timbo343 Posted October 12, 2006 Posted October 12, 2006 When forcing an update in for group policy through cmd.. i check the event viewer after it has finished updating and i see an error message.. Error SceCli Security policy cannot be propagated. Cannot access the template. Error code = -536870656. \\Domain\sysvol\Domain\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf. Ive had a look at http://support.microsoft.com/?kbid=258296 done what it has said but still no joy.. any one beable to help me out Tim
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 well looking at the policies on other servers
Geoff Posted October 12, 2006 Posted October 12, 2006 Run dcdiag on your DC's. Check the event log for errors and warnings.
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 Test results :: Domain Controller Diagnosis Performing initial setup: Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\SETH Starting test: Connectivity ......................... SETH passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\SETH Starting test: Replications ......................... SETH passed test Replications Starting test: NCSecDesc Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes All access rights for the naming context: CN=Schema,CN=Configuration,DC=shs,DC=com Error BUILTIN\Administrators doesn't have Replicating Directory Changes All access rights for the naming context: CN=Schema,CN=Configuration,DC=shs,DC=com Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes All access rights for the naming context: CN=Configuration,DC=shs,DC=com Error BUILTIN\Administrators doesn't have Replicating Directory Changes All access rights for the naming context: CN=Configuration,DC=shs,DC=com ......................... SETH failed test NCSecDesc Starting test: NetLogons ......................... SETH passed test NetLogons Starting test: Advertising ......................... SETH passed test Advertising Starting test: KnowsOfRoleHolders ......................... SETH passed test KnowsOfRoleHolders Starting test: RidManager ......................... SETH passed test RidManager Starting test: MachineAccount ......................... SETH passed test MachineAccount Starting test: Services ......................... SETH passed test Services Starting test: ObjectsReplicated ......................... SETH passed test ObjectsReplicated Starting test: frssysvol ......................... SETH passed test frssysvol Starting test: frsevent ......................... SETH passed test frsevent Starting test: kccevent ......................... SETH passed test kccevent Starting test: systemlog ......................... SETH passed test systemlog Starting test: VerifyReferences ......................... SETH passed test VerifyReferences Running partition tests on : Schema Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Running partition tests on : Configuration Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Running partition tests on : shs Starting test: CrossRefValidation ......................... shs passed test CrossRefValidation Starting test: CheckSDRefDom ......................... shs passed test CheckSDRefDom Running enterprise tests on : shs.com Starting test: Intersite ......................... shs.com passed test Intersite Starting test: FsmoCheck ......................... shs.com passed test FsmoCheck
Geoff Posted October 12, 2006 Posted October 12, 2006 You need to find out where it's failing first. What does the Replication event log say?
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 first of all.. dont want to sound thick but how do i find the log ??
Geoff Posted October 12, 2006 Posted October 12, 2006 1) Login to DC 2) Run Event Viewer 3) Select 'File Replication Service'
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 ok thanks... got this every morning... One hades dc: source: NtFrs Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller Hades.shs.com for FRS replica set configuration information. On seth dc: The File Replication Service has enabled replication from ISIS to SETH for c:\windows\sysvol\domain after repeated retries. On isis dc: The File Replication Service is having trouble enabling replication from SETH to ISIS for c:\windows\sysvol\domain using the DNS name seth.shs.com. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name seth.shs.com from this computer. [2] FRS is not running on seth.shs.com. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
Geoff Posted October 12, 2006 Posted October 12, 2006 Ok, does your primary DNS IP as setup on your DC's point at the other DC or itself?
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 the primary DNS sever points to the second DNS server and then the alternative DNS points to the outside world for the, where as all the other servers point to the primary dns and then to the second dns on the network. if you see what i mean
Geoff Posted October 12, 2006 Posted October 12, 2006 You can't point to external DNS servers. You need to configure forwarders. See here for more details, and implement as per your situation: http://support.microsoft.com/kb/825036
plexer Posted October 12, 2006 Posted October 12, 2006 You DC's shouldn't have a dns server that is not a DC on your domain. For outside world resolution they can either use the root hints or you can set up a dns forwarder to resolve dns that doesn't exist on your domain. Ben
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 ye we have got forward lookup zones in place too... or have i totally got the wrong end of the stick?
plexer Posted October 12, 2006 Posted October 12, 2006 Your forward lokoup zone is your network. What you need to do is go into the DNS admin window. Right click on your server name and select properties, click on the forwarders tab and set up a forwarder for all other dns domains using the ip addresses given to you by your lea. Ben
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 ah... we arent with the lea with the internet connection.. we are totally independant to the lea as we can do the internet, filtering etc a hell of a lot cheaper. But i have already got my 2 DNS servers in there from my ISP.
Geoff Posted October 12, 2006 Posted October 12, 2006 Ok, that's fine. You can leave the forwarders in there then. Just make sure you have the DNS settings correct on your DC's as per my previous post.
plexer Posted October 12, 2006 Posted October 12, 2006 Ok well LEA settings other ISP same bones makes no difference. Ben
timbo343 Posted October 12, 2006 Author Posted October 12, 2006 Right ok, ive checked all the dns settings etc and they all seem to be ok... what now??
Geoff Posted October 12, 2006 Posted October 12, 2006 On the DC that isn't registered in DNS correctly run: ipconfig /registerdns That should allow Ntfrs on the other DC be able to find the DC and begin replicating. Check the event logs that this is the case.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now