NTDS warning: Replication event 1080 every few minutes on sole DC

I recently demoted a Windows 2003 server DC named NAR because it never
replicated with the Windows 2003 DC named ZNTR that contains the FSMO roles
(and is currently the only DNS server and DHCP server).

IPCONFIG/ALL for ZNTR:
Windows IP Configuration

Host Name . . . . . . . . . . . . : zntr
Primary Dns Suffix . . . . . . . : wrbenson.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : wrbenson.local

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Linksys EG1032 v2 Instant Gigabit
Network
Adapter
Physical Address. . . . . . . . . : 00-12-17-51-FA-4B
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.11.12.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.11.12.99
DNS Servers . . . . . . . . . . . : 10.11.12.3
NetBIOS over Tcpip. . . . . . . . : Disabled

The demotion was successful, at least that's what AD reported at the end of
the DCPROMO process, so I moved NAR out of the DC OU and into a server OU,
and now I'm temporarily running a single-DC domain, but ever since, I've
gotten the following error in the Directory Service event log every 15-18
minutes:


Event Type: Warning
Event Source: NTDS General
Event Category: Replication
Event ID: 1080
Date: 7/8/2007
Time: 8:48:21 PM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: ZNTR
Description:
Internal event: Active Directory could not notify the domain controller at
the following network address about changes to the directory partition.

Directory partition:
DC=DomainDnsZones,DC=wrbenson,DC=local
Network address:
9f385845-432e-4e23-aba6-69ba549035d2._msdcs.wrbenson.local

The first couple of events had this:

Additional Data
Error value:
8446 The replication operation failed to allocate memory.

But every event since has been
Error value:
1722 The RPC server is unavailable.

NETDIAG shows no errors, but DCDIAG/Q shows:
An Warning Event occured. EventID: 0x80000438
Time Generated: 07/08/2007 23:42:26
(Event String could not be retrieved)
......................... ZNTR failed test kccevent

RPC service is started and Automatic, and RPC Locator service is stopped and
Manual; I opened TCP ports in Windows Firewall for RPC NtFRS and RPC NtNTDS
as well as a range of TCP ports for RPC's dynamic high open ports, but I
still get the events every few minutes. I temporarily turned off the
Firewall and they still occur. whether NAR is up or not.

I also get the following warning in the Application event log upon reboot:

Event Type: Warning
Event Source: SRMSVC
Event Category: None
Event ID: 12317
Date: 7/9/2007
Time: 12:30:41 AM
User: N/A
Computer: ZNTR
Description:
File Server Resource Manager failed to enumerate share paths or DFS paths.
Mappings from local file paths to share and DFS paths may be incomplete or
temporarily unavailable. FSRM will retry the operation at a later time.

Error-specific details:
Error: (0x8007054b) The specified domain either does not exist or could
not be contacted.


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 50 4d 43 41 43 48 45 43 PMCACHEC
0008: 37 36 36 00 00 00 00 00 766.....
0010: 50 4d 43 41 43 48 45 43 PMCACHEC
0018: 37 33 38 00 00 00 00 00 738.....

However I believe this 12317 warning is benign; it only happens once upon
rebooting the server and I think it's an indication that the domain is
temporarily unavailable after reboot, since there's no other DC to handle
netlogons. Please correct me if I'm wrong.

NSLOOKUP from ZNTR returns:
Default Server: zntr.wrbenson.local
Address: 10.11.12.3

set q=srv
_ldap._tcp.wrbenson.local
Server: zntr.wrbenson.local
Address: 10.11.12.3

_ldap._tcp.wrbenson.local SRV service location:
priority = 0
weight = 100
port = 389
svr hostname = zntr.wrbenson.local
zntr.wrbenson.local internet address = 10.11.12.3

I haven't gotten anywhere by Googling this - hope someone can please shed
some light for me?

Thanks in advance---
Randy Benson




.

Relevant Pages

  • Re: NTFRS
    ... The server holding the PDC role is down. ... Default-First-Site-Name\WIN2003 via RPC ... I have no Sysvol on the Windows 2003 server. ...
    (microsoft.public.win2000.active_directory)
  • SecurityFocus Microsoft Newsletter #154
    ... MICROSOFT VULNERABILITY SUMMARY ... ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi... ... Roger Wilco Remote Server Side Buffer Overrun Vulnerability ... available for Microsoft Windows operating systems. ...
    (Focus-Microsoft)
  • Re: NTFRS
    ... The server holding the PDC role is down. ... Default-First-Site-Name\WIN2003 via RPC ... I have no Sysvol on the Windows 2003 server. ...
    (microsoft.public.win2000.active_directory)
  • RE: Outlook trying to connect.......
    ... Also installed Security Update for Windows XP on the client. ... would like to explain Windows Server 2003 Service Pack 1 added a new RPC ... Server 2003 Service Pack 1-based server. ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • SecurityFocus Microsoft Newsletter #49
    ... Subject: SecurityFocus Microsoft Newsletter #49 ... Microsoft Windows NNTP Denial of Service Vulnerability ... Microsoft IIS SSI Buffer Overrun Privelege Elevation Vulnerability ... Microsoft ISA Server H.323 Memory Leak Denial of Service... ...
    (Focus-Microsoft)