Errors on dcdiag checking after added new DC

Question

Hi,

I have got DC on Widows Server 2012r2(DFSR is enabled) and I added new DC with Windows Server 2019 OS - I did it, because I would like demote old DC.

After added new DC I checked dcdiag and I had this:

 Testing server: Default-First-Site-Name\AD1
      Starting test: Connectivity
         ......................... AD1 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\AD1
      Starting test: Advertising
         Warning: DsGetDcName returned information for \\AD.contoso.local, when we were trying to reach AD1.
         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
         ......................... AD1 failed test Advertising
      Starting test: FrsEvent
         ......................... AD1 passed test FrsEvent
      Starting test: DFSREvent
         ......................... AD1 passed test DFSREvent
      Starting test: SysVolCheck
         ......................... AD1 passed test SysVolCheck
      Starting test: KccEvent
         ......................... AD1 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... AD1 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... AD1 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... AD1 passed test NCSecDesc
      Starting test: NetLogons
         Unable to connect to the NETLOGON share! (\\AD1\netlogon)
         [AD1] An net use or LsaPolicy operation failed with error 67, The network name cannot be found..
         ......................... AD1 failed test NetLogons

I don't have access to netlogon on new server and I have a problem with "DsGetDcName"

On checking dcdiag I have more errors:

Time Generated: 08/24/2023   17:02:04
            Event String:
            The processing of Group Policy failed. Windows attempted to read the file \\contoso.local\SysVol\contoso.local\Policies\{57B39CBE-068C-43C0-819B-381BDAD27B69}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
         A warning event occurred.  EventID: 0x0000008E
            Time Generated: 08/24/2023   17:22:06
            Event String:
            The time service has stopped advertising as a time source because the local clock is not synchronized.
         A warning event occurred.  EventID: 0x00000032
            Time Generated: 08/24/2023   17:22:06
            Event String:
            The time service detected a time difference of greater than 5000 milliseconds for 900 seconds. The time difference might be caused by synchronization with low-accuracy time sources or by suboptimal network conditions. The time service is no longer synchronized and cannot provide the time to other clients or update the system clock. When a valid time stamp is received from a time service provider, the time service will correct itself.
         A warning event occurred.  EventID: 0x80040020
            Time Generated: 08/24/2023   17:30:53
            Event String:
            The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.
         A warning event occurred.  EventID: 0x80040020

Any ideas?

EDIT: It's not 2022 OS it's 2019 OS - Sorry for mistake.

Answer 1

Please run;

Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log (run on PDC emulator)
repadmin /showrepl >C:\repl.txt (run on any domain controller)
ipconfig /all > C:\%computername%.txt (run on EVERY domain controller)

Also check the domain controller System and Replication (DFS or FRS) event logs for errors since last boot. Post the Event Source and Event IDs of any found. (no evtx files)

then put unzipped text files up on OneDrive and share a link.

Answer 2

Hello drClays,

Thank you for posting in Q&A forum.

From the information you provided, I can AD1 failed test Advertising as one DC.

To better understand you question, please help confirm the information below so that we can help you better.

1.Is your forest one forest with a single domain?
2.If you have only one domain, how many DCs are there in your Domain before you adding new 2022 DC?
3.If the old DC and AD replication works fine before you add the new 2022 DC?
4.Check can you see netlogon and sysvol folder by running net share on new DC.
5.can you access netlogon and sysvol folder on new DC.

It seems there might be one or more issue on your old DC or in your domain before adding new DC in your domain. I think the quick way you can try is:

1.Demote the new 2022 DC in the domain completely.

2.You should check if old 2012 R2 DC itself work fine or not. You can run Dcdiag /v on this DC to check the result.

3.If you have more than one DC before adding this new 2022 DC, you should not only check DC function itself on each DC, but also check the AD replication between all DCs in the domain. Run commands below on PDC.

repadmin /showrepl >c:\repsum1.txt

repadmin /replsum >c:\repsum2.txt

repadmin /showrepl * /csv >c:\repsum.csv

4.Check if SYSVOL replication works fine if you have more than one DC.

5.Check if group policy can apply successfully on client and DC.
Run gpupdate /force on one client and DC.

6.Check if time and date is correct on old DC/DCs.

If all is fine above, we can try to promote this 2022 server as DC and check if new DC works fine.

Hope the information above is helpful. If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

==========================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 3

There was 2 DC with WS2012r2. After added new DC with WS2022 I demote secondary DC with WS2012r2. I going to have only one DC.

Hopefully the 2012 is not yet demoted? You can try a non-authoritative sync

https://learn.microsoft.com/en-US/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization#how-to-perform-a-non-authoritative-synchronization-of-dfsr-replicated-sysvol-replication-like-d2-for-frs

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Something here could help.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/newly-promoted-domain-controller-fail-advertise

but there were likely problems with the 2012 before the 2022 was introduced. Might want to demote the new 2022, then work to clean up until dcdiag, System and DFS Replication event logs are all 100% free of errors before trying again.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

I can demote this DC with 2019 OS and add tomorrow DC with 2016 OS and check it. What do you think about it?

I would not do this. Trying to add a domain controller to a domain that already has problems just complicates the situation. If it were me, I'd demote the new 2022, (after doing so clear out the mentioned event logs before a reboot) then work to clean up until dcdiag, System and DFS Replication event logs are all 100% free of errors before trying again.

--please don't forget to upvote and Accept as answer if the reply is helpful--