I have 3 2016 AD servers, AD level 2012.
From the beginning: I noticed they were not updating from WSUS. As I tried to correct this, I noticed I was getting 1202 errors and when I ran windowsupdatelogs from powershell I noticed it was not resolving names on the output.
Then 1 of the AD servers crashed. I cleaned up the AD, rebuilt it and have it back on the domain and updating, replicating and all "looks" fine. The 1202 name mapping error is still with me.
When I run: dcdiag /c /a I get: DsBindWithSpnEx() failed with error 1722, The RPC server is unavailable..
This is the only error I'm seeing on the command... Yet the rebuilt server has replicated, including DNS. I can query DNS and it works on all servers. I wear many hats and it's been awhile since I have done any troubleshooting on an AD. I added the 127.0.0.1 as 2nd DNS in the list of DNS servers on all the AD servers and things got a little better as far as the AD servers responding quicker and seeing each other.
I figured I'd let it run for a bit before I made any more changes.
TI get the same error today. "Security policies were propagated with warning. 0x534 : No mapping between account names and security IDs was done." 1202 error again.
When I try to look at domain Operations master or any other I get an ERROR in the Domain naming operations master field.
On the page below, the commands are not working on server 2016. It's supposed to help you locate the accounts in error. https://support.microsoft.com/en-us/help/324383/troubleshooting-scecli-1202-events.