Errors on the network

[wesleyw]

Currently running a Windows 2008 domain.

 

Some time ago we had a fault which caused the DCs to die horribly. After restoring the network to some level of functionality things have been working fine until recently. Firstly I've had a few machines randomly drop trusts with our AD. Secondly I created a new DC as a backup and dcpromo'd it onto the domain. However the backup server will blue screen/crash/core dump when logging in and our Primary domain controller has been giving out 5722 errors (SID faults it looks like) on several other computers even though this doesn't seem to have affected anyone logging in?

 

I decided to run a few checks the first being NLTEST /server: /SC_query:

 

from which i got: I_NetLogonControl failed: Status = 1722 0x6ba RPC_S_SERVER_UNAVAILABLE

 

Slightly perturbed I then ran

 

nltest /dsregdns

 

this came back

Flags: 0

Connection Status = 0 0x0 NERR_Success

The command completed successfully

 

 

 

I have since run dcdiag /c /v

 

and output this to a text file.

 

Points to worry about in the file seem to be:

 

 

Starting test: CheckSecurityError

 

* Dr Auth: Beginning security errors check!

Found KDC PDC for domain domain.local in site Default-First-Site-Name

Checking machine account for DC PDC on DC PDC.

* SPN found :LDAP/PDC.domain.local/domain.local

* SPN found :LDAP/PDC.domain.local

* SPN found :LDAP/PDC

* SPN found :LDAP/PDC.domain.local/domain

* SPN found :LDAP/b51abd5d-d6df-4145-9d54-e144c20e1779._msdcs.domain.local

* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/b51abd5d-d6df-4145-9d54-e144c20e1779/domain.local

* SPN found :HOST/PDC.domain.local/domain.local

* SPN found :HOST/PDC.domain.local

* SPN found :HOST/PDC

* SPN found :HOST/PDC.domain.local/domain

* SPN found :GC/PDC.domain.local/domain.local

Source DC BDC has possible security error (1722).

 

Diagnosing...

 

Found KDC PDC for domain domain.local in site Default-First-Site-Name

Checking time skew between servers:

BDC

PDC

Error 53 querying time on DC BDC. Ignoring this DC and

 

continuing...

 

Time skew error between client and 1 DCs! ERROR_ACCESS_DENIED

 

or down machine received by:

 

BDC

[bDC] DsBindWithSpnEx() failed with error 1722,

 

Win32 Error 1722.

Printing RPC Extended Error Info:

 

Error Record 1, ProcessID is 6104

(DcDiag)

 

System Time is: 6/26/2012 16:1:3:38

 

Generating component is 2 (RPC runtime)

 

Status is 1722 The RPC server is unavailable.

 

 

Detection location is 501

 

NumberOfParameters is 4

 

Unicode string: ncacn_ip_tcp

 

Unicode string:

 

be448425-24c3-4c1e-a3cf-ac4f2f7d1ea9._msdcs.domain.local

 

Long val: -481213899

 

Long val: 1722

 

Error Record 2, ProcessID is 6104

(DcDiag)

 

System Time is: 6/26/2012 16:1:3:38

 

Generating component is 8 (winsock)

 

Status is 1722 The RPC server is unavailable.

 

 

Detection location is 1442

 

NumberOfParameters is 1

 

Unicode string:

 

be448425-24c3-4c1e-a3cf-ac4f2f7d1ea9._msdcs.domain.local

 

Error Record 3, ProcessID is 6104

(DcDiag)

 

System Time is: 6/26/2012 16:1:3:38

 

Generating component is 8 (winsock)

 

Status is 1237

 

The operation could not be completed. A retry should be performed.

 

 

Detection location is 313

 

Error Record 4, ProcessID is 6104

(DcDiag)

 

System Time is: 6/26/2012 16:1:3:38

 

Generating component is 8 (winsock)

 

Status is 10060

 

A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

 

 

Detection location is 311

 

NumberOfParameters is 3

 

Long val: 135

 

Pointer val: 0

 

Pointer val: 0

 

Error Record 5, ProcessID is 6104

(DcDiag)

 

System Time is: 6/26/2012 16:1:3:38

 

Generating component is 8 (winsock)

 

Status is 10060

 

A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.

 

 

Detection location is 318

 

Ignoring DC BDC in the convergence test of object

 

CN=PDC,OU=Domain Controllers,DC=domain,dc=local, because we cannot

 

connect!

 

Checking for CN=PDC,OU=Domain Controllers,DC=domain,dc=local in domain DC=domain,dc=local on 1 servers

Object is up-to-date on all servers.

......................... PDC failed test CheckSecurityError

 

Starting test: CutoffServers

 

* Configuration Topology Aliveness Check

* Analyzing the alive system replication topology for DC=ForestDnsZones,DC=domain,dc=local.

* Performing upstream (of target) analysis.

* Performing downstream (of target) analysis.

* Analyzing the alive system replication topology for DC=DomainDnsZones,DC=domain,dc=local.

* Performing upstream (of target) analysis.

* Performing downstream (of target) analysis.

* Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=domain,dc=local.

* Performing upstream (of target) analysis.

* Performing downstream (of target) analysis.

* Analyzing the alive system replication topology for CN=Configuration,DC=domain,dc=local.

* Performing upstream (of target) analysis.

* Performing downstream (of target) analysis.

* Analyzing the alive system replication topology for DC=domain,dc=local.

* Performing upstream (of target) analysis.

* Performing downstream (of target) analysis.

......................... PDC passed test CutoffServers

 

Starting test: FrsEvent

 

* The File Replication Service Event log test

Skip the test because the event log File Replication Service does not exist.

......................... PDC passed test FrsEvent

 

Starting test: DFSREvent

 

The DFS Replication Event Log.

There are warning or error events within the last 24 hours after the

 

SYSVOL has been shared. Failing SYSVOL replication problems may cause

 

Group Policy problems.

An Error Event occurred. EventID: 0xC0001390

 

Time Generated: 06/25/2012 17:18:48

 

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = DFS Replication) could not be retrieved,

 

error 0x3afc)

 

An Error Event occurred. EventID: 0xC0001390

 

Time Generated: 06/26/2012 01:23:20

 

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = DFS Replication) could not be retrieved,

 

error 0x3afc)

 

An Error Event occurred. EventID: 0xC0001390

 

Time Generated: 06/26/2012 09:27:53

 

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = DFS Replication) could not be retrieved,

 

error 0x3afc)

 

......................... PDC failed test DFSREvent

 

 

 

Any ideas on addressing this issue without having to rebuild the domain from scratch.

 

 

Wes

[Michael]

The one thing that sticks out is 'The RPC server is unavailable'. Have you checked the RPC service is running?

 

I'd also say DNS may need a look at too. You could try stopping and restarting DNS, or even try re-creating your zones just to be sure.

 

As for your BDC blue screening, there's clearly other issues there. I would probably disconnect it and get your PDC working perfectly, then focus on your BDC.

[wesleyw]

The "Status is 1722 The RPC server is unavailable." error seems to be caused by the BDC not being contacted. Main RPC service on both PDC and BDC is running. BDC only crashes when trying to log into it as any user. The NLTEST /server: /SC_query: error turns out to be only happening when you put the PDC name into the command from the PDC itself no problem otherwise.

 

 

Wes