AD not replicating

we having problems believe replicating ad.

we have 3 dc in small site of 70 users.

the names have changed are:

nserver1 (pdc)

bserver2

eserver3 (this exchange server)

domain 123.ourdomain.com

people able log in when try connect share on pdc error.

“login failure target account name incorrect”

the cause of think upgrade of sp on nserver1 failed , caused various dc stop talking.

to resolve issue of people not connecting shares delete machine in ad , reconnect them domain local computer. works of time. keeps happening.

when following command on eserver3 following results.

repadmin /showrepl 123.ourdomain.com

123\bserver2

dc options: is_gc

site options: (none)

dc object guid: 731f9ce6-d057-4ae4-9fe0-6f60149911ea

dc invocationid: f19808d3-8425-4492-9529-60444c5aa77d

==== inbound neighbors ======================================

dc=123,dc=ourdomain,dc=com

    123\nserver1 via rpc

        dc object guid: 676dfa45-31ac-4401-a55d-24f94b542f9b

        last attempt @ 2012-11-29 10:25:53 failed, result -2146893022 (0x80090322):

            target principal name incorrect.

        9959 consecutive failure(s).

        last success @ 2012-11-19 16:41:21.

cn=configuration,dc=123,dc=ourdomain,dc=com

    123\nserver1 via rpc

        dc object guid: 676dfa45-31ac-4401-a55d-24f94b542f9b

        last attempt @ 2012-11-29 10:00:19 failed, result -2146893022 (0x80090322):

            target principal name incorrect.

        595 consecutive failure(s).

        last success @ 2012-11-19 16:35:46.

cn=schema,cn=configuration,dc=123,dc=ourdomain,dc=com

    123\nserver1 via rpc

        dc object guid: 676dfa45-31ac-4401-a55d-24f94b542f9b

        last attempt @ 2012-11-29 09:48:35 failed, result -2146893022 (0x80090322):

            target principal name incorrect.

        234 consecutive failure(s).

        last success @ 2012-11-19 15:48:25.

source: 123\nserver1

******* 9956 consecutive failures since 2012-11-19 16:41:21

last error: -2146893022 (0x80090322):

            target principal name incorrect.

when run

repadmin /showrepl 123.ourdomain.com

replication summary start time: 2012-11-29 11:14:47

beginning data collection replication summary, may take awhile:

<st1:place w:st="on"><st1:city w:st="on">source</st1:city> <st1:state w:st="on">dc</st1:state></st1:place>           largest delta  fails/total  %%  error

 nserver1          09d.19h:26m:22s    3 /   3  100  (2148074274) target principal name incorrect.

destination dc    largest delta    fails/total  %%  error

 bserver2           09d.19h:26m:22s    3 /   3  100  (2148074274) target principal name incorrect.

experienced following operational errors trying retrieve replication information:

        8341 - nserver1.123.ourdomain.com

my first question is,

is there harm in running

repadmin /replicate command

i wanted group results.
problem solved bit more complex thought.

i used instructions following link try update servers , force replication. ( suggestion group)
http://technet.microsoft.com/en-us/library/cc816926(v=ws.10).aspx

the results replicate server1 server2 not server2 server1. when tried got tombstone error.

i tried use link you'all provided fix secure channel.

http://sandeshdubey.wordpress.com/2011/10/02/secure-channel-between-the-dcs-broken/

after did saw signs. commands used in first post worked.

btw instructions should added need download 2003 tools first , paths run commands not right seems ms has changed tools stored. note may using resolve own problem.

now tred again force replication gui in instructions first link in post. still failed tombstone message. i'm asuming bad. wasn't sure why seemed replicate in 1 direction not in other..
eg server1-->server2 = ok

server2-->server1 = tombstone message

anyway decided demote server2. is, anyway not hard. way miss spoke when said had 3 domain controllers had two.
before demotion, made sure there no fsmo's on server2 , moved "global catalog server" server1 , deleted 1 on server2. demoted server.

this took hour in total, (once guess gotta this.)

some interesting things happed. few users called saying not access sql data base. error message had trust relationshship or somthing. feeling other servers somehow out of wack have been secure channel or demotion of dc rebooted sql server , accpac server , people stopped calling us. think rejigged things , think far has fixed problems.

i have 1 question if still reading can answer. after demotion of dc, need dc if want make dc again. have seen people talk cleaning out meta data, have , there instuctions on this. have not see on this. again want make same computer eg server2 dc again.

thanks.

Windows Server  >  Directory Services