 

Time Generated: 02/08/2019 07:55:54

 

Event String:

 

No suitable default server credential exists on this system. This will prevent server applications that expect to make use of the system default credentials from accepting SSL connections. An example of such an application is the directory server. Applications that manage their own credentials, such as the internet information server, are not affected by this.

 

If I am right, this is because we have no CA in the domain. This has always been the case and shouldn't be an issue (right?).

 

Could anyone push me in the right direction here. Cheers!

[chris_uk]

Have a look in the event viewer, Application and Services Logs, look for DFS Replication. Do you have any errors on it?

Chris

[LansITGuy]

Thanks Chris. Forgot to include that bit.

Nothing unusual in the events for either server. The only time we have an error is during the restarting of the opposite server. As soon as both are back online the we get Event 5004 indicating that inbound connection is up on each server with it's partner.

[chris_uk]

Did you look at the DFS Replication in the event log? If a server has had a forced reboot like a hard power off the jet database will become bad and the files will not be copied between the netlogon shares.

Very easy to fix.

[LansITGuy]

There was an unexpected shutdown on the servers on 28/1/19. DC1 shows two events in quick succession:

 

Event: 2212

The DFS Replication service has detected an unexpected shutdown on volume C:. This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. The service has automatically initiated a recovery process. The service will rebuild the database if it determines it cannot reliably recover. No user action is required.

 

Additional Information:

Volume: C:

GUID: 15F82779-96D1-11E2-A44F-806E6F6E6963

 

Followed 4 seconds later by:

 

Event: 2214

The DFS Replication service successfully recovered from an unexpected shutdown on volume C:.This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. No user action is required.

 

Additional Information:

Volume: C:

GUID: 15F82779-96D1-11E2-A44F-806E6F6E6963

 

The next message happens during an intended restart whilst I've been researching this issue. I'm not seeing an indication of a Jet error.

[chris_uk]

Ok, you need to reset DFS so that it syncs. Before doing so please create a backup.

You will need to run in an elevated command prompt

 

C:\Windows\System32\wbem\WMIC.exe /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid="15F82779-96D1-11E2-A44F-806E6F6E6963" call ResumeReplication

 

It will take about 30 seconds before the files start syncing correctly.

[LansITGuy]

Thanks for the suggestion Chris. I've been stuck with other issues first, so haven't got to this yet, but I was just wondering about a few things before I do this.

 

1 - Do I run this on the server which does not seem to be in sync? DC1 has all the FMSO roles, but it is this server which seems to be incorrect. DC2 looks to have all the correct files.

 

2 - The only reference I've been able to find about the command you suggested is that it would be run after hotfix KB2663685. Based on Get-HotFix in PowerShell, this is not installed on either server.

 

wmic /NodeSpace:\\root\MicrosoftDFS path DFSRReplicatedFolderInfo get ReplicatedFolerName, State

 

For what its worth, running the following command on each server shows that SysVol is in state 4 (Normal). Not sure if that's any help or not.

 

I might be being a bit over cautious here, but I've never seen a Netlogon / SysVol replication issue before.

 

Thanks again for any advice!

[HPlum78]

Before running anything just run the following commands to check the sysvol share and DFR replication state.

 

For /f %i IN ('dsquery server -o rdn') do     @echo %i && @(net view \\%i | find "SYSVOL") & echo

 

For /f %i IN ('dsquery server -o rdn') do     @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo WHERE replicatedfoldername='SYSVOL share' get replicationgroupname,replicatedfoldername,state

 

(elevated command prompt)

 

i will dig out some more info and post when i get a few more mins, just put the output of the commands above on here before doing anything else as i have not seen any mention of event id 2213 and from memory that's what i would be looking for before running the command that has been noted above....

 

Ah now its all coming back to me, as i have just looked at event 2213 and your mention of kb2663685 so that's the reason you have not seen evt id 2213 as you have said you do not have the kb installed. So in you instance as the events are telling you DFS has automatically initiated the recovery.

 

Here is more info https://support.microsoft.com/en-gb/help/2846759/dfsr-event-id-2213-in-windows-server-2008-r2-or-windows-server-2012

Edited February 13, 2019 by HPlum78

[LansITGuy]

Thanks. Ran from my workstation and all looks normal.

 

For /f %i IN ('dsquery server -o rdn') do @echo %i && @(net view \\%i | find "SYSVOL") & echo

HC-ADC-01

SYSVOL Disk Logon server share

ECHO is on.

HC-ADC-02

SYSVOL Disk Logon server share

ECHO is on.

 

That is all of our DCs listed.

[HPlum78]

Did you take a look at the link above? Are you still experiencing issues?

[LansITGuy]

Did you take a look at the link above? Are you still experiencing issues?

 

Sorry, I did check the article, but just to clarify, we don't have any event 2213 entries in either DC's DFS event log.

 

Following the last unexpected shutdown (due to power loss) we see a 2212 warning followed by 2214 about 5 seconds later indicating that the replication service has successfully recovered from the unexpected shutdown.

 

Thanks again for any suggestions.