Active Directory Replication Errors - help and advice please...

hi all,

we seem have developed quite major fault in our active directory services.  

picking on 1 server starters, re-installed, have following errors:

event id 1645

  

active directory domain services did not perform authenticated remote procedure call (rpc) directory server because desired service principal name (spn) destination directory server not registered on key distribution center (kdc) domain controller resolves spn. 

destination directory server:
1b2c197f-d976-4e02-b830-99afd75c7bbc._msdcs.mydomain.local 
spn:
e3514235-4b06-11d1-ab04-00c04fc2dcd2/1b2c197f-d976-4e02-b830-99afd75c7bbc/mydomain.local@mydomain.local 

user action 
verify names of destination directory server , domain correct. also, verify spn registered on kdc domain controller. if destination directory server has been promoted, necessary local directory server’s account data replicate kdc before directory server can authenticated.

event id 2042

             

it has been long since machine last replicated named source machine. time between replications source has exceeded tombstone lifetime. replication has been stopped source.

 the reason replication not allowed continue 2 dcs may contain lingering objects.  objects have been deleted , garbage collected active directory domain services partition still exist in writable partitions of other dcs in same domain, or read-only partitions of global catalog servers in other domains in forest known "lingering objects".  if local destination dc allowed replicate source dc, these potential lingering object recreated in local active directory domain services database.

time of last successful replication:
2012-06-25 13:42:17 
invocation id of source directory server:
83290b33-3a96-423c-8c8e-166d62bb813d 
name of source directory server:
5ee25484-8248-493b-8316-a2b560193ad5._msdcs.mydomain.local 
tombstone lifetime (days):
60 

replication operation has failed.


user action:
  action plan recover error can found @ http://support.microsoft.com/?id=314282.

 if both source , destination dcs windows server 2003 dcs, install support tools included on installation cd.  to see objects deleted without performing deletion run "repadmin /removelingeringobjects <source dc> <destination dc dsa guid> <nc> /advisory_mode". eventlogs on source dc enumerate lingering objects.  to remove lingering objects source domain controller run "repadmin /removelingeringobjects <source dc> <destination dc dsa guid> <nc>".

 if either source or destination dc windows 2000 server dc, more information on how remove lingering objects on source dc can found @ http://support.microsoft.com/?id=314282 or microsoft support personnel.

 if need active directory domain services replication function @ costs , don't have time remove lingering objects, enable replication setting following registry key non-zero value:

registry key:
hklm\system\currentcontrolset\services\ntds\parameters\allow replication divergent , corrupt partner

 replication errors between dcs sharing common partition can prevent user , compter acounts, trust relationships, passwords, security groups, security group memberships , other active directory domain services configuration data vary between dcs, affecting ability log on, find objects of interest , perform other critical operations. these inconsistencies resolved once replication errors resolved.  dcs fail inbound replicate deleted objects within tombstone lifetime number of days remain inconsistent until lingering objects manually removed administrator each local dc.  additionally, replication may continue blocked after registry key set, depending on whether lingering objects located immediately.


alternate user action:

force demote or reinstall dc(s) disconnected.

***note, have added registry key in order replication working, still have other problems, , need clean these "lingering objects" not sure how.

event id 1925

    

the attempt establish replication link following writable directory partition failed. 

directory partition: 
cn=configuration,dc=mydomain,dc=local 
source directory service: 
cn=ntds settings,cn=server01,cn=servers,cn=site01,cn=sites,cn=configuration,dc=mydomain,dc=local 
source directory service address: 
8fdb483b-339b-45bf-9c1e-5be1b37e7ccc._msdcs.mydomain.local 
intersite transport (if any): 
cn=ip,cn=inter-site transports,cn=sites,cn=configuration,dc=mydomain,dc=local 

directory service unable replicate source directory service until problem corrected. 

user action 
verify if source directory service accessible or network connectivity available. 

additional data 
error value: 
8614 directory service cannot replicate server because time since last replication server has exceeded tombstone lifetime.

event id 1865

      

the knowledge consistency checker (kcc) unable form complete spanning tree network topology. result, following list of sites cannot reached local site. 

sites: 
cn=remotesite01,cn=sites,cn=configuration,dc=mydomain,dc=local 


 event id 1311

knowledge consistency checker (kcc) has detected problems following directory partition. 
 
directory partition:
cn=configuration,dc=mydomain,dc=local 
 
there insufficient site connectivity information kcc create spanning tree replication topology. or, 1 or more directory servers directory partition unable replicate directory partition information. due inaccessible directory servers. 
 
user action 
perform 1 of following actions: 
- publish sufficient site connectivity information kcc can determine route directory partition can reach site. preferred option. 
- add connection object directory service contains directory partition in site directory service contains same directory partition in site. 
 
if neither of tasks correct condition, see previous events logged kcc identify inaccessible directory servers.

and last of error in bold below:

c:\users\administrator.mydomain>repadmin /showreps
remotesite\server02
dsa options: is_gc
site options: (none)
dsa object guid: aa0d5e4d-4070-410c-9fc7-330f034cbbf4
dsa invocationid: b4b60e77-9910-493d-800e-d5945c96b02d

==== inbound neighbors ======================================

dc=mydomain,dc=local
    mainsite\server03 via rpc
        dsa object guid: 8fdb483b-339b-45bf-9c1e-5be1b37e7ccc
        last attempt @ 2012-10-23 20:51:57 successful.
    mainsite\server01 via rpc
        dsa object guid: 1b2c197f-d976-4e02-b830-99afd75c7bbc
        last attempt @ 2012-10-23 21:20:50 failed, result 1396 (0x574):
            logon failure: target account name incorrect.
        10121 consecutive failure(s).

...erm think that's enough now!  can help? or should raise paid support ticket resolution microsoft?

any directions appreciated.

thanks,

j.

active directory domain services did not perform authenticated remote procedure call (rpc) directory server because desired service principal name (spn) destination directory server not registered on key distribution center (kdc) domain controller resolves spn. see that: http://technet.microsoft.com/en-us/library/cc756429%28v=ws.10%29.aspx

verify names of destination directory server , domain correct. also, verify spn registered on kdc domain controller. if destination directory server has been promoted, necessary local directory server’s account data replicate kdc before directory server can authenticated.

seems have dns resolution issue.

you can proceed that:

• make sure each dc has 1 nic card enabled , 1 ip address in use
• make sure each public dns server in use set forwarders , not in ip settings in use
• choose healthy dc / dns server , make dcs point primary dns server
• make each dc / dns server point private ip address secondary dns server
• make sure needed ports ad replication opened in both directions: http://social.technet.microsoft.com/wiki/contents/articles/584.active-directory-replication-over-firewalls.aspx

once done, run ipconfig /registerdns and restart netlogon on each dc have.

 the reason replication not allowed continue 2 dcs may contain lingering objects.  objects have been deleted , garbage collected active directory domain services partition still exist in writable partitions of other dcs in same domain, or read-only partitions of global catalog servers in other domains in forest known "lingering objects".  if local destination dc allowed replicate source dc, these potential lingering object recreated in local active directory domain services database.

seems have lingering objects. see that: http://support.microsoft.com/?id=314282

please backups before proceeding updates , changes!

---

this posting provided "as is" no warranties or guarantees , , confers no rights.    microsoft student partner 2010 / 2011
microsoft certified professional
microsoft certified systems administrator: security
microsoft certified systems engineer: security
microsoft certified technology specialist: windows server 2008 active directory, configuration
microsoft certified technology specialist: windows server 2008 network infrastructure, configuration
microsoft certified technology specialist: windows server 2008 applications infrastructure, configuration
microsoft certified technology specialist: windows 7, configuring
microsoft certified technology specialist: designing , providing volume licensing solutions large organizations
microsoft certified professional: enterprise administrator
microsoft certified professional: server administrator
microsoft certified trainer

Windows Server  >  Directory Services