DC Diag error

[LordNewton]

Just promoted a 2008 r2 SERVER (DC01)to be a DC in an domain with an existing 2003 R2 (Server) server, but nothings replicating

I can ping both servers from each other

 

the results of DCdiag hold the clue but no idea how to fix it, google is having an off day...

 

 

Directory Server Diagnosis

 

 

Performing initial setup:

 

Trying to find home server...

 

Home Server = DC01

 

* Identified AD Forest.

Done gathering initial info.

 

 

Doing initial required tests

 

 

Testing server: Default-First-Site-Name\DC01

 

Starting test: Connectivity

 

......................... DC01 passed test Connectivity

 

 

 

Doing primary tests

 

 

Testing server: Default-First-Site-Name\DC01

 

Starting test: Advertising

 

Warning: DsGetDcName returned information for \\server.STPETERS.COM,

 

when we were trying to reach DC01.

 

SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.

 

......................... DC01 failed test Advertising

 

Starting test: FrsEvent

 

There are warning or error events within the last 24 hours after the

 

SYSVOL has been shared. Failing SYSVOL replication problems may cause

 

Group Policy problems.

......................... DC01 passed test FrsEvent

 

Starting test: DFSREvent

 

......................... DC01 passed test DFSREvent

 

Starting test: SysVolCheck

 

......................... DC01 passed test SysVolCheck

 

Starting test: KccEvent

 

......................... DC01 passed test KccEvent

 

Starting test: KnowsOfRoleHolders

 

......................... DC01 passed test KnowsOfRoleHolders

 

Starting test: MachineAccount

 

......................... DC01 passed test MachineAccount

 

Starting test: NCSecDesc

 

......................... DC01 passed test NCSecDesc

 

Starting test: NetLogons

 

Unable to connect to the NETLOGON share! (\\DC01\netlogon)

 

[DC01] An net use or LsaPolicy operation failed with error 67,

 

The network name cannot be found..

 

......................... DC01 failed test NetLogons

 

Starting test: ObjectsReplicated

 

......................... DC01 passed test ObjectsReplicated

 

Starting test: Replications

 

[Replications Check,DC01] DsReplicaGetInfo(PENDING_OPS, NULL) failed,

 

error 0x2105 "Replication access was denied."

 

......................... DC01 failed test Replications

 

Starting test: RidManager

 

......................... DC01 passed test RidManager

 

Starting test: Services

 

......................... DC01 passed test Services

 

Starting test: SystemLog

 

 

Running partition tests on : ForestDnsZones

 

Starting test: CheckSDRefDom

 

......................... ForestDnsZones passed test CheckSDRefDom

 

Starting test: CrossRefValidation

 

......................... ForestDnsZones passed test

 

CrossRefValidation

 

 

Running partition tests on : DomainDnsZones

 

Starting test: CheckSDRefDom

 

......................... DomainDnsZones passed test CheckSDRefDom

 

Starting test: CrossRefValidation

 

......................... DomainDnsZones passed test

 

CrossRefValidation

 

 

Running partition tests on : Schema

 

Starting test: CheckSDRefDom

 

......................... Schema passed test CheckSDRefDom

 

Starting test: CrossRefValidation

 

......................... Schema passed test CrossRefValidation

 

 

Running partition tests on : Configuration

 

Starting test: CheckSDRefDom

 

......................... Configuration passed test CheckSDRefDom

 

Starting test: CrossRefValidation

 

......................... Configuration passed test CrossRefValidation

 

 

Running partition tests on : STPETERS

 

Starting test: CheckSDRefDom

 

......................... STPETERS passed test CheckSDRefDom

 

Starting test: CrossRefValidation

 

......................... STPETERS passed test CrossRefValidation

 

 

Running enterprise tests on : STPETERS.com

 

Starting test: LocatorCheck

 

......................... STPETERS.com passed test LocatorCheck

 

Starting test: Intersite

 

......................... STPETERS.com passed test Intersite

 

Please help.....

[Michael]

DNS is the root cause of replication not working correctly.

 

If you open up DNS on your 2003 R2 server, in turn on both Forward and Reverse lookup zones, make sure Zone Transfers are enabled.

 

Then open up Active Directory Sites and Services on your 2003 R2 server, expand Default-First-Site-Name > Servers > Servername. Here you should be able to force replication manually. If it works then great, but if it doesn't, then double check DNS again.

[LordNewton]

Thanks Michael

 

Zone Transfers wasnt enabled - so Ive turned that on, and Ive forced a replication (I think) and i get a pop up saying AD has replicated all the connections, but the error is still listed in DC Diag.

 

DCDiag only returned errors on the 2K8 server

[Michael]

Run this batch file and it'll clear all logs on 2008 Server. Sometimes dcdiag reports errors from the reported event logs.

 

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit

 

You should also make sure you've run:

 

adprep /rodcprep

 

Otherwise there's a section of 2008 dcdiag which will always report an error until you do so.

 

I'd also recommend you download/install dcdiag for 2003 R2 server too.

[LordNewton]

Still no joy - the 2003 server pass's everything on when run (2003) Dcdiag on it

[tmcd0035]

technet.microsoft.com/Forums/en-CA/windowsserver2008r2general/thread/15511d6d-aa2e-4b18-b7b7-6a5a39f867f6

 

did you run adprep /forestprep and adprep /domainprep before introducing the 2008r2 server?

[LordNewton]

 

did you run adprep /forestprep and adprep /domainprep before introducing the 2008r2 server?

 

Yes I did, just checking your link now

Thanks

[LordNewton]

You link doesnt go to a specific page??

[ricki]

Have you checked the settings on you network card for ip, subnet dns ,etc on the servers

 

Richard

[LordNewton]

Yes 100's of times, I've set the 2k8 servers primary DNS to the 2K3 server, and they can ping each other by name and ip address

[Michael]

So when you run dcdiag now, what does it look like?

[LordNewton]

Still the same

[Michael]

The thing that bothers me most about your dciag output is:

 

SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.

 

Is your 2003 Server still the FSMO role holder? After you updated Forward and Reverse Lookup Zones on 2003 Server, did you repeat the same process on 2008 R2? Is your 2008 R2 Server a GC (Global Catalog) server?

 

Your static IP configuration should be:

 

Server's own IP first

Secondary Server IP

External Server IPs

 

Example1:

192.168.1.1

192.168.1.2

8.8.8.8

 

Example2:

192.168.1.2

192.168.1.1

8.8.8.8

[ricki]

HI

 

IN nds for the forward and reverse lookups is the dynamic updates to secure only.

 

Plus is the zone transfers set correctly so the correct servers get the dns transfered to them.

 

Richard

[ricki]

Have you done a netdiag and a dcdiag on the windows 2003 server.

 

Does repadmin /showrepl

 

There are other repadmin commands see here they may give you a clue.

 

Repadmin

 

Richard

[Michael]

HI

 

IN nds for the forward and reverse lookups is the dynamic updates to secure only.

 

Plus is the zone transfers set correctly so the correct servers get the dns transfered to them.

 

Richard

 

You can have just Dynamic Updates, but I agree Secure Updates are better. For those that don't know, Secure Updates basically means only authenticated clients in the domain can make changes to DNS. This stops any external or rogue devices messing your DNS setup!

 

Again, like Zone Transfers, Secure Updates has to be specified on the Forward and all Reverse Lookup Zones in turn.

[LordNewton]

@Michael

Yes I enabled zone transfers on both servers for forward and reverse look up zones

The 2K3 server is the role holder for all FSMO's

The 2K8 Server is a GC

 

Ive just set the IP DNS config to your recommendations (the 2k8 server was pointing to the 2k3 as primary DNS)

 

 

@ricki

The dynamic updates was secure - Ive reduced it to none secure (grasping at straws now)

Zone transfers is set to all DCs

Dcdiag on the 2k3 server doesnt return any errors.

 

The repadmin on both servers says successfull or all items

 

Thanks both for your help, please keep the ideas coming.

[LordNewton]

just to add

 

Both servers have their firewalls disabled, and there is no SYSVOL share on the 2k8 server

[LordNewton]

FIXED IT!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

 

I *think* doing this has fixed it Using the BurFlags registry key to reinitialize File Replication Service replica sets (I tired this on Monday and it didnt work)

 

DCdiag doesnt list any more errors!, the SYSVOL is there!

 

Hopefully it will stay working

 

Thank you everyone for your help and support, its been much needed!

[mac_shinobi]

Thanks for the feedback / update

[Michael]

Good job, glad you got it sorted. The last time I used Burflags was between a 2000/2003 server, many moons ago!

[Japtastic]

I know it's old but this really helped me out today. I had to set the current primary DC to burflag D4 and the new one to D2.

[Michael]

I know it's old but this really helped me out today. I had to set the current primary DC to burflag D4 and the new one to D2.

 

Normally setting the existing FSMO DC to 'D4' should be suffice as it becomes authoritative above everything else. You only need to use D2 if the other DC wouldn't play ball after this. Even in a small environment, it can take a good 30 mins or more to re-build and replicate out.