Sysvol not propagating to other server and pcs looking to old server for scripts.

[edutech4schools]

Hi,

 

I recently added a new 2008r2 server to our 2003 domain and moved all rolls to the new server as the old one 2003 server will be dumped soon.

 

I ran dcpromo on the new server and all went ok. it has dns active directory and sysvol all populated. I then migrated dhcp and made the setings point to the new server so all computers logging on should and do point to the new server.

 

Odd thing is, if I make a change to the kix script in netlogon on the new server this does not get copied to the old server. The other odd thing is that all computers still look to the old server for the kix script in sysvol.

 

Any pointers as to why this might be happening.

Edited May 26, 2012 by edutech4schools

[edutech4schools]

More info.

when I run netdom query fsmo on new server all roles are listed as running on the new server but when I look in AD\domain controllers the old server is listed as DC and the new as GC.

[edutech4schools]

More info:

Well the propagation issues might be down to DNS setting in network adapters on the old server was still pointing to itself rather than the new server. Will need to wait to see if that helps.

[FN-GM]

How long did you leave it to replicate? Have you had a look in the event logs?

[edutech4schools]

How long did you leave it to replicate?

 

its been about 20 mins since I pointed the old server dns at the new server.

 

Have you had a look in the event logs?

Had lots yesterday after I rebooted both servers but nothing since that jumps out at me as being an issue.

 

Just dumped a new text file in the netlogon folder and it replicated almost instantly. but if I make a change in the kix script it does not get replicated.

 

EDIT - Kix is replicating. I deleted the old file and created a new one. YAY.

[FN-GM]

I have known replication to take ages to decide to work. I would just leave it and see what happens. Are your other domain controllers looking healthy?

[ricki]

HI

 

Have you tried a repadmin /showrepl on both domain controllers. You need to be logged on as admin

 

Is the time on both servers the same otherwise kerberos will fail.

 

Have you tried forcing a replication and do you get an error in the event logs or on the screen. After holidays wil have to change a registry setting on devieny partners and allow them to replicate and them put them back as they have been off and have not replicated for a few days.

Event ID 2042: It has been too long since this machine replicated: Active Directory

 

Check the nic card settings and the ip addresses / subnet etc

 

Check dns is allowed to replicate to all servers.

 

I know this will be a silly question but you did to a adprep on the old domain controller before adding the windows 2008 server to prepare the schema Windows Server 2008 ADPREP

 

Richard

[ricki]

Sorry

 

I forget have you done a dcdiag and a netdiag on the windows 2003 server and a dc diag on the windows 2008 server.

 

Richard

[themightymrp]

Do you use any subfolders of the Netlogon share to hold software distributions or anything similar? I have a subfolder in mine which contains a few programs that I deploy via GPO. Recently, when I added a new DC, our Anti-Virus (sophos) accidentally identified one of the apps as suspicious and wouldn't let the replication take place. It therefore kept killing the Replication Service. I didn't realise until I went through the anti-virus logs! Once the app was authorized the replication took less than an hour to complete

[edutech4schools]

Thanks for all the info. It looks like all is ok, just seemed to take much longer to start replicating than normal.

[Geoff]

Do you use any subfolders of the Netlogon share to hold software distributions or anything similar? I have a subfolder in mine which contains a few programs that I deploy via GPO. Recently, when I added a new DC, our Anti-Virus (sophos) accidentally identified one of the apps as suspicious and wouldn't let the replication take place. It therefore kept killing the Replication Service. I didn't realise until I went through the anti-virus logs! Once the app was authorized the replication took less than an hour to complete

 

I wouldn't recommend running on access AV scanning on servers.

[Michael]

Immediate things to check (as others have mentioned) are DNS settings. Make sure the DCs point to themselves first, then each other second, then any external DNS.

 

In Active Directory Sites and Services you can manually force the servers to replicate instead of hanging around. Typically it should take seconds unless there's a huge amount of data to replicate. There should be literally a handful of scripts or reg edits possibly, but you could argue you can do most of this using GPO in 2008 R2.

[edutech4schools]

Just one more question. Why does the old server (which I have not demoted yet) say its a DC and the New server say its a GC. Is this normal?

 

Notes:

repadmin /showrepl gives the other servers info, as expected.

Replication is working fine now.

All setting such as PDC, Op Master etc all have the new server name.

Yes adprep32 was done

netdom query fsmo = Looks good and lists new server for all roles

DCDIAG on old server = all pass

NETDIAG on old server = all pass

 

However DCDIAG on new server passes all except this one: (I have changed server and domain names)

 

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=ForestDnsZones,DC=domain,DC=LAN

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=DomainDnsZones,DC=domain,DC=LAN

......................... server-SRV01 failed test NCSecDesc

 

 

Should I worry about this error and should I worry the the new server is listed as GC?

 

EDIT. Info about the failed test NCSecDesc

If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep.

 

So back to my first question. Why does my new server which has all the roles say its a GC?

Edited May 28, 2012 by edutech4schools

[Michael]

You need at least one GC (Global Catalog) server in your network and typically this can be on the same box as your 2008 R2 DC. Without the GC option enabled, processing logons would not be possible.

[edutech4schools]

Yep, I moved all roles and GC to the new server but the old one is still listed as DC in Acitve directory and the new one as GC. Is this correct until I demote the old server? I would have thought having all the roles on the new server and none on the old would make the new server the main DC.

[Roberto]

I'm not sure what the problem is here. If you made it a Global Catalogue server then it will show up as a Global Catalogue. That's the correct behaviour. A GC is a superset of the DC functions, not a different type of server.

[FN-GM]

Yep, I moved all roles and GC to the new server but the old one is still listed as DC in Acitve directory and the new one as GC. Is this correct until I demote the old server? I would have thought having all the roles on the new server and none on the old would make the new server the main DC.

 

Thats right. Its a DC until you tell it not to be. Why are you just running with one DC by the way?

[edutech4schools]

Why are you just running with one DC by the way?

Its a small primary, with limited money and all the primary schools in the area have only one server.

 

I did trial having a BDC in a test setup and got frightened off as AD got corrupted and the corruption got replicated, which would have been a pain to fix. Being a primary they would be ok to wait for a full restore. TBH I go round and round this in my head and did follow a thread on this site, which ended in the person deciding to keep it as a single server setup.

[ricki]

Yep, I moved all roles and GC to the new server but the old one is still listed as DC in Acitve directory and the new one as GC. Is this correct until I demote the old server? I would have thought having all the roles on the new server and none on the old would make the new server the main DC.

 

If the old domain controller is still a domain controller it will still be in the domain controller ou. Once its demoted then move it to your server ou.

 

Please fix your problem before demoting the old server

 

Richard

 

Richard

[ricki]

Just one more question. Why does the old server (which I have not demoted yet) say its a DC and the New server say its a GC. Is this normal?

 

Notes:

repadmin /showrepl gives the other servers info, as expected.

Replication is working fine now.

All setting such as PDC, Op Master etc all have the new server name.

Yes adprep32 was done

netdom query fsmo = Looks good and lists new server for all roles

DCDIAG on old server = all pass

NETDIAG on old server = all pass

 

However DCDIAG on new server passes all except this one: (I have changed server and domain names)

 

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=ForestDnsZones,DC=domain,DC=LAN

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=DomainDnsZones,DC=domain,DC=LAN

......................... server-SRV01 failed test NCSecDesc

 

 

Should I worry about this error and should I worry the the new server is listed as GC?

 

EDIT. Info about the failed test NCSecDesc

If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep.

 

So back to my first question. Why does my new server which has all the roles say its a GC?

 

Hi Have you done this How To Fix NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights Error it will get rid of the error.

 

Richard

[edutech4schools]

Hi Have you done this How To Fix NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights Error it will get rid of the error.

 

Just done that. thanks, worked a treat.

 

If I wanted to make the old server a BDC what should I do next?

 

For any new forum readers:

old server had all rolles

Added new server to domain

dcpromo new server

moved all roles to new server

[ricki]

HI

 

Is it not already a domain controller?

 

What happens is when the clients log on they go to the domain controller that answers first. There is not backup domain controller like there used to be with windows 2000 server.

 

Word of warning. Do all you gpo settings on the windows 2008 server or a windows 7 machine with the management tool. DO NOT use the windows 2003 or xp machines.

 

Richard

[edutech4schools]

I did all my courses and learning on 2000 server. Thanks for the info.

 

How would I be best to septate the roles? is it possible to seize all roles if 1 server has all the roles and goes down?

[ricki]

HI

 

If you only have one good one leave it all on one and make the windows 2003 a global catalogue. If you were a big domain I would move them around but with only one main server I would leave it as is. I would suggest if the old server would take it upgrade to windows 2008 r2 and then if you lost the main new domain controller its still operational.

 

Be carefull with your windows 2008 domain controller and watch out for eventid 2012 errors. Windows 2008 r2 is too smart for its own good and trys to offload processing from the cpu to the nic card. You might have to disable chimney, rss and autotuning. I think off the top of my head we also had to disable checksum on the nic. Watch out for things running slow on client machines and random disconnections.

 

Richard

[edutech4schools]

If you only have one good one leave it all on one and make the windows 2003 a global catalogue

 

Can I leave GC on the 2008r2 box along with making the 2003 a GC?