Broke replication with bad FSMO role move?
- From: "Sandman" <Sandman@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Tue, 7 Feb 2006 13:02:28 -0800
So I set out to avoid AD replication problems by ensuring that our
Infrastructure MGR FSMO roll is not on a GC (as per
http://support.microsoft.com/default.aspx?scid=kb;en-us;223346) ... and I end
up causing the problem I was looking to avoid. I have a child domain where
the I.M. role was on a GC. I removed GC from another server and was supposed
to transfer the I.M. role to it....however I somehow was a total dummy and
instead transferred the RID master role. A month goes by before someone
brings up a problem with a universal group. Some members are showing up as
phantoms, they say that the AD object can't be found if you click on the user
object in the group. So, I figure out what I have done (or didn't do rather)
and tranfer the I.M. role as I should have done initially. It's been a few
days now and things have not worked themself out, objects still show as
phantoms. On the server that is not the I.M. I get 3 reoccuring DS event log
errors:
========================
Event Type: Error
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1864
Date: 2/6/2006
Time: 6:41:53 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: EUDC2
Description:
This is the replication status for the following directory partition on the
local domain controller.
Directory partition:
DC=ForestDnsZones,DC=domain
The local domain controller has not recently received replication
information from a number of domain controllers. The count of domain
controllers is shown, divided into the following intervals.
More than 24 hours:
2
More than a week:
2
More than one month:
2
More than two months:
2
More than a tombstone lifetime:
2
Tombstone lifetime (days):
60
Domain controllers that do not replicate in a timely manner may encounter
errors. It may miss password changes and be unable to authenticate. A DC that
has not replicated in a tombstone lifetime may have missed the deletion of
some objects, and may be automatically blocked from future replication until
it is reconciled.
To identify the domain controllers by name, install the support tools
included on the installation CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication
latencies of the domain controllers in the forest. The command is "repadmin
/showvector /latency <partition-dn>".
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
====================================
Through DCDIAG I have found that this server is not advertising as a time
server, and the event logs indicate it is having issues contacting a time
server. Now the local time is currently accurate, but this could have
something to do with my issue. Using Replmon it seems like there are no
replication issues.
I'm at a bit of a loss as to where to go from here. Anyone have any ideas?
Sorry for the long post, lemme know what additional info is needed as I know
there are tidbits I have not included.
Sandman
.
- Follow-Ups:
- Re: Broke replication with bad FSMO role move?
- From: Chrispsg
- Re: Broke replication with bad FSMO role move?
- Prev by Date: Re: I'm Stumped...
- Next by Date: Re: AD question
- Previous by thread: Re: AD/AM Replication Problem
- Next by thread: Re: Broke replication with bad FSMO role move?
- Index(es):
Relevant Pages
|
