I recently discovered that Active Directory replication started failing about a month ago. If I attempt to
Replicate Now from the failing domain controller, I receive
The following error occurred during the attempt to synchronize the domain controllers: Access is denied.
Directory Service log tells basically the same story; repeating two events
- 1061: Internal error: The directory replication agent (DRA) call returned error 5.
- 1085: Replication warning: The directory replication agent (DRA) couldn't synchronize partition DC=OUR_DOMAIN with partition on directory server big-long-guid._msdcs.OUR_DOMAIN. The error was: Access is denied
It is between two servers at a remote site. One is Windows 2003 and the other is Windows 2000; the Windows 2000 machines is experiencing the errors. The domain is older OUR_DOMAIN style.
Attempts so far:
- I disabled Kerberos service on the Windows 2000 server and restarted
- RPC and RPC locater services have expected settings
ncacn_nb_tcpon Windows 20003 server (added)
- Portqry reports okay
- Firewall disabled
netdom resetpwd(and reboot) on Windows 2000 server.
ENTERPRISE DOMAIN ADMINShas read access to site on both servers
dcdiag /con 2003: Pass all except DNS Forward; several errors related to root hint servers, which don't seem relevent
dcdiag /con 2000: says replication failed (duh) (3 reports) and then passes the test(?) Reports IISADMIN and SMTPSVC missing (don't see why they would be needed) Lists some error events for kccevent (where are those in event viewer?) and some printer errors from systemlog.