Deanuk Posted February 16, 2021 Posted February 16, 2021 Morning everyone, I've been having issues with two DCs in a school I recently took over, I was wondering if anyone could help me with it? I've found that the DC's are throwing up GPO errors, can't keep time and DNS is quite messed up. I don't believe that they are replicating correctly. I don't think that a previous upgrade has been done correctly. When doing GPO updates on any machine the following error comes up: PS Z:\> gpupdate /force Updating policy... Computer Policy update has completed successfully. The following warnings were encountered during computer policy processing: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its own log file. Please click on the "More information" link. User Policy update has completed successfully. For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access inf ormation about Group Policy results. Now, looking at the errors logs I found the following: - System - Provider [ Name] Microsoft-Windows-GroupPolicy [ Guid] {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9} EventID 1085 Version 0 Level 3 Task 0 Opcode 1 Keywords 0x8000000000000000 - TimeCreated [ SystemTime] 2021-02-15T14:35:07.159517900Z EventRecordID 830475 - Correlation [ ActivityID] {03751D06-82D0-4537-B851-0E6A9D4D6C68} - Execution [ ProcessID] 1460 [ ThreadID] 1124 Channel System Computer DC01.XXX.local - Security [ UserID] S-1-5-18 - EventData SupportInfo1 1 SupportInfo2 5023 ProcessingMode 0 ProcessingTimeInMilliseconds 750 ErrorCode 8219 ErrorDescription The policy object does not exist. DCName \\DC01.XXX.local ExtensionName Wireless Group Policy ExtensionId {0ACDD40C-75AC-47ab-BAA0-BF6DE7E7FE63} Searching the internet I found the following fix for the Wireless Group Policy issue https://social.technet.microsoft.com/Forums/en-US/b64003d8-c3bc-47c4-b3e5-1c1a0ac4a595/windows-failed-to-apply-the-wireless-group-policy-settings-wireless-group-policy-settings-might?forum=winserverGP However, I can't find the GPO objects within the ADSI editor and therefore can't remedy the issue. The GPO does not exist inside of the sysvol folder on DC01 or DC02. Running DCDiag and DCDiag /c /v /e /q throws up multiple issues too. DCDiag Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = DC02 * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DC02 Starting test: Connectivity ......................... DC02 passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DC02 Starting test: Advertising Warning: DC02 is not advertising as a time server. ......................... DC02 failed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC02 passed test FrsEvent Starting test: DFSREvent ......................... DC02 passed test DFSREvent Starting test: SysVolCheck ......................... DC02 passed test SysVolCheck Starting test: KccEvent An error event occurred. EventID: 0xC00004CC Time Generated: 02/15/2021 13:18:47 Event String: System Monitor was unable to open Active Directory Domain Services performance counters. An attempt to query the following performance counter registry key failed. An error event occurred. EventID: 0xC00004CC Time Generated: 02/15/2021 13:18:47 Event String: System Monitor was unable to open Active Directory Domain Services performance counters. An attempt to query the following performance counter registry key failed. An error event occurred. EventID: 0xC00004CC Time Generated: 02/15/2021 13:21:16 Event String: System Monitor was unable to open Active Directory Domain Services performance counters. An attempt to query the following performance counter registry key failed. An error event occurred. EventID: 0xC00004CC Time Generated: 02/15/2021 13:21:16 Event String: System Monitor was unable to open Active Directory Domain Services performance counters. An attempt to query the following performance counter registry key failed. ......................... DC02 failed test KccEvent Starting test: KnowsOfRoleHolders ......................... DC02 passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DC02 passed test MachineAccount Starting test: NCSecDesc ......................... DC02 passed test NCSecDesc Starting test: NetLogons ......................... DC02 passed test NetLogons Starting test: ObjectsReplicated ......................... DC02 passed test ObjectsReplicated Starting test: Replications ......................... DC02 passed test Replications Starting test: RidManager ......................... DC02 passed test RidManager Starting test: Services Invalid service startup type: NETLOGON on DC02, current value DEMAND_START, expected value AUTO_START ......................... DC02 failed test Services Starting test: SystemLog A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:33:12 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:38:15 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:43:23 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:48:26 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:53:29 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 12:58:32 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:03:35 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:08:38 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:13:41 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:18:44 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. An error event occurred. EventID: 0xC0001B7A Time Generated: 02/15/2021 13:21:15 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 1 time(s). An error event occurred. EventID: 0xC0001B77 Time Generated: 02/15/2021 13:21:16 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 2 time(s). The following cor rective action will be taken in 300000 milliseconds: Restart the service. An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 13:21:16 Event String: The Diagnostic Service Host service failed to start due to the following error: An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 13:21:16 Event String: The Diagnostic Service Host service failed to start due to the following error: A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:23:47 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. An error event occurred. EventID: 0xC0001B78 Time Generated: 02/15/2021 13:26:16 Event String: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected ter mination of the WMI Performance Adapter service, but this action failed with the following error: An error event occurred. EventID: 0xC0001B7A Time Generated: 02/15/2021 13:27:15 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 3 time(s). An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 13:27:16 Event String: The Diagnostic Service Host service failed to start due to the following error: A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:28:50 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. An error event occurred. EventID: 0x00002720 Time Generated: 02/15/2021 13:33:40 Event String: The application-specific permission settings do not grant Local Activation permission for the COM Server app lication with CLSID A warning event occurred. EventID: 0x0000043D Time Generated: 02/15/2021 13:29:46 Event String: Windows failed to apply the Wireless Group Policy settings. Wireless Group Policy settings might have its ow n log file. Please click on the "More information" link. ......................... DC02 failed test SystemLog Starting test: VerifyReferences ......................... DC02 passed test VerifyReferences Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : XXX Starting test: CheckSDRefDom ......................... XXX passed test CheckSDRefDom Starting test: CrossRefValidation ......................... XXX passed test CrossRefValidation Running enterprise tests on : XXX.local Starting test: LocatorCheck ......................... XXX.local passed test LocatorCheck Starting test: Intersite ......................... XXX.local passed test Intersite
Deanuk Posted February 16, 2021 Author Posted February 16, 2021 DCDiag /c /v /e /q shows the following errors. PS Z:\> DCDiag /c /v /e /q Warning: DC02 is not advertising as a time server. ......................... DC02 failed test Advertising [DC02] No security related replication errors were found on this DC! To target the connection to a specific source DC use /ReplSource:. ** Did not run Outbound Secure Channels test because /testdomain: was not entered Invalid service startup type: NETLOGON on DC02, current value DEMAND_START, expected value AUTO_START ......................... DC02 failed test Services An error event occurred. EventID: 0xC0001B7A Time Generated: 02/15/2021 14:17:46 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 1 time(s). An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 14:17:47 Event String: The Diagnostic Service Host service failed to start due to the following error: An error event occurred. EventID: 0xC0001B77 Time Generated: 02/15/2021 14:17:47 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service. An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 14:17:48 Event String: The Diagnostic Service Host service failed to start due to the following error: An error event occurred. EventID: 0xC0001B78 Time Generated: 02/15/2021 14:22:47 Event String: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the WMI Performance Adapter service, but this action failed with the following error: An error event occurred. EventID: 0xC0001B7A Time Generated: 02/15/2021 14:23:46 Event String: The WMI Performance Adapter service terminated unexpectedly. It has done this 3 time(s). An error event occurred. EventID: 0xC0001B58 Time Generated: 02/15/2021 14:23:46 Event String: The Diagnostic Service Host service failed to start due to the following error: ......................... DC02 failed test SystemLog The following problems were found while verifying various important DN references. Note, that these problems can be reported because of latency in replication. So follow up to resolve the following problems, only if the same problem is reported on all DCs for a given domain or if the problem persists after replication has had reasonable time to replicate changes. [1] Problem: Missing Expected Value Base Object: CN=DC02,OU=Domain Controllers,DC=XXX,DC=local Base Object Description: "DC Account Object" Value Object Attribute Name: msDFSR-ComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 [2] Problem: Missing Expected Value Base Object: CN=DC01,OU=Domain Controllers,DC=XXX,DC=local Base Object Description: "DC Account Object" Value Object Attribute Name: msDFSR-ComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 LDAP Error 0x20 (32) - No Such Object. ......................... DC02 failed test VerifyEnterpriseReferences [DC01] No security related replication errors were found on this DC! To target the connection to a specific source DC use /ReplSource:. There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC01 failed test FrsEvent ** Did not run Outbound Secure Channels test because /testdomain: was not entered The following problems were found while verifying various important DN references. Note, that these problems can be reported because of latency in replication. So follow up to resolve the following problems, only if the same problem is reported on all DCs for a given domain or if the problem persists after replication has had reasonable time to replicate changes. [1] Problem: Missing Expected Value Base Object: CN=DC02,OU=Domain Controllers,DC=XXX,DC=local Base Object Description: "DC Account Object" Value Object Attribute Name: msDFSR-ComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 [2] Problem: Missing Expected Value Base Object: CN=DC01,OU=Domain Controllers,DC=XXX,DC=local Base Object Description: "DC Account Object" Value Object Attribute Name: msDFSR-ComputerReferenceBL Value Object Description: "SYSVOL FRS Member Object" Recommended Action: See Knowledge Base Article: Q312862 LDAP Error 0x20 (32) - No Such Object. ......................... DC01 failed test VerifyEnterpriseReferences Invalid service startup type: NETLOGON on DC02, current value DEMAND_START, expected value AUTO_START Test results for domain controllers: DC: DC02.XXX.local Domain: XXX.local TEST: Basic (Basc) Error: NETLOGON service is not running Summary of DNS test results: Auth Basc Forw Del Dyn RReg Ext _________________________________________________________________ Domain: XXX.local DC02 PASS FAIL PASS PASS PASS PASS n/a ......................... XXX.local failed test DNS I realise there are multiple errors being shown here but I'm working through them one at a time, any help would be greatly appreciated. Thanks, Dean
HPlum78 Posted February 16, 2021 Posted February 16, 2021 (edited) https://www.microsoft.com/en-gb/download/details.aspx?id=30005 Download the above and run it in the first instance. It will give you a run down in a more (better) format and list out the priorities in order. I cannot see how many DC's there are in your topology, where are the FSMO roles at the min? https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-get-list-of-fsmo-role-holders/ That will get them out in a nice list. On my phone and scrolling through verbose errors is let's say sub optimal. Edited February 16, 2021 by HPlum78
Deanuk Posted February 16, 2021 Author Posted February 16, 2021 https://www.microsoft.com/en-gb/download/details.aspx?id=30005 Download the above and run it in the first instance. It will give you a run down in a more (better) format and list out the priorities in order. I cannot see how many DC's there are in your topology, where are the FSMO roles at the min? https://devblogs.microsoft.com/scripting/powertip-use-powershell-to-get-list-of-fsmo-role-holders/ That will get them out in a nice list. On my phone and scrolling through verbose errors is let's say sub optimal. I've run the tool and it is not throwing any replication errors up, maybe that isn't an issue. We have 2 DC's, DC one is physical DC two virtual. FSMO roles are with DC01. Running the table command you linked shows: InfrastructureMaster RIDMaster PDCEmulator -------------------- --------- ----------- DC01.XXX.local DC01.XXX.local DC01.XXX.local Name Domain Forest OperationMasterRoles ---- ------ ------ -------------------- DC01 XXX.local XXX.local {SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster...}
Jambon360 Posted February 16, 2021 Posted February 16, 2021 It sounds like DC02 is not in a good shape. Is there an obvious time difference between it and the PDC (DC01)? If so AD can be quite fussy with anything out of sync especially if it is over 5 minutes. DC02 should be subscribing to DC01 for time at stratum level 2 or 3. If you run the following command from DC02 it should be able to tell you: w32tm /query /peers What hypervisor are you running the VM on? Depending on the version you may need to carry out certain configuration to stop the virtual DC from obtaining time from the hypervisor host as well as this is known to cause issue. Could you also run the following command to see the delta sizes of replication between the two servers? repadmin /replsum repadmin /showrepl Thanks
Deanuk Posted February 16, 2021 Author Posted February 16, 2021 It sounds like DC02 is not in a good shape. Is there an obvious time difference between it and the PDC (DC01)? If so AD can be quite fussy with anything out of sync especially if it is over 5 minutes. DC02 should be subscribing to DC01 for time at stratum level 2 or 3. If you run the following command from DC02 it should be able to tell you: w32tm /query /peers What hypervisor are you running the VM on? Depending on the version you may need to carry out certain configuration to stop the virtual DC from obtaining time from the hypervisor host as well as this is known to cause issue. Could you also run the following command to see the delta sizes of replication between the two servers? repadmin /replsum repadmin /showrepl Thanks Currently running VMware centre 6.5 hosts are on 5.5 - that's another issue I'm currently fixing. PS Z:\> w32tm /query /peers #Peers: 1 Peer: DC01.XXX.local State: Active Time Remaining: 887.1329272s Mode: 1 (Symmetric Active) Stratum: 1 (primary reference - syncd by radio clock) PeerPoll Interval: 10 (1024s) HostPoll Interval: 10 (1024s) PS Z:\> repadmin /replsum Replication Summary Start Time: 2021-02-16 09:22:19 Beginning data collection for replication summary, this may take awhile: ..... Source DSA largest delta fails/total %% error DC01 33m:41s 0 / 5 0 DC02 35m:16s 0 / 5 0 Destination DSA largest delta fails/total %% error DC01 35m:16s 0 / 5 0 DC02 33m:41s 0 / 5 0 PS Z:\> repadmin /showrepl Repadmin: running command /showrepl against full DC localhost Default-First-Site-Name\DC02 DSA Options: IS_GC Site Options: (none) DSA object GUID: 376b7f82-ee9c-4153-add6-9d4b777274aa DSA invocationID: 6eab147d-87fa-46f9-b475-caa80c3359ef ==== INBOUND NEIGHBORS ====================================== DC=XXX,DC=local Default-First-Site-Name\DC01 via RPC DSA object GUID: b8e8bf59-1a78-491a-9eca-d69eeabec904 Last attempt @ 2021-02-16 09:22:19 was successful. CN=Configuration,DC=XXX,DC=local Default-First-Site-Name\DC01 via RPC DSA object GUID: b8e8bf59-1a78-491a-9eca-d69eeabec904 Last attempt @ 2021-02-16 08:48:38 was successful. CN=Schema,CN=Configuration,DC=XXX,DC=local Default-First-Site-Name\DC01 via RPC DSA object GUID: b8e8bf59-1a78-491a-9eca-d69eeabec904 Last attempt @ 2021-02-16 08:48:38 was successful. DC=ForestDnsZones,DC=XXX,DC=local Default-First-Site-Name\DC01 via RPC DSA object GUID: b8e8bf59-1a78-491a-9eca-d69eeabec904 Last attempt @ 2021-02-16 08:48:38 was successful. DC=DomainDnsZones,DC=XXX,DC=local Default-First-Site-Name\DC01 via RPC DSA object GUID: b8e8bf59-1a78-491a-9eca-d69eeabec904 Last attempt @ 2021-02-16 08:48:38 was successful.
Jambon360 Posted February 16, 2021 Posted February 16, 2021 (edited) Thanks for the additional information. So looks as though replication is working correctly. The DCdiag from DC02 suggests that it is not advertising itself as a domain controller however. Are the OS version different? I can't say for certain but it looks as though the SYSVOL is still running on FRS rather than DFS-R which can cause issues with newer version of Windows Server. Also DC01 can you run the w32tm command? DC02 showing stratum level 1 would suggest DC01 is using the its CMOS rather than an accurate time source to keep time. Edited February 16, 2021 by Jambon360
RobD Posted February 16, 2021 Posted February 16, 2021 Check DFSR and the sysvol. DFSR For /f %i IN ('dsquery server -o rdn') do @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo WHERE replicatedfoldername='SYSVOL share' get replicationgroupname,replicatedfoldername,state The "state" values can be any of the following: 0 = Uninitialized 1 = Initialized 2 = Initial Sync 3 = Auto Recovery 4 = Normal 5 = In Error Sysvol: For /f %i IN ('dsquery server -o rdn') do @echo %i && @(net view \\%i | find "SYSVOL") & echo
HPlum78 Posted February 16, 2021 Posted February 16, 2021 Had to go to an appointment but it looks like the collective have hooked you up :-)
Deanuk Posted February 16, 2021 Author Posted February 16, 2021 (edited) Thanks for the additional information. So looks as though replication is working correctly. The DCdiag from DC02 suggests that it is not advertising itself as a domain controller however. Are the OS version different? I can't say for certain but it looks as though the SYSVOL is still running on FRS rather than DFS-R which can cause issues with newer version of Windows Server. Also DC01 can you run the w32tm command? DC02 showing stratum level 1 would suggest DC01 is using the its CMOS rather than an accurate time source to keep time. Looks like you're right, DC01 is getting from CMOS rather than the time server. I'll look to change this to uk.pool.ntp.org. in terms of the DSF-R I'll look in to it as I have not done this before. PS Z:\> w32tm /monitor DC02.XXX.local[10.X.X.18:123]: ICMP: 0ms delay NTP: +0.0006124s offset from DC01.XXX.local RefID: DC01.XXX.local [10.0.11.22] Stratum: 2 DC01.XXX.local *** PDC ***[[::1]:123]: ICMP: 0ms delay NTP: +0.0000000s offset from DC01.XXX.local RefID: 'LOCL' [0x4C434F4C] Stratum: 1 Edited February 16, 2021 by Deanuk
Jambon360 Posted February 16, 2021 Posted February 16, 2021 Good stuff, may want to sensor the code output. What about OS versions do they differ between the two DC's?
mrwoberts Posted February 16, 2021 Posted February 16, 2021 As others have said, time is very important and they need to be in sync. Further to the good stuff above, I'd also concentrate on getting DNS in order - make sure at the very least you have the corresponding static records (forwards and reverse) for key servers, such as DC01 and 2. Make sure they are announcing changes to each other (depends on how you have it configured). Any other server roles involved here? DHCP?? What are the static IP settings on each server's NIC - check the DNS settings of each NIC, they should have static addresses and the primary DNS of each server should point to the other one (again, this depends on your setup but I suspect this is the case) Backup all the core Event logs!! Flush them out and then keep an eye on new events.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now