This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 90%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWL%3C/text%3E%3C/svg%3E)
Hi Everyone,
I have 5 DC servers mixed Windows 2008 R2 / 2012 r2 / 2019. Scheme is 2008.
There was a mdc02 (win 2019) but it's been removed due to error. Therefore I have disconnected and forced remove it by powershell script.
Since namespace of DFS file server have problem - The namespaces on myoffice.com cannot be enumerated. The RPC server is unavailable.
Then I have run "Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log" on PDC (mdc01).
Starting test: FrsEvent
* The File Replication Service Event log test
Skip the test because the server is running DFSR.
......................... MDC01 passed test FrsEvent
Starting test: DFSREvent
The DFS Replication Event Log.
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
A warning event occurred. EventID: 0x80001396
Time Generated: 09/19/2023 11:08:48
Event String:
The DFS Replication service is stopping communication with partner MDC02 for replication group Domain System Volume due to an error. The service will retry the connection periodically.
Additional Information:
Error: 1723 (The RPC server is too busy to complete this operation.)
Connection ID: 876085F3-8EC3-4C21-82AB-A5B1FCED7472
Replication Group ID: A6C0C1B1-ED35-494A-8670-C89ED8B557B1
An error event occurred. EventID: 0xC0001390
Time Generated: 09/19/2023 11:09:28
Event String:
The DFS Replication service failed to communicate with partner MDC02 for replication group Domain System Volume. This error can occur if the host is unreachable, or if the DFS Replication service is not running on the server.
Starting test: FrsEvent
* The File Replication Service Event log test
Skip the test because the server is running DFSR.
......................... ad02 passed test FrsEvent
Starting test: DFSREvent
The DFS Replication Event Log.
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
A warning event occurred. EventID: 0x80001396
Time Generated: 09/18/2023 18:25:26
Event String:
The DFS Replication service is stopping communication with partner MDC03 for replication group Domain System Volume due to an error. The service will retry the connection periodically.
Additional Information:
Error: 9036 (Paused for backup or restore)
Connection ID: 2101F649-E22A-4D29-BF25-B9A43E5664BC
Replication Group ID: A6C0C1B1-ED35-494A-8670-C89ED8B557B1
A warning event occurred. EventID: 0x80001396
Time Generated: 09/19/2023 01:42:12
Event String:
The DFS Replication service is stopping communication with partner MDC01 for replication group Domain System Volume due to an error. The service will retry the connection periodically.
There are DFS replication issue for all DC servers.
The DFS Replication Event Log.
The DFS Replication service is stopping communication with partner
Please what to do. I was demote mdc02 (Since it's encountered Windows update issue).
I just do not know what's the fault ?
Thanks in advance,
Will.
Additional Information: Error: 9036 (Paused for backup or restore)
This is normal and expected behavior, so nothing to worry about.
--please don't forget to close up the thread here by marking answer if the reply is helpful--
Just checking if there's any progress or updates?
--please don't forget to close up the thread here by marking answer if the reply is helpful--
Hi Dave,
Great to hear your reply.
For Error 9036, checked that moment should be running server backup job.
Also found other error from the log,
Since the DFS namespace can't be displayed & failure to add new DFS server (for migration purpose).
I guess it's related to DC issue.
For those issue, could you please give me some ideas for investigation?
Thanks
I'd suggest opening a new thread about this new topic.
--please don't forget to close up the thread here by marking answer if the reply is helpful--
Hi Dave,
Thanks again.
I have opened new thread. Hope to see you again.
https://learn.microsoft.com/en-us/answers/questions/1372926/problem-with-dfs-namespace-server-issue
Sounds good, you're welcome.
Hi Dave,
I have other findings on PDC server (MDC01).
It showed other errors. There is other issue on DC ?
Thanks
dcdiag /s:mdc01 /q
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... MDC01 failed test DFSREvent
An error event occurred. EventID: 0x8000002A
Time Generated: 09/20/2023 11:44:48
Event String: The Kerberos Key Distribution Center lacks strong keys for account krbtgt.
An error event occurred. EventID: 0x80000025
Time Generated: 09/20/2023 12:00:18
Event String:
The Key Distribution Center (KDC) encountered a ticket that did not contain information about the account that requested the ticket while processing a request for another ticket. This prevented security checks from running and could open security vulnerabilities. See https://go.microsoft.com/fwlink/?linkid=2173051 to learn more.
......................... MDC01 failed test SystemLog
dcdiag /s:company.com.hk /q
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... DC01 failed test DFSREvent
An error event occurred. EventID: 0x8000002A
Time Generated: 09/20/2023 11:37:41
Event String: The Kerberos Key Distribution Center lacks strong keys for account krbtgt.
An error event occurred. EventID: 0x000016AD
Time Generated: 09/20/2023 11:57:09
Event String:
The session setup from the computer WIN10-22H2-8 failed to authenticate. The following error occurred:
An error event occurred. EventID: 0x0000165B
Time Generated: 09/20/2023 12:18:12
Event String:
The session setup from computer 'WIN10-22H2-8' failed because the security database does not contain a trust account 'WIN10-22H2-8$' referenced by the specified computer.
......................... DC01 failed test SystemLog
Event ID 42 Description: The Kerberos Key Distribution Center lacks strong keys for account krbtgt. You must update the password of this account to prevent use of insecure cryptography.
Translation: The krbtgt account has not been reset since AES was introduced into the environment.
Resolution: Reset the krbtgt account password after ensuring that AES has not been explicitly disabled on the DC.
Hi Dave,
How can I check AES is enabled or not ?
Otherwise, may I know just reset krbtgt password under Active Directory Users and Computers ?
=====================
Also have other Event ID 5805, 5723 is about NETLOGON.
The session setup from the computer XXX failed to authenticate. The following error occurred: Access is denied.
I would like to remove XXX but couldn't find it in AD. May I know how can I remove it ?
Thanks