1

I have two Windows Server 2012 Virtual Machines with Active Directory Domain Services installed. They are both Domain Controllers on the same domain, and both are running DNS servers.

When both machines are running, I create a new user on AD1(the first machine I setup). This new user does not replicate to AD2(the second machine).

When I create a new user on AD2, it replicates to AD1 without issue.

There are a number of errors in the event logs for AD1, but despite extensive Googling, I can't quite figure out how to solve the issue. I've been trying for a few days and I'm at my wits' end. Sometimes the error is from the DFRS, sometimes it's from the Domain Services itself.

I'd be happy to post any and all error messages if anyone is interested - any help would be unbelievably appreciated; I just can't seem to lick this :(

(Quick edit: The latest errors state: There are no more endpoints available from the endpoint mapper.)

1
  • Domain controllers are using RPC to do replication among themselves. For some reasons, your RPC on one of the domain controllers is not working properly. There can be multiple reasons. Please check this KB Aug 18, 2012 at 19:03

1 Answer 1

1

It sounds like there is a firewall between the two. In 2008 R2 you need to be able to communicate on ports:

  1. 135 - to map endpoints
  2. 445 - Sysvol
  3. 5722 - FRS (if you're using it)
  4. 49152-65535 - RPC

There are more ports needed for actual logins, etc, but these are the minimum needed for replication.

3
  • As for RPC, you can change this behavior in the registry. RPC opens a conversation on a set port, but then negotiates a higher port. If you need these to be explicit, that can be done, it will require a reboot per DC though, just an FYI. This can make firewall configuration a little easier. I typically do this when servers in a DMZ need to maintain membership in AD. Aug 19, 2012 at 15:10
  • Firewalls on both machines were completely disabled prior to installing Active Directory.
    – TheSciz
    Aug 20, 2012 at 14:52
  • The proper rules are made on the Windows client firewalls during dcpromo anyway. I was referring to a hardware firewall or third parts software that might not be configured for replication.
    – MDMarra
    Aug 20, 2012 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .