Domain Controllers Replication issue

Yousuf Shahzad 26

Hello

We have been facing the below issue for a long:

We have two Windows Server 2012 DCs. Both the DCs stopped replicating for a long time and the time exceeds more than 3 years.

I installed/promoted another DC and followed all the steps to replicate with the 1st one but when I create a user in any of the DCs, I need to refresh, and then I can see the change. Both the DCs do not replicate automatically. I did not demote the second faulty DC.

The second issue is when I shut down the first domain, our employees cannot access shared folders and the internet.

All our roles are in our first DC.

Schema Master
Domain Name Master
PDC
RID Pool Manager
Infrastructure Master

What could be the possible solution? Please provide me as soon as possible because we do not have any redundant DC and our first DC is on a virtual machine and that server is creating some problem and can go down anytime.

Regards

6 answers

Gary Reynolds 9,621 Reputation points

2021-10-17T08:22:55.78+00:00

Hi Yousuf,

If you have restarted the DFS or the Active Directory Domain Services, then you can ignore these warning.

However, if you haven't, I would suggest that you review the event log for the DFS services and see if there are any error being reported:

Gary.
Please sign in to rate this answer.
Yousuf Shahzad 26 Reputation points

2021-10-17T11:57:29.817+00:00

Hi Gary

Please check my comments below

I did not restart DFS.

Below are event logs from DC2

I also checked DNS entry and found "Special Permissions" missing in the new DC, but it is present is the faulty DC.

Maybe if I add the permission, replication starts working or maybe the group policy issue gets resolved.

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-17T12:17:01.38+00:00

Hi Yousuf,

I can't see all the pictures, but here is an article to resolve your DFRS issue https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dfsr-event-id-2213

If you could re-port the other DNS pictures, I'll have a look.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-17T13:14:02.143+00:00

Hi Gary

I have shared all the images again.

Please have a look at it and advice me.

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-17T21:02:25.283+00:00

Hi Yousuf,

Follow the previous DFSR link to fix that issue.

Can you please check the permissions for the same DNS record on DC1, to see if the same permission is set on that DC, you will need to click on the Advanced button in the dialog to get the full details of the permissions that have been assigned to the Everyone trustee.

To confirm the state of the DC replication run the following commands, errors associated to the old DC can be ignored

repadmin /replsummary repadmin /showreps

Please share the details of the GPO issue you are experiencing.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-18T05:30:25.073+00:00

Hi Gary

Please check below Directory Services Logs from DC2.

My question is why DC2 is trying to establish a replication link with the old/faulty DC while that faulty DC is already shut down?? This is really strange!!! Isn't it?

DC2 should establish a replication link with DC1 rather than the faulty one.

Should I delete all the entries of the old/faulty DC?

Regards

Yousuf

Yousuf Shahzad 26 Reputation points

2021-10-18T06:10:59.087+00:00

Hi Gary

Yes, The permission for the same DNS record on DC1 is exactly the same as on faulty DC.
Should I add that 'special permissions' in new DC by going to 'advance' option?

Please check the result for both the commands

repadmin /replsummary

repadmin /showreps

repadmin /replsummary https://www.catalog.update.microsoft.com/search.aspx?q=2663685 Source DSA largest delta fails/total %% error DC-01 37m:45s 0 / 5 0 DC-02 >60 days 5 / 5 100 (1722) The RPC server is unavailable. DC-02new 40m:47s 0 / 5 0 Destination DSA largest delta fails/total %% error DC-01 >60 days 5 / 10 50 (1722) The RPC server is unavailable. DC-02new 38m:06s 0 / 5 0 Experienced the following operational errors trying to retrieve replication info rmation: 58 - DC-02.abc.local

Regards

Yousuf

Yousuf Shahzad 26 Reputation points

2021-10-18T06:51:18.717+00:00

Hi Gary

repadmin /showreps Default-First-Site-Name\DC-01 DSA Options: IS_GC Site Options: (none) DSA object GUID: 6cb203fb-7b8b-417d-a51e-5a6a19ebffeb DSA invocationID: 6cb203fb-7b8b-417d-a51e-5a6a19ebffeb ==== INBOUND NEIGHBORS ====================================== DC=abc,DC=local Default-First-Site-Name\DC-02 via RPC DSA object GUID: f551c054-a5f4-46db-bd0d-886f8d437f39 Last attempt @ 2021-10-18 07:56:07 failed, result 1722 (0x6ba): The RPC server is unavailable. 33979 consecutive failure(s). Last success @ 2017-12-10 08:51:35. Default-First-Site-Name\DC-02new via RPC DSA object GUID: 1039b036-56bc-493e-9bf4-7a3f7a314f81 Last attempt @ 2021-10-18 08:43:17 was successful. CN=Configuration,DC=abc,DC=local Default-First-Site-Name\DC-02 via RPC DSA object GUID: f551c054-a5f4-46db-bd0d-886f8d437f39 Last attempt @ 2021-10-18 07:56:49 failed, result 1722 (0x6ba): The RPC server is unavailable. 33822 consecutive failure(s). Last success @ 2017-12-10 08:51:35. Default-First-Site-Name\DC-02new via RPC DSA object GUID: 1039b036-56bc-493e-9bf4-7a3f7a314f81 Last attempt @ 2021-10-18 07:56:49 was successful.

Yousuf Shahzad 26 Reputation points

2021-10-18T06:56:46.573+00:00

Hi Gary

CN=Schema,CN=Configuration,DC=abc,DC=local Default-First-Site-Name\DC-02 via RPC DSA object GUID: f551c054-a5f4-46db-bd0d-886f8d437f39 Last attempt @ 2021-10-18 07:57:31 failed, result 1722 (0x6ba): The RPC server is unavailable. 33822 consecutive failure(s). Last success @ 2017-12-10 08:51:35. Default-First-Site-Name\DC-02new via RPC DSA object GUID: 1039b036-56bc-493e-9bf4-7a3f7a314f81 Last attempt @ 2021-10-18 07:57:31 was successful. DC=DomainDnsZones,DC=abc,DC=local Default-First-Site-Name\DC-02 via RPC DSA object GUID: f551c054-a5f4-46db-bd0d-886f8d437f39 Last attempt @ 2021-10-18 07:56:07 failed, result 1256 (0x4e8): The remote system is not available. For information about network tr oubleshooting, see Windows Help. 33896 consecutive failure(s). Last success @ 2017-12-10 08:51:35. Default-First-Site-Name\DC-02new via RPC DSA object GUID: 1039b036-56bc-493e-9bf4-7a3f7a314f81 Last attempt @ 2021-10-18 08:03:29 was successful.

Yousuf Shahzad 26 Reputation points

2021-10-18T06:57:06.747+00:00

Hi Gary

DC=ForestDnsZones,DC=abc,DC=local Default-First-Site-Name\DC-02 via RPC DSA object GUID: f551c054-a5f4-46db-bd0d-886f8d437f39 Last attempt @ 2021-10-18 07:56:07 failed, result 1256 (0x4e8): The remote system is not available. For information about network tr oubleshooting, see Windows Help. 33870 consecutive failure(s). Last success @ 2017-12-10 08:51:35. Default-First-Site-Name\DC-02new via RPC DSA object GUID: 1039b036-56bc-493e-9bf4-7a3f7a314f81 Last attempt @ 2021-10-18 07:57:31 was successful. DsReplicaGetInfo() failed with status 8453 (0x2105): Replication access was denied. DsReplicaGetInfo() failed with status 8453 (0x2105): Replication access was denied.

Gary Reynolds 9,621 Reputation points

2021-10-18T08:03:52.173+00:00

Hi Yousuf,

The reports are showing that the replication is working correctly between DC1 and new DC2, you are seeing errors as the DCs are trying to replicate with the faulty DC, they will continue to try to replicate with the faulty DC even though you have switched it off. If you want to fix these errors, you need to do the meta data cleanup as described in the links that DSPatrick shared.

The special permissions assigned to everyone might not be required, do you have a screenshot of the advanced permissions dialog with the special permissions that have been assigned?

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-18T08:27:58.657+00:00

Hi Gary

The last option is meta data cleanup or if I delete all the entries of a faulty DC. Will it solve the issue??

Please check below screenshots:

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-18T09:39:18.077+00:00

Hi Yousuf,

The only difference I can see is that the read all properties is not set but has specific read access to all the attributes on the faulty DC, As you have just rebuilt the new DC I wouldn't make any changes to the permissions to match the existing DCs.

Don't think you ave any issues to resolve here.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-18T10:34:53.463+00:00

Hi Gary

Please check some more screenshots to better understand the issue:

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-18T11:17:34.273+00:00

Hi Yousuf,

You would have made your life easier if you had used a different name for the new server.

The AD when it's automatically creating the replication partners, it doesn't know which DCs are good or bad, all it know is that there is a list of DC and will assign replicated partners based on the DC picked be the algorithm. You will need to complete the meta data clean up to delete the old DC and then the replication partner will be updated based solely on the two remaining DCs. Just make sure you remove the right DC when you are doing the cleanup.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-19T06:06:28.433+00:00

Hi Gary

Wao!! the metadata cleanup worked properly without disturbing DC1, and now all the entries of the faulty DC have been removed.

Most importantly, now if I shut down DC1, our other clients can log on properly and can access shared folders and the internet properly. Great

But, the problem of DFS replication is still there, which means the replication is restarting after a certain time period.

****When I restart DC2 and immediately check sysvol folder, it shows me all the policies, but after some time if I again check sysvol, it does not show me policies.**

**gpupdate /force updates DC2 group policies after DC2 restarts, but after some time, it does not.****

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-19T06:23:29.79+00:00

Hi Yufsuf,

Follow this article to fix the DFSR restart problem dfsr-event-id-2213

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-20T06:25:42.697+00:00

Hi Gary

I will follow the link to solve the DFSR restart problem and let you know very soon.

Regards

Yousuf

Yousuf Shahzad 26 Reputation points

2021-10-21T08:08:06.41+00:00

Hi Gary

What. where and how to take backup for the below step:

Back up the files in all replicated folders on the volume. Failure to do this may result in data loss from unexpected conflict resolution during the recovery of the replicated folders. I am sure I will perform all the steps on DC2 Server. Am I right?

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-21T08:40:41.177+00:00

Hi Yousuf,

Your normal server backup would have backup the files in the DFSR shares, as the files are replicated from DC1, if you have a backup of DC1 you should also be covered. If you want belt and braces, just copy the files in the DFSR shares to another folders on a different drive.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-21T09:56:07.247+00:00

Hi Gary

Actually, I could not get you.

Can you please elaborate on whatever you mentioned in your previous reply?

Thanks

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-21T20:37:25.157+00:00

Hi Yousuf,

I'm making the assumption that you have a backup solution which is backing up the DCs in your environment.

If this is the case, if the last backup as successful, you have already completed the backup requirement.

If not, I would backup DC1 as this should have the most consistent version of the sysvol directory.

The other option I mentioned was to copy the contents of the sysvol directory to another folder so you have a local copy of the files in the sysvol.

Gary.

Gary Reynolds 9,621 Reputation points

2021-10-26T09:58:09.27+00:00

Hi Yousuf,

Just checking if there is any progress or update on this one?

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-27T10:09:10.717+00:00

Hi Gary

Sorry for the late reply.

Actually, I have been busy with some critical issues. I will get back to you in 2 days.

Regards

Yousuf

Yousuf Shahzad 26 Reputation points

2021-10-31T07:13:14.867+00:00

Hi Gary

Please advise me of the below backup of Server 2012 of DC1.

If this backup is OK then I will proceed with this solution https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dfsr-event-id-2213.

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-31T08:44:31.217+00:00

Yep looks good, but I would confirm if the DC have multiple drives and that the backup is including them.

Gary.

Yousuf Shahzad 26 Reputation points

2021-10-31T09:10:54.35+00:00

Hi Gary

How to check if the DC has multiple drives and the backup is including them?

Any suggestion??

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-31T09:43:47.833+00:00

Open windows explorer on the dc and check if there are more hard drives an c: drive.

Yousuf Shahzad 26 Reputation points

2021-10-31T10:58:34.44+00:00

Hi Gary

Oh, you are talking about drives, I thought DRIVERS. Actually, I misunderstood in a hurry.

DC1 has only C drive.

So, should I follow this link https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dfsr-event-id-2213

Regards

Yousuf

Gary Reynolds 9,621 Reputation points

2021-10-31T11:04:11.583+00:00

Yep, this will help solve the DFSR issues.

Gary.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Domain Controllers Replication issue

6 answers

Your answer