4

We are upgrading our single 2003 domain controller (DC1) to two 2012 R2 controllers (DC2 in Sevenoaks and DC3 in Manchester (different site in Sites and Services for Manchester)). DCpromo (the wizard anyway) went through without a hitch on both new servers. I went to demote DC1 and it suggested there were no valid DCs on the domain and that it would be a mighty bad idea.

On closer inspection I noticed that DC2 and DC3 had no SYSVOL or NETLOGON shares.

Running a DCDiag on DC2 showed the following error:

Starting test: Advertising
   Warning: DsGetDcName returned information for \\mfb-dc1.mortgages4business.local, when we were trying to reach
   MFB-DC2.
   SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
   ......................... MFB-DC2 failed test Advertising
Starting test: FrsEvent
   There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
   replication problems may cause Group Policy problems.

repadmin /showrepl shows no errors on DC2. So I'm thinking DNS, you can find the ipconfig for DC2 here, and the ipconfig for DC1 here - everything points to DC1, the 2003 box, which is what I want for replication purposes until SYSVOL etc are created successfully.

On DC2 there are no directory services errors at all, on DC1 things are a little more unhappy - every 15 minutes there is a batch of 12 errors and warnings created.

Four of these (1865 warnings): "The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site." Four 1311 errors (more of the same). Four 1566 errors: "All domain controllers in the following site that can replicate the directory partition over this transport are currently unavailable. Site: CN=Manchester..."

If I run DCDiag on DC1, I get some replication errors - these relate to DC3 though (the server on the other network).

     [Replications Check,MFB-DC1] A recent replication attempt failed:
        From MFB-DC3 to MFB-DC1
        Naming Context: DC=DomainDnsZones,DC=mortgages4business,DC=local
        The replication generated an error (1256):
        The remote system is not available. For information about network troubleshooting, see Windows Help.
        The failure occurred at 2015-03-14 00:45:12.
        The last success occurred at 2015-03-13 22:00:11.
        1 failures have occurred since the last success.

     [Replications Check,MFB-DC1] A recent replication attempt failed:
        From MFB-DC3 to MFB-DC1
        Naming Context: CN=Schema,CN=Configuration,DC=mortgages4business,DC=local
        The replication generated an error (8524):
        The DSA operation is unable to proceed because of a DNS lookup failure.
        The failure occurred at 2015-03-14 00:45:15.
        The last success occurred at 2015-03-13 21:45:09.
        1 failures have occurred since the last success.
        The guid-based DNS name 4b35c4ab-6da8-40c5-8a74-4f8ee6e12954._msdcs.mortgages4business.local
        is not registered on one or more DNS servers.

All servers can ping each other and DNS looks good. All three servers have _msdcs.mortgages4business.local registered.

Edit: In DC3s logs, under file replication logs, I find: The File Replication Service is having trouble enabling replication from mfb-dc1.mortgages4business.local to MFB-DC3 for c:\windows\sysvol\domain using the DNS name mfb-dc1.mortgages4business.local. FRS will keep retrying. So perhaps my DNS theory isn't far wrong - mad thing is I can pin mfb-dc1...

What am I missing? Is this something to do with the other site? It can't replicate to DC3 so it gives up and doesn't replicate to the local DC2?

  • For a start, demote DC3. Troubleshooting only one issue at a time is easier. Then see if you can access \\dc1 from DC2 and vice versa. Also run repadmin /showrepl and dcdiag /q again on both machines post the results please. – Daniel Mar 14 '15 at 6:39
  • Have you ensured DNS on all servers doesnt have any old DC information in them? DNS forward and reverse zones all looks OK with no duplicates? Are you sure none of the DC's are in JRNL_WRAP_ERROR, check this in the application event logs>file replication service? BITS is running on all DC's? This certainly points to a DNS issue, i'd agree to demote DC3 first though. – Ash Robinson Mar 14 '15 at 10:08
  • Could you post the whole DCDiag? I've had a problem pretty similar to this a few months ago and the fix wasn't too difficult. There was old DNS information cluttering up the DNS Server and Replication had been disabled on one of the DCs following a dirty shutdown. I'd check the Replication Status tool to verify that though. – nerdythor Nov 25 '15 at 14:58
2

I can't add a comments, due to reputation, but I'm a 10+ year AD guy, so please allow me a little grace on the answer.

Firstly, there are no replication errors, because the DC isn't advertising itself.

I presume, all DC's are also DNS servers. If not, make it so. You will want two DNS servers in the domains after the 2k3 box is decomm'ed.

DC01 is pointing to itself for DNS, while that was fine with one DC, now it's not. citation: https://technet.microsoft.com/en-us/library/ff807362(v=ws.10).aspx

Change the DNS client IP settings of DC01 to be:

192.168.0.19
127.0.0.1

Change the DNS client IP settings of DC02 to be:

192.168.0.4
127.0.0.1

Change the DNS Client IP settings of DC03 to be

192.168.0.19
127.0.0.1

So 01 and 03 should point to 02, 02 should point to 01. Leave IPv6 (the ::1) enabled on the 2012 servers, AD DS isn't supported with it disabled.

This line suggested this was the issue, that and known best practices:

        The guid-based DNS name 4b35c4ab-6da8-40c5-8a74-4f8ee6e12954._msdcs.mortgages4business.local
        is not registered on one or more DNS servers.

Run DCdiag /fix on all three servers, it might be netdiag /fix on the 2003. This will re/register all srv records for the DC's. That should resolve your DNS issues. Give it 5 minutes, run from an elevated cmd line:

repadmin /syncall * /e 

This will sync the domain. Give it a couple of hours and see what going on with more dcdiags. If that doesn't work I would think about firewalls. Where is DC01, Sevenoaks or Manchester. Are all Ports open? https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx But I wouldn't worry that it's the issue at this stage.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.