3

I had set up a 'test' domain with two Windows 2012 AD domain controllers (DC1 & DC2), both virtual machines.

Unfortunately, DC1 (the FSMO holder) became completely corrupted.

While I could start again, it is proving very instructive to attempt to repair DC2.

Steps taken so far:

  1. Used ntdsutil to seize the FSMO roles
  2. Used ntdsutil to remove the failed controller from the domain.

However, I am still unable to connect to the domain using AD "Sites and Services", which states that the domain could not be contacted.

Investigating further, I'm seeing a DFSR error (unsurprisingly) trying to replicate from DC1, and the domain won't go active until it is complete (which can never happen, obviously).

The actual error is:

The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and is waiting to perform initial replication. The replicated folder will remain in the initial synchronization state until it has replicated with its partner DC1. If the server was in the process of being promoted to a domain controller, the domain controller will not advertise and function as a domain controller until this issue is resolved. This can occur if the specified partner is also in the initial synchronization state, or if sharing violations are encountered on this server or the sync partner. If this event occurred during the migration of SYSVOL from File Replication service (FRS) to DFS Replication, changes will not replicate out until this issue is resolved. This can cause the SYSVOL folder on this server to become out of sync with other domain controllers.

Additional Information:

(Detailed info relating to the Domain replication group, GUIDs etc).

My question, then, is how do I force DFSR to abort this "initial synchronization", in order to proceed further?

6
  • 1
    Is DC02 a DNS server? What is DC02 pointing to for it's client DNS settings?
    – HostBits
    Nov 11, 2012 at 19:38
  • 1
    Good point - yes, it's a DNS server, but it wasn't pointing to itself for DNS in the static IP configuration - I'll change that and re-test!
    – PJC
    Nov 11, 2012 at 20:03
  • OK - well, it was worth changing, and may have caused a future problem, but for now it's still the same issue. Actually, I hadn't looked at the DNS Error log, which is saying DNS is down pending authorization from AD, and of course AD is still down pending the DFRS replication.
    – PJC
    Nov 11, 2012 at 20:16
  • It sounds like DC01 was corrupted prior to the domain every syncing settings to DC02. In this case you essentially have no domain and will have to start over. I could be wrong but if DC02 is still waiting for its initial configuration, it will never get it. Nov 11, 2012 at 20:25
  • 2
    Try opening a UNC path to DC02. If the SYSVOL share doesn't exist then DC02 definitely did not complete the initial AD and SYSVOL replication and is in some ambiguous state. If that's the case then there probably isn't anything that can be done to correct it.
    – joeqwerty
    Nov 11, 2012 at 20:42

1 Answer 1

1

As mentioned in KB216498, ntdsutil does not automatically remove DFS-R objects upon metadata cleanup.

You might be able to workaround the SYSVOL initial replication issue by simply connecting to the default NC on DC02 and removing the DFS-R object for DC01, as explained in Step 21 in the Procedure:

  1. Logon a domain controller as a domain administrator in the affected domain.
  2. Start Adsiedit.msc.
  3. Connect to the default naming context.
  4. Locate the following DFS Replication topology container: CN=Topology,CN=Domain System Volume,CN=DFSR-Globalsettings,CN=System,DC=Your Domain,DC=Domain Suffix
  5. Delete the msDFSR-Member CN object that has the old computer name.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .