LordNewton Posted June 25, 2012 Posted June 25, 2012 Just promoted a 2008 r2 SERVER (DC01)to be a DC in an domain with an existing 2003 R2 (Server) server, but nothings replicating I can ping both servers from each other the results of DCdiag hold the clue but no idea how to fix it, google is having an off day... Directory Server Diagnosis Performing initial setup: Trying to find home server... Home Server = DC01 * Identified AD Forest. Done gathering initial info. Doing initial required tests Testing server: Default-First-Site-Name\DC01 Starting test: Connectivity ......................... DC01 passed test Connectivity Doing primary tests Testing server: Default-First-Site-Name\DC01 Starting test: Advertising Warning: DsGetDcName returned information for \\server.STPETERS.COM, when we were trying to reach DC01. SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE. ......................... DC01 failed test Advertising Starting test: FrsEvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... DC01 passed test FrsEvent Starting test: DFSREvent ......................... DC01 passed test DFSREvent Starting test: SysVolCheck ......................... DC01 passed test SysVolCheck Starting test: KccEvent ......................... DC01 passed test KccEvent Starting test: KnowsOfRoleHolders ......................... DC01 passed test KnowsOfRoleHolders Starting test: MachineAccount ......................... DC01 passed test MachineAccount Starting test: NCSecDesc ......................... DC01 passed test NCSecDesc Starting test: NetLogons Unable to connect to the NETLOGON share! (\\DC01\netlogon) [DC01] An net use or LsaPolicy operation failed with error 67, The network name cannot be found.. ......................... DC01 failed test NetLogons Starting test: ObjectsReplicated ......................... DC01 passed test ObjectsReplicated Starting test: Replications [Replications Check,DC01] DsReplicaGetInfo(PENDING_OPS, NULL) failed, error 0x2105 "Replication access was denied." ......................... DC01 failed test Replications Starting test: RidManager ......................... DC01 passed test RidManager Starting test: Services ......................... DC01 passed test Services Starting test: SystemLog Running partition tests on : ForestDnsZones Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Running partition tests on : DomainDnsZones Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Running partition tests on : Schema Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Running partition tests on : Configuration Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Running partition tests on : STPETERS Starting test: CheckSDRefDom ......................... STPETERS passed test CheckSDRefDom Starting test: CrossRefValidation ......................... STPETERS passed test CrossRefValidation Running enterprise tests on : STPETERS.com Starting test: LocatorCheck ......................... STPETERS.com passed test LocatorCheck Starting test: Intersite ......................... STPETERS.com passed test Intersite Please help.....
Michael Posted June 25, 2012 Posted June 25, 2012 DNS is the root cause of replication not working correctly. If you open up DNS on your 2003 R2 server, in turn on both Forward and Reverse lookup zones, make sure Zone Transfers are enabled. Then open up Active Directory Sites and Services on your 2003 R2 server, expand Default-First-Site-Name > Servers > Servername. Here you should be able to force replication manually. If it works then great, but if it doesn't, then double check DNS again. 1
LordNewton Posted June 25, 2012 Author Posted June 25, 2012 Thanks Michael Zone Transfers wasnt enabled - so Ive turned that on, and Ive forced a replication (I think) and i get a pop up saying AD has replicated all the connections, but the error is still listed in DC Diag. DCDiag only returned errors on the 2K8 server
Michael Posted June 25, 2012 Posted June 25, 2012 Run this batch file and it'll clear all logs on 2008 Server. Sometimes dcdiag reports errors from the reported event logs. @echo off FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V IF (%adminTest%)==(Access) goto noAdmin for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G") echo. echo goto theEnd :do_clear echo clearing %1 wevtutil.exe cl %1 goto :eof :noAdmin exit You should also make sure you've run: adprep /rodcprep Otherwise there's a section of 2008 dcdiag which will always report an error until you do so. I'd also recommend you download/install dcdiag for 2003 R2 server too. 1
LordNewton Posted June 25, 2012 Author Posted June 25, 2012 Still no joy - the 2003 server pass's everything on when run (2003) Dcdiag on it
tmcd0035 Posted June 25, 2012 Posted June 25, 2012 technet.microsoft.com/Forums/en-CA/windowsserver2008r2general/thread/15511d6d-aa2e-4b18-b7b7-6a5a39f867f6 did you run adprep /forestprep and adprep /domainprep before introducing the 2008r2 server?
LordNewton Posted June 25, 2012 Author Posted June 25, 2012 did you run adprep /forestprep and adprep /domainprep before introducing the 2008r2 server? Yes I did, just checking your link now Thanks
ricki Posted June 26, 2012 Posted June 26, 2012 Have you checked the settings on you network card for ip, subnet dns ,etc on the servers Richard
LordNewton Posted June 26, 2012 Author Posted June 26, 2012 Yes 100's of times, I've set the 2k8 servers primary DNS to the 2K3 server, and they can ping each other by name and ip address
Michael Posted June 26, 2012 Posted June 26, 2012 So when you run dcdiag now, what does it look like?
Michael Posted June 26, 2012 Posted June 26, 2012 The thing that bothers me most about your dciag output is: SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE. Is your 2003 Server still the FSMO role holder? After you updated Forward and Reverse Lookup Zones on 2003 Server, did you repeat the same process on 2008 R2? Is your 2008 R2 Server a GC (Global Catalog) server? Your static IP configuration should be: Server's own IP first Secondary Server IP External Server IPs Example1: 192.168.1.1 192.168.1.2 8.8.8.8 Example2: 192.168.1.2 192.168.1.1 8.8.8.8
ricki Posted June 26, 2012 Posted June 26, 2012 HI IN nds for the forward and reverse lookups is the dynamic updates to secure only. Plus is the zone transfers set correctly so the correct servers get the dns transfered to them. Richard
ricki Posted June 26, 2012 Posted June 26, 2012 Have you done a netdiag and a dcdiag on the windows 2003 server. Does repadmin /showrepl There are other repadmin commands see here they may give you a clue. Repadmin Richard
Michael Posted June 26, 2012 Posted June 26, 2012 HI IN nds for the forward and reverse lookups is the dynamic updates to secure only. Plus is the zone transfers set correctly so the correct servers get the dns transfered to them. Richard You can have just Dynamic Updates, but I agree Secure Updates are better. For those that don't know, Secure Updates basically means only authenticated clients in the domain can make changes to DNS. This stops any external or rogue devices messing your DNS setup! Again, like Zone Transfers, Secure Updates has to be specified on the Forward and all Reverse Lookup Zones in turn.
LordNewton Posted June 27, 2012 Author Posted June 27, 2012 @Michael Yes I enabled zone transfers on both servers for forward and reverse look up zones The 2K3 server is the role holder for all FSMO's The 2K8 Server is a GC Ive just set the IP DNS config to your recommendations (the 2k8 server was pointing to the 2k3 as primary DNS) @ricki The dynamic updates was secure - Ive reduced it to none secure (grasping at straws now) Zone transfers is set to all DCs Dcdiag on the 2k3 server doesnt return any errors. The repadmin on both servers says successfull or all items Thanks both for your help, please keep the ideas coming.
LordNewton Posted June 27, 2012 Author Posted June 27, 2012 just to add Both servers have their firewalls disabled, and there is no SYSVOL share on the 2k8 server
LordNewton Posted June 27, 2012 Author Posted June 27, 2012 FIXED IT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I *think* doing this has fixed it Using the BurFlags registry key to reinitialize File Replication Service replica sets (I tired this on Monday and it didnt work) DCdiag doesnt list any more errors!, the SYSVOL is there! Hopefully it will stay working Thank you everyone for your help and support, its been much needed! 1
Michael Posted June 27, 2012 Posted June 27, 2012 Good job, glad you got it sorted. The last time I used Burflags was between a 2000/2003 server, many moons ago!
Japtastic Posted March 19, 2014 Posted March 19, 2014 I know it's old but this really helped me out today. I had to set the current primary DC to burflag D4 and the new one to D2.
Michael Posted March 19, 2014 Posted March 19, 2014 I know it's old but this really helped me out today. I had to set the current primary DC to burflag D4 and the new one to D2. Normally setting the existing FSMO DC to 'D4' should be suffice as it becomes authoritative above everything else. You only need to use D2 if the other DC wouldn't play ball after this. Even in a small environment, it can take a good 30 mins or more to re-build and replicate out.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now