WS2025 Replication errors

[andy.krystofi]

Hello,

 

in our company there are two DCs. Main is WS2019 with FSMO role and second that we have configured last month is WS2025 as a backup AD. 

There have been problems with it from the start, primarily a replication error that occurs immediately after restarting the server. Sometimes it is enough to wait about 30 minutes and the replication starts working correctly on its own, and sometimes it does not start at all. I'm talking about command repadmin /replsummary and error (1908) Could not find the domain controller for this domain. DNS is set correctly, the primary is as backup one and second as localhost on the both servers.
Additionally, after each server restart, an error related to DHCP appears in Event Viewer: 1059 The DHCP service failed to see a directory server for authorization. Even though DHCP works on both servers, as I can see from the scope. When I have added the value NTDS in registry value DependOnService in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer, the error doesn't appear after reboot. 

 

Does anyone have any ideas? I will be grateful for any tips.

 

[andy.krystofi]

Can someone help?

 

[Jaan]

Just punched it into AI and got this:

 

While you state DNS is set correctly, the configuration you described ("primary is as backup one and second as localhost on the both servers") is a common point of contention, especially for a new DC.

• Main DC (WS2019):

  • Primary DNS: IP of the WS2025 DC.

  • Secondary DNS: 127.0.0.1 (Loopback) or another DC (if you had one). Using the loopback is generally acceptable.

• Backup DC (WS2025):

  • Primary DNS: IP of the WS2019 DC (FSMO holder).

  • Secondary DNS: 127.0.0.1 (Loopback).

If the WS2025 DC is setting its Primary DNS to its own IP (the loopback or static IP) and its Secondary to the WS2019 DC's IP, that's often an issue because it may try to register its SRV records before its own DNS service is fully operational, leading to the 1908 error from the other DC.

• Actionable Step: On the WS2025 DC, ensure the Primary DNS Server is set to the IP address of the WS2019 DC.

Service Startup Dependency

 

The intermittent nature of the error (sometimes taking 30 minutes to resolve) points directly to services starting after the initial replication check fails. Active Directory Domain Services (NTDS) relies heavily on the Netlogon service for locating other DCs and registering its own SRV records.

• Actionable Step: After a reboot of the WS2025 server, check the status of the Netlogon service. If it's not running or just starting, that's likely the cause. Wait for it to start, and then immediately check repadmin /replsummary.

 

2. DHCP Authorization Error (1059)

 

The error 1059 (The DHCP service failed to see a directory server for authorization) occurs because the DHCP Server service attempts to start and authorize itself in Active Directory before the Active Directory Domain Services (NTDS) or the Netlogon service is fully operational.

 

The Registry Fix Explained and Validated

 

Your fix using the DependOnService registry value is the correct and recommended solution for this specific timing issue.

• Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer

• Value Name: DependOnService

• Value Data: NTDS (and possibly Netlogon)

By adding NTDS (Active Directory Domain Services) to the list, you instruct the Service Control Manager to delay the start of the DHCP service until the AD DS service has successfully started. This ensures that a Directory Server is available for the DHCP service to check authorization against, eliminating the 1059 error.

• Tip: While your fix is good, you could also consider adding Netlogon to the DependOnService value alongside NTDS, as Netlogon is crucial for DC functionality, too. The value would be NTDS and Netlogon on separate lines (if editing via the GUI) or separated by spaces/nulls (if editing via command line/script).

 

3. Potential Crossover Solution

 

Since both your issues (Replication 1908 and DHCP 1059) are likely boot-time dependency issues on the WS2025 DC:

• Focus on Netlogon and DNS: If the Netlogon service starts slowly, it prevents the DC from advertising itself correctly (causing 1908) and prevents other services (like DHCP) from finding a directory server.

• Review Event Logs: After a reboot, check the System and Directory Service logs on the WS2025 server, paying attention to the timestamps immediately preceding and following the 1908 error time. Look for errors related to Netlogon, DNS Client, or DNS Server.

 

Summary of Recommended Actions

 

1. Correct DNS Forwarding: On the WS2025 DC, set the Primary DNS to the IP address of the WS2019 DC (the FSMO holder).

2. Confirm DHCP Fix: The DependOnService fix for the DHCP service is valid and should prevent the 1059 error.

3. Investigate Service Startup: If the 1908 error persists, it is a race condition. Ensure Netlogon and DNS Server services are set to Automatic startup. If the issue is persistent, you could explore setting the DNS Server service to also depend on NTDS using the DependOnService registry key, though this is a more advanced troubleshooting step.

The combination of slow service startup (particularly Netlogon/DNS Server) and the new server's need to register in the forest is the most probable cause of both errors. Resolving the service dependency for DHCP is complete, now focus on the Netlogon/DNS dependencies for replication.

[andy.krystofi]

On 24/10/2025 at 09:19, Jaan said:

Just punched it into AI and got this:

 

While you state DNS is set correctly, the configuration you described ("primary is as backup one and second as localhost on the both servers") is a common point of contention, especially for a new DC.

• Main DC (WS2019):

  • Primary DNS: IP of the WS2025 DC.

  • Secondary DNS: 127.0.0.1 (Loopback) or another DC (if you had one). Using the loopback is generally acceptable.

• Backup DC (WS2025):

  • Primary DNS: IP of the WS2019 DC (FSMO holder).

  • Secondary DNS: 127.0.0.1 (Loopback).

If the WS2025 DC is setting its Primary DNS to its own IP (the loopback or static IP) and its Secondary to the WS2019 DC's IP, that's often an issue because it may try to register its SRV records before its own DNS service is fully operational, leading to the 1908 error from the other DC.

• Actionable Step: On the WS2025 DC, ensure the Primary DNS Server is set to the IP address of the WS2019 DC.

Service Startup Dependency

 

The intermittent nature of the error (sometimes taking 30 minutes to resolve) points directly to services starting after the initial replication check fails. Active Directory Domain Services (NTDS) relies heavily on the Netlogon service for locating other DCs and registering its own SRV records.

• Actionable Step: After a reboot of the WS2025 server, check the status of the Netlogon service. If it's not running or just starting, that's likely the cause. Wait for it to start, and then immediately check repadmin /replsummary.

 

2. DHCP Authorization Error (1059)

 

The error 1059 (The DHCP service failed to see a directory server for authorization) occurs because the DHCP Server service attempts to start and authorize itself in Active Directory before the Active Directory Domain Services (NTDS) or the Netlogon service is fully operational.

 

The Registry Fix Explained and Validated

 

Your fix using the DependOnService registry value is the correct and recommended solution for this specific timing issue.

• Location: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer

• Value Name: DependOnService

• Value Data: NTDS (and possibly Netlogon)

By adding NTDS (Active Directory Domain Services) to the list, you instruct the Service Control Manager to delay the start of the DHCP service until the AD DS service has successfully started. This ensures that a Directory Server is available for the DHCP service to check authorization against, eliminating the 1059 error.

• Tip: While your fix is good, you could also consider adding Netlogon to the DependOnService value alongside NTDS, as Netlogon is crucial for DC functionality, too. The value would be NTDS and Netlogon on separate lines (if editing via the GUI) or separated by spaces/nulls (if editing via command line/script).

 

3. Potential Crossover Solution

 

Since both your issues (Replication 1908 and DHCP 1059) are likely boot-time dependency issues on the WS2025 DC:

• Focus on Netlogon and DNS: If the Netlogon service starts slowly, it prevents the DC from advertising itself correctly (causing 1908) and prevents other services (like DHCP) from finding a directory server.

• Review Event Logs: After a reboot, check the System and Directory Service logs on the WS2025 server, paying attention to the timestamps immediately preceding and following the 1908 error time. Look for errors related to Netlogon, DNS Client, or DNS Server.

 

Summary of Recommended Actions

 

1. Correct DNS Forwarding: On the WS2025 DC, set the Primary DNS to the IP address of the WS2019 DC (the FSMO holder).

2. Confirm DHCP Fix: The DependOnService fix for the DHCP service is valid and should prevent the 1059 error.

3. Investigate Service Startup: If the 1908 error persists, it is a race condition. Ensure Netlogon and DNS Server services are set to Automatic startup. If the issue is persistent, you could explore setting the DNS Server service to also depend on NTDS using the DependOnService registry key, though this is a more advanced troubleshooting step.

The combination of slow service startup (particularly Netlogon/DNS Server) and the new server's need to register in the forest is the most probable cause of both errors. Resolving the service dependency for DHCP is complete, now focus on the Netlogon/DNS dependencies for replication.

 

I also asked ChatGPT but I want to know why I have to edit value DependOnService. In other environment two DC's work properly without changed this value but both work on WS2019.

DNS is set correctly. I don't have an idea...

[andy.krystofi]

Problems are solved after last Windows update. Please close this topic.