Short Version
Domain controller was setup, then taken offline for longer than the tombstone limit. Now I can't get it to replicate again.
Relevant Error Messages
On dc2 (identical error messages exist about both exchange and dc1):
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/exchange.mydomain.local. The target name used was [email protected]. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (MYDOMAIN.LOCAL), and the client realm. Please contact your system administrator.
Another relevant error (Event ID 2042):
The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the following domain controller has consistently failed. Attempts: 12 Domain controller: CN=NTDS Settings,CN=DC1,CN=Servers,CN=MainSite,CN=Sites,CN=Configuration,DC=mydomain,DC=local Period of time (minutes): 105103 The Connection object for this domain controller will be ignored, and a new temporary connection will be established to ensure that replication continues. Once replication with this domain controller resumes, the temporary connection will be removed. Additional Data Error value: 2148074274 The target principal name is incorrect.
And Event ID 1925:
The attempt to establish a replication link for the following writable directory partition failed.
Other Details
Both sites are connected through a VPN. At the main site, I have two domain controllers (which we shall call exchange and dc1). Both are Server 2003. If it matters, dc1 holds all the FSMO roles.
In preparation for setting up a remote site, I setup a domain controller called dc2, running Server 2003 R2, and configured separate sites in AD Sites and Services, and configured replication from dc1 to dc2. I even had it the correct subnet for the remote site by connecting it through a router (this was before the site was connected to the VPN, so no IP conflicts).
Everything was working great, so I shut down and got it ready to take out. But things kept getting delayed for over 2 months, and now dc2 won't replicate properly.
What I've tried
Removing the domain controller role - fails with:
Managing the network session with DC1.mydomain.com failed "Logon Failure: The target account name is incorrect."
Resetting the machine password with:
Disable and stop KDC service
klist /purge
netdom resetpwd /s:dc1 /ud:domainadmin /pd:domainadminpassword
Reboot
Reenable KDC service
Most of the KB articles I went through about fixing replication after reaching the tombstone life got stuck because of the "The target principal name is incorrect" error.
IP
for additional redundancy to replicate across sites. For some reason DC2, DC3, and DC4 could not authenticate to\\DC1\sysvol
and it was that AD computer object DC1 password attributepwdLastSet
newer on DC1 and not on DC2-4 and thus the issue with the kerberos authentication. I added the redundant bridgeheads to replicate across sites after running thenetdom resetpwd /s:dc3 /ud:domain admin /pd:*
and once kdc restart, repl worked.