Server 2019 DC - Issues

[CHiLL]

A couple of months ago, after a bunch of research I did an in-place upgrade on our physical DC (DC1) from Server 2012 R2 to Server 2019 (this is not our PDC). It went well and the server/domain functioned correctly. During the half term I did an in-place upgrade of DC2, our PDC VM, from 2012 R2 to 2019 and the function level was increased from 2012 R2 to 2016. The domain seemed to function correctly until yesterday when a couple of issues started occurring.

 

Firstly, we have Always-On VPN configured and I am not able to get the certificate to automatically enrol for the user. This has worked perfectly until now and it is showing the following message in the event log on the client:

Certificate enrollment for  failed in authentication to all urls for enrollment server associated with policy id: {2F1553CE-7833-423E-BF60-2F04FE7ADC15} (The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)). Failed to enroll for template: VPNUsers

 

I queried which DC the device was connecting to, and it was DC1. I logged onto DC1 and checked the logs and these were being shown:

Level: Warning. Source: Browser. EventID 8021.
The browser service was unable to retrieve a list of servers from the browser master \\DC2 on the network \Device\NetBT_Tcpip_{993D5DD2-7A4A-4669-B78E-7241C01886C9}.

Browser master: \\DC2
Network: \Device\NetBT_Tcpip_{993D5DD2-7A4A-4669-B78E-7241C01886C9}

This event may be caused by a temporary loss of network connectivity. If this message appears again, verify that the server is still connected to the network. The return code is in the Data text box.

The above error only appears on DC1, DC2 is fine.

 

I did notice that DC1 had turned UAC back on, despite it had previously been turned off by our servers GPO (User Account Control: Admin Approval Mode for the Built-in Administrator account: Enabled). The DC is still in AD and is still in the Domain Controllers OU, which is receiving the Default Domain Controllers GPO, as well as our custom Servers GPO, neither of which have been modified in years.

 

However the following error appears on both DCs:

Level: Error. Source: NETLOGON. Event ID: 5722
The session setup from the computer  failed to authenticate. The name(s) of the account(s) referenced in the security database is SCIENCE-TBLT20$.  The following error occurred: 
Access is denied.

 

I'm suspecting that there's something wrong with DC1, but I'm unsure how to resolve it. We have not made any changes since upgrading to 2019 to our domain.

 

Edit: DCDiag reports passes on both DCs for all except for DFSREvent which reports this warning:

Starting test: DFSREvent
        There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
        replication problems may cause Group Policy problems.

 

I also have the Microsoft AD Replication Tool 1.0 installed on my workstation and that reports correct synchronisation between the two DCs.

 

I have also restarted DC1, to no avail.

 

Edit 2: I have output the dcdiag result to a text file and it has reported the following:

      Starting test: DFSREvent

        The DFS Replication Event Log. 
        There are warning or error events within the last 24 hours after the

        SYSVOL has been shared.  Failing SYSVOL replication problems may cause

        Group Policy problems. 
        A warning event occurred.  EventID: 0x80001396

           Time Generated: 05/07/2019   15:52:55

           Event String:

           The DFS Replication service is stopping communication with partner DC1 for replication group Domain System Volume due to an error. The service will retry the connection periodically. 

            

           Additional Information: 

           Error: 1723 (The RPC server is too busy to complete this operation.) 

           Connection ID: 96698CB3-F0C2-4473-A4EC-B093A7EB911F 

           Replication Group ID: D028633F-A4B8-47E3-8B26-5751949FCF85

        An error event occurred.  EventID: 0xC0001390

           Time Generated: 05/07/2019   15:53:49

           Event String:

           The DFS Replication service failed to communicate with partner DC1 for replication group Domain System Volume. This error can occur if the host is unreachable, or if the DFS Replication service is not running on the server. 

            

           Partner DNS Address: DC1.SJW.Internal 

            

           Optional data if available: 

           Partner WINS Address: DC1 

           Partner IP Address: 10.22.11.11 

            

           The service will retry the connection periodically. 

            

           Additional Information: 

           Error: 1722 (The RPC server is unavailable.) 

           Connection ID: 96698CB3-F0C2-4473-A4EC-B093A7EB911F 

           Replication Group ID: D028633F-A4B8-47E3-8B26-5751949FCF85

        ......................... DC2 failed test DFSREvent

Edited May 8, 2019 by CHiLL