1

I have the following infrastructure:

DC1 as main domain controller
DC2 as a replicated domain controller from DC1 in another office, connected through VPN

Everything was working OK, but a few days ago I changed the FSMO from DC1 to DC3 in the same office. When I check DC2 with

netdom query /domain:MyDomain fsmo

the result values are still DC1

How can I change this from DC1 to DC3?

I followed these steps to change the FSMO: http://support.microsoft.com/kb/255690/en-us

The output of netdom:

Schema master               DCUCACSA.ucacsa.org  <-- DC1 = DCUCACSA
Domain naming master        DCUCACSA.ucacsa.org
PDC                         DCUCACSA.ucacsa.org
RID pool manager            DCUCACSA.ucacsa.org
Infrastructure master       DCUCACSA.ucacsa.org
The command completed successfully.

The output of repadmin:

Replication Summary Start Time: 2014-06-11 09:23:34

Beginning data collection for replication summary, this may take awhile:
  ......

Source DSA          largest delta    fails/total %%   error
 DCNCG                     05m:14s    0 /   5    0  
 DCUCACSA                  35m:21s    0 /   5    0  

Destination DSA     largest delta    fails/total %%   error

 UCACSA-DOMINIO            35m:28s    0 /  10    0  

Note: DC1 = DCUCACSA, DC2 = DCNCG, DC3 = UCACSA-DOMINIO



Experienced the following operational errors trying to retrieve replication information:

        8341 - DCUCACSA.ucacsa.org
Improve this question
6
  • 1
    Full output of the netdom command would be helpful, as well as the specific steps you took to change the FSMO.
    – myron-semack
    Jun 11, 2014 at 15:05
  • 1
    My hunch is that it's a replication issue... try to force replication from Sites and Service first... and if you don't know how to do this let me know and I can assist you...
    – Brad Bouchard
    Jun 11, 2014 at 20:11
  • 1
    @Brad Bouchard, I tried to force replication, but I just got the message: The following error ocurred during the attempt to synchronize naming context ...
    – Alonso
    Jun 11, 2014 at 22:29
  • 1
    Rest of the error please? There are a couple that Sites and Services displays that are similar to that one...
    – Brad Bouchard
    Jun 12, 2014 at 13:54
  • 1
    The following error ocurred during the attempt to synchronize naming context ucacsa.org from Domain Controller DCNCG to Domain Controller DCUCACSA: The naming context is in the process of being removed or is not replicated from the specified server. This operation will not continue.
    – Alonso
    Jun 12, 2014 at 23:54

2 Answers 2

Reset to default
0

You probably want to run ntdsutil for this as it's nice and step by step and you can verify as you go.

Microsoft NTDSUTIL docs

Follow the instructions to transfer, not to seize.

Strongly suggest you back up your AD (ie, system state on both DC's) before doing this :-)

-- But!

If your actual problem is that DC1 says one thing, and DC2 says a different thing, then you most likely have an entirely different problem. For this you better say what version of Windows on each DC etc.

Without further knowledge on what you're running you could have a replication issue or a DNS issue. Make sure DC2 is using DC1 as it's DNS server during migration. Also make sure you don't have NTFRS Journal Wrap errors in your event log. If Windows 2003 this is quite common and you'll possibly have to do a burflags D4 restore. But you must make a backup of your SYSVOL share on both servers in case you get it wrong.

Microsoft Burflags docs re replication

Improve this answer
2
  • Hi, my actual problem is that DC1 says one thing, and DC2 says a different thing. DC1 and DC2 are Windows Server 2008R2 and DC3 is Windows Server 2012. I will try the burflags D4 restore. Thanks
    – Alonso
    Jun 11, 2014 at 17:27
  • You should probably choose to do the D4 (aka Authoritative Restore) on DC1 (the original DC) if it has the correct data in SYSVOL (check \\localhost\SYSVOL). If you edited Group Policies or made logon script changes on DC2 since you installed, then going authoritative on DC1 will cause it to overwrite DC2. If on the other hand you go authoritative on DC2 that will make it overwrite DC1's SYSVOL. This is why you want to just back up those folders first (default location is %systemroot%\SYSVOL) - see technet.microsoft.com/en-us/library/cc778037(v=ws.10).aspx
    – Ian Macintosh
    Jun 12, 2014 at 14:36
0

First and foremost, make sure your AD forest is healthy.

  1. Check the Event Viewer on all domain controllers and flush out any AD-related errors/warnings.

  2. Run w32tm /monitor and w32tm /query /status /verbose on all the domain controllers. Look for time synchronization issues. Make sure the current PDCe has an accurate clock and a valid NTP time source. Make sure the other domain controllers are syncing their clocks properly against the PDCe.

  3. Run the dciag utility, test everything.

  4. Run repadmin (or adreplstatus), make sure replication is happening.

  5. Run the Best Practices Analyzer, and implement the recommendations as best you can.

It is a good idea to do all of the above, especially just before and just after making a significant change to the forest (e.g. adding/removing a domain controller). It also never hurts to do these things periodically as a "spot check".

Secondly, make sure you properly moved all of the FSMO roles over. There are multiple steps involved and it is easy to forget one. When I last did the transfer, I followed the steps listed here: http://winsvr.wordpress.com/2012/12/17/transferring-fsmo-roles-from-ws-2008r2-dc-to-ws-2012-dc/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .