2

I am running a test environment with 2 Active Directory Windows2012 controllers - which goes on and off quite a bit. However I am having a hard time deciphering repadmin /showrepl and repadmin /replsummary outputs. The output displays errors due to issues 10 minutes ago however according to the event logs the issues seems to have been cleared.

Below is an example. Currently the replication seems to be working just by manually adding objects and they are showing up in the other DC. Event log errors and warnings seem to have cleared. However my main concern is being able to check the heath of the Active Directory services in real time without it referring to past errors or errors not clearing as soon as everything is good again.

C:\Users\administrator>repadmin /showrepl

Repadmin: running command /showrepl against full DC localhost
Default-First-Site-Name\WIN2012-1
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 4d0f615f-2568-4acb-a4d7-fda9e8c303ff
DSA invocationID: 4d0f615f-2568-4acb-a4d7-fda9e8c303ff

==== INBOUND NEIGHBORS ======================================

DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 13:16:30 was successful.

CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:52:26 was successful.

CN=Schema,CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:47:28 failed, result 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup failu
re.
        1 consecutive failure(s).
        Last success @ 2016-11-30 22:45:07.

DC=DomainDnsZones,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 13:08:01 was successful.

DC=ForestDnsZones,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:47:28 failed, result 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup failure.
        1 consecutive failure(s).
        Last success @ 2016-11-30 22:45:07.

Source: Default-First-Site-Name\WIN-2012-2
******* 1 CONSECUTIVE FAILURES since 2016-11-30 22:45:07
Last error: 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup failure.

repadmin /replsummary

Replication Summary Start Time: 2016-12-01 13:19:35

Beginning data collection for replication summary, this may take awhile:
  .....


Source DSA          largest delta    fails/total %%   error
 WIN-2012-2            14h:34m:28s    2 /   5   40  (8524) The DSA operation is
unable to proceed because of a DNS lookup failure.
 WIN2012-1             14h:20m:18s    2 /   5   40  (1908) Could not find the do
main controller for this domain.


Destination DSA     largest delta    fails/total %%   error
 WIN-2012-2            14h:20m:18s    2 /   5   40  (1908) Could not find the do
main controller for this domain.
 WIN2012-1             14h:34m:28s    2 /   5   40  (8524) The DSA operation is
unable to proceed because of a DNS lookup failure.

Also, what is the difference between the following 3 tests showrepl displays?:

DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 13:16:30 was successful.

CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:52:26 was successful.

CN=Schema,CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:47:28 failed, result 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup 
    1 consecutive failure(s).
    Last success @ 2016-11-30 22:45:07.
1

repadmin /replsummary necessarily shows historical data from a rolling cache of successes and failures and therefore /replsummary will continue displaying old errors for some time even after you truly have fixed it. I don't like /replsummary and never use it.

/showrepl on the other hand, is as real-time as it gets. Maybe you're still seeing old errors in /showrepl because the DCs haven't tried to replicate anything since then?

Can you repadmin /syncall /APed from both DCs without any errors? If you can't then you haven't fixed it yet.

Also, what is the difference between the following 3 tests showrepl displays?:

DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 13:16:30 was successful.

CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:52:26 was successful.

CN=Schema,CN=Configuration,DC=tom,DC=local
    Default-First-Site-Name\WIN-2012-2 via RPC
        DSA object GUID: 666eacaf-7bfd-428f-bc21-4bc067207f44
        Last attempt @ 2016-12-01 12:47:28 failed, result 8524 (0x214c):
            The DSA operation is unable to proceed because of a DNS lookup 
    1 consecutive failure(s).
    Last success @ 2016-11-30 22:45:07.

Domain controllers host several different naming contexts, or partitions. They are sort-of analogous to logical tables or views in a database. Each of these partitions is replicated separately. The first one, DC=tom,DC=local is your domain partition. It's where your users and groups are that belong to that domain. Users and groups from other domains (if you had any) would not be in that partition.

CN=Configuration,DC=tom,DC=local is a forest-wide naming context that is replicated to all DCs in the forest. It contains information about the configuration of the entire forest, like AD Sites, PKI information, etc.

CN=Schema,CN=Configuration,DC=tom,DC=local is also a forest-wide naming context. There's only one version of this partition for the entire forest.

2
  • Thanks very informative!!! yes repadmin /syncall /APed shows "no errors". That is very good to know ! and yes I should have waited a few more minutes for syncs to happen. I would up vote but need more karma... :)
    – AlaanG1
    Dec 1 '16 at 20:43
  • @AlaanG1 Glad to help. One last piece of bonus knowledge: The /APed (case sensitive) switches in that command, A means "All partitions", P means "push replication", (default is pull,) e means "Enterprise, cross sites" (default is only home site), and d means "display servers using FQDN instead of DSA GUID. (Makes the output more human-readable.)
    – Ryan Ries
    Dec 1 '16 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.