Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

While testing some remote DC's, "repadmin /replsummary" ended with an error of

   Experienced the following operational errors trying to retrieve replication information:
       58 - mydc1.mydomain.com
       58 - mydc2.mydomain.com

Information for "Source DSA" for mydc1 and mydc2 both show up with 0 fails/errors; the information is lacking under Destination DSA. This domain controller I ran the command on (remotedc1) can see mydc1 and mydc2.

Pinging from remotedc1 to mydc2 and mydc1 shows an average time of 43ms...

What causes this kind of error?

share|improve this question
    
I know you guys were offline for quite a while. Any chance that your DCs in NYC were offline long enough to hit the 180 day tombstone lifetime? –  MDMarra Feb 5 '13 at 20:06
    
Other DC's in another location can see mydc1 and mydc2 without error... –  Bart Silverstrim Feb 5 '13 at 20:08
    
We've had internal networks up before the 180 days also :-) –  Bart Silverstrim Feb 5 '13 at 20:09
    
Ok, that's good at least. What happens when you try and force a sync with repadmin /syncall /APed? Any interesting feedback? –  MDMarra Feb 5 '13 at 20:10
1  
OK, PETE, I GET IT! NO TOMBSTONES :) –  MDMarra Feb 5 '13 at 20:13

1 Answer 1

up vote 6 down vote accepted

After some investigation, I found that a set of firewall rules was completely blocking communication between the site in question and the remote site, which happened to be the FSMO roles holder. Without the ability to talk to the FSMO masters, things started getting weird.

So, make sure if you run into this error that you double and triple-check that your firewall rules are not blocking communication between your domain controllers.


In our case, we were completely blocking all communication to the DC, so the non-smart-ass answer to your query @Iain is "all of them." Sorry I can't be more specific!

share|improve this answer
2  
Which particular rules were causing the problem ? –  Iain Feb 5 '13 at 21:36
    
In our case, we were completely blocking all communication to the DC, so the non-smart-ass answer to your query @Iain is "all of them." Sorry I can't be more specific! –  Peter Grace Feb 13 '13 at 14:47
    
Knowing that is more useful than a plain check your firewall - thanks. –  Iain Feb 13 '13 at 14:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.