Unable to promote a new DC

Question

We have 3 domain controllers, on october 2023 we decomise two domain controllers due to eol of windows server 2012, the FSMO roles were transfered from one of these dcs to a new one, but im thinking that wasnt doit correctly

now we need to promote a new one and the situation its, firts i get a error on delegating the domain zone, and if I bypass the warning the dc gets promoted, joined on domain cotrolles ou, the replica conectors gets created but the replication never ends, always get only a part of the data, ous, users, etc, the sysvol and netlogon shares never get up

I already try with 2022, 2019 and 2016, always the same situation

Tnaks in advance for any advice

I believe this is a dns related situation

But im not shure how to diagnose

Answer 1

Hi Emilio MartínAlvarado,

Thank you for posting in the Microsoft Community Forums.

First, verify that the FSMO (Flexible Single Master Operation) roles have been properly transferred to the new DC.The FSMO roles include Architecture Hosts, Domain Naming Hosts, PDC Emulators, RID Hosts, and Infrastructure Hosts. These roles are critical to the proper functioning of the domain. You can use the netdom query fsmo command to view the current holders of the FSMO roles at the command line.

If you find that the FSMO roles have not been transferred correctly, you will need to use the netdom seize fsmo command to force the acquisition of these roles. Note, however, that this is usually a last resort when the original FSMO role holder is unavailable, as it interrupts replication and can lead to data inconsistencies.

2. Resolving delegate domain region errors

Errors encountered when delegating domain regions can be caused by a variety of reasons including, but not limited to, DNS issues, permissions issues, or domain controller configuration errors. Here are some steps to resolve them:

Check DNS: Ensure that all DCs are properly resolving DNS records, especially SRV records, which are used to locate domain controllers and global catalogs.

Check permissions: Make sure that the user performing the delegated action has sufficient permissions. Typically, this requires being a member of the Enterprise Admins or Domain Admins group.

Check Domain Controller Configuration: Ensure that all DCs are properly configured and running the latest updates and patches.

3. Troubleshooting replication

The problem of never-ending replication and getting only part of the data can be caused by a variety of replication errors. Here are some steps to resolve them:

Run DCDIAG: Use the dcdiag tool to diagnose the health and replication status of the domain controller. The tool will check several aspects such as DNS, replication, event logs, etc.

Check replication status: use the repadmin /showrepl command to view the replication status of the domain controller. Note any failed replication attempts or delays.

Resolve replication conflicts: If conflicts arise during replication, you may need to resolve them manually. In some cases, you may need to restore data from a backup.

4. Starting SYSVOL and Netlogon Shares

If the SYSVOL and Netlogon shares are not started, this is usually caused by problems with the DFS Replication Service (DFSR) or File Replication Service (FRS). Here are some steps to resolve this:

Check DFSR status: If your environment is using DFSR (Windows Server 2008 R2 and later), make sure that the DFSR service is running and that there are no errors or warning events.

Force an authoritative synchronization: If there is a problem with DFSR, you may need to force an authoritative synchronization to restore the SYSVOL and Netlogon shares. Note, however, that this may result in data loss.

Check FRS status (if applicable): If your environment is still using FRS (Windows Server 2003 and earlier), make sure that the FRS service is running and there are no errors or warning events. Note, however, that FRS has been replaced by DFSR in Windows Server 2008 R2 and later.

5. Upgrade and Migration Strategy

Since Windows Server 2012 has reached EOL (End of Life), it is recommended that the remaining DCs be upgraded to a higher version of Windows Server, such as Windows Server 2016, Windows Server 2019, or Windows Server 2022.This will not only resolve issues associated with older versions, but also provide better performance and security.

Best regards

Neuvi Jiang