1

Hi

I have 2 DC's (server 2019) (1 physical, 1 Virtual) was working good, but last month I did notice some issues like I couldn't connect from dc2 to dc1. so I opened Event Viewer to find muliple errors and warnings.

Some of them in DC1:

  • This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.
  • Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
  • Active Directory Domain Services could not resolve the following DNS host name of the source domain controller to an IP address. This error prevents additions, deletions and changes in Active Directory Domain Services from replicating between one or more domain controllers in the forest. Security groups, group policy, users and computers and their passwords will be inconsistent between domain controllers until this error is resolved, potentially affecting logon authentication and access to network resources.
  • The DNS server is waiting for Active Directory Domain Services (AD DS) to signal that the initial synchronization of the directory has been completed
  • This directory partition has not been backed up since at least the following number of days.
  • Automatic registration failed at join phase.

    Exit code: Unknown HResult Error code: 0x801c001d

  • Failed to register the service principal name 'Microsoft Virtual Console Service'.

  • The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

And on DC2:

  • The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
  • event id: 5781
  • Some of DC1 events.

What I did:

  • I did search and try almost every solution I found in internet without success.
  • I did move the virtual one to be inside the physical one in case my problem was from my switches for example.
  • uninstall AV from DC's.
  • run my 2nd DC inside the 1st (for troubleshooting).

What I found:

  • moving the virtual inside the physical one helped me a little, I can now replicate dns but that's it !
  • I found odd thing: I can access DC1 by name (in file explorer) from any server except DC2 that access DC1 by ip address only !

UPDATE:

Turn out this issue happened from restoring DC1 couple days ago. I had learned that I can't restore DC's like any other machine ! OK. I am learning now how to fix this : )

Thanks...

3 Answers 3

1

You said "DC2 that access DC1 by ip address only"

This would worry me the most, AD is very dependant on DNS (especially SRV records). Troubleshooting this (or even forcing resolution via \system32\drivers\etc\hosts until you get them sync'ed properly) is a first priority.

Also may want to make sure the two DC's are using the same time source (by default your DC emulating a PDC).

"I did move the virtual one to be inside the physical one in case my problem was from my switches for example."

Does that mean you are running one DC on the other using Hyper-V? I would try not to do that. Ideally you'd have your Hyper-V box running nothing other than the hypervisor on the physical hardware.

5
  • - Thanks. I found missing srv record yesterday in _msdcs > pdc > _tcp, so I did add it, after couple minutes disappered ! - I don't remember changing time source settings, How to check it? - I have to servers. the first it DC1, the other is file server with hyper-v to host my backup dc.
    – Lancer
    May 23, 2020 at 18:23
  • If you are having to add an srv record something is wrong. You may have the same zone replicating at the domain-wide and forest level or something else weird going on. Do you have a 3rd DC (install it on anything reliable not on the same hardware as the other 2) May 23, 2020 at 21:23
  • No I don't have 3rd DC. Are you asking me to setup a third DC ?
    – Lancer
    May 23, 2020 at 21:44
  • I would, you want at least two that are able to communicate with each other. Then you can try moving roles etc - AD will put the stuff back in DNS if it needs to. Also make sure you have a common time source. If your time is out of sync they can't talk to each other. May 26, 2020 at 13:19
  • Thanks. I did update my question above.
    – Lancer
    May 27, 2020 at 0:17
1

DNS. Focus on DNS. Make sure the records in both DC's reflect the same information, Make sure that a change on one DC is reflected in the other and vise-versa. Did you run DCDIAG and did it pass? I cant imagine it did.

Go with everything the fidler says, pay attention to SRV records and sync the clocks.

The first error(FSMO) is a DNS problem. (NTLM) can be fixed in Policys. The ADDS error is DNS again. "the DNS server" and the backup error can be ignored for now. The following 3 errors are DNS again.

Your Virtual DC should be moved to another machine, and made to work there.

Again, set the clocks and then focus on DNS and most of this will go away.

1
  • Thank you. - As I mentioned above I had found missing srv record belong to dc2. but every time I try adding it. I found it deleted after couple minutes. - I know I should move my virtual DC to another server, but I did that in sake of troubleshooting, worth mention that dcdiag had different failing test before, but after moving it to DC1 I have 100% pass for dcdiag (my issue still persistent).
    – Lancer
    May 25, 2020 at 3:22
0

fixes:

  • uninstall AV from DC's.
  • run my 2nd DC inside the 1st.

I wasn't able to bing tcp 135 on dc2, now I can do that but my issue persistent.

2
  • 1
    you should edit that into your question as examples of what you have tried. You can edit your question several times, by the way. May 24, 2020 at 18:39
  • When you say "Ping" are you using the MS utility? Are either of your DC's running firewalls by any chance? You may want to (for the purposes of troubleshooting only) completely disable the firewall for now (the one on the DCs). May 26, 2020 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .