[NTFRS] authorative restore

[Verwijderd]

***kan iemand mijn topic titel ff aanpassen, was weer eens te vlot met versturen.
***zat te denken aan [NTFRS] authorative restore?

Ik heb de volgende problemen met het repliceren van onze DC's

The File Replication Service is having trouble enabling replication from DC1 to DC2 for c:\winnt\sysvol\domain using the DNS name DC1.mijndomein.nl. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name DC1.mijndomein.nl from this computer.
[2] FRS is not running on DC1.mijndomein.nl.
[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

EVENT ID: 13508 (niet gevolgd door 13509)

Output van ntfrsdiag:

------------------------------------------------------------
FRSDiag v1.7 on 11-12-2006 15:41:45
.\dc1 on 2006-12-11 at 15.41.45
------------------------------------------------------------

Checking for errors/warnings in FRS Event Log ....
NtFrs 11-12-2006 13:19:03 Warning 13508 The File Replication Service is having trouble enabling replication from dc2 to dc1 for c:\winnt\sysvol\domain using the DNS name dc2.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc2.mijndomein.nl from this computer. [2] FRS is not running on dc2.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
NtFrs 11-12-2006 1:44:22 Warning 13508 The File Replication Service is having trouble enabling replication from dc2 to dc1 for c:\winnt\sysvol\domain using the DNS name dc2.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc2.mijndomein.nl from this computer. [2] FRS is not running on dc2.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
NtFrs 10-12-2006 1:44:21 Warning 13508 The File Replication Service is having trouble enabling replication from dc2 to dc1 for c:\winnt\sysvol\domain using the DNS name dc2.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc2.mijndomein.nl from this computer. [2] FRS is not running on dc2.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
WARNING: Found Event ID 13508 errors without trailing 13509 ... see above for (up to) the 3 latest entries!

......... failed 1
Checking for errors in Directory Service Event Log .... passed
Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ... passed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0005.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 3472: 874: S0: 13:22:04> ++ ERROR - EXCEPTION (000006bf) : WStatus: RPC_S_CALL_FAILED_DNE
ERROR on NtFrs_0005.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 3472: 875: S0: 13:22:04> :SR: Cmd 0023d448, CxtG 41804d71, WS RPC_S_CALL_FAILED_DNE, To dc2.mijndomein.nl Len: (348) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was established to target, but there was a failure to send RPC call package. Check for Networking problems!)" : <SndCsMain: 3472: 895: S0: 13:22:04> :SR: Cmd 0023d448, CxtG 41804d71, WS RPC_S_CALL_FAILED_DNE, To dc2.mijndomein.nl Len: (348) [SndFail - Send Penalty]

Found 3 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above

......... failed with 3 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...
SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Enable Journal Wrap Automatic Restore = 0 :: ERROR: Enabling Journal Wrap Automatic Restore is NOT recommended in post-SP2 version of FRS. Please see KB.292438 (Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets) for further information!
failed with 1 error(s) and 0 warning(s)

Checking Repadmin Showreps for errors...passed


Final Result = failed with 5 error(s)

------------------------------------------------------------
FRSDiag v1.7 on 11-12-2006 15:41:45
.\dc2 on 2006-12-11 at 15.41.45
------------------------------------------------------------

Checking for errors/warnings in FRS Event Log ....
NtFrs 11-12-2006 13:23:10 Warning 13508 The File Replication Service is having trouble enabling replication from dc1 to dc2 for c:\winnt\sysvol\domain using the DNS name dc1.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc1.mijndomein.nl from this computer. [2] FRS is not running on dc1.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
NtFrs 10-12-2006 17:00:30 Warning 13508 The File Replication Service is having trouble enabling replication from dc1 to dc2 for c:\winnt\sysvol\domain using the DNS name dc1.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc1.mijndomein.nl from this computer. [2] FRS is not running on dc1.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
NtFrs 9-12-2006 17:00:29 Warning 13508 The File Replication Service is having trouble enabling replication from dc1 to dc2 for c:\winnt\sysvol\domain using the DNS name dc1.mijndomein.nl. FRS will keep retrying. Following are some of the reasons you would see this warning. [1] FRS can not correctly resolve the DNS name dc1.mijndomein.nl from this computer. [2] FRS is not running on dc1.mijndomein.nl. [3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers. This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
WARNING: Found Event ID 13508 errors without trailing 13509 ... see above for (up to) the 3 latest entries!

......... failed 1
Checking for errors in Directory Service Event Log .... passed
Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size...
ERROR : File Backlog TO server "mijndomein\dc1$" is : 682 :: Unless this is due to your schedule, this is a problem!
failed with 1 error(s) and 0 warning(s)

Checking Overall Disk Space and SYSVOL structure (note: integrity is not checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ...
ERROR: 100,00% (681 out of 681) of your outlog contains Security ACL events.
See KB articles below for further information:
279156 - The Effects of Setting the File System Policy on a Disk Drive or Folder
284947 - Antivirus Programs May Modify Security Descriptors and Cause Excessive Replication of FRS Data in Sysvol and DFS
......... failed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ... passed
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...
SYSTEM\CurrentControlSet\Services\NtFrs\Parameters\Enable Journal Wrap Automatic Restore = 0 :: ERROR: Enabling Journal Wrap Automatic Restore is NOT recommended in post-SP2 version of FRS. Please see KB.292438 (Troubleshooting Journal_Wrap Errors on Sysvol and DFS Replica Sets) for further information!
failed with 1 error(s) and 0 warning(s)

Checking Repadmin Showreps for errors...passed


Final Result = failed with 4 error(s)

Zoals jullie zien is het een keer niet goed gegaan (mijn sysvol share en netlogon kwamen niet meer up toen ik het wilde herstellen met enable journal wrap automatic restore = 1, dus heb ik de sysvols en netlogons handmatig geshared en sysvolready registersleutel op 1 gezet) en nu snap ik niet meer hoe ik dit moet oplossen.
Heb wel al dingen gelezen over authorative en non-authorative restore en begreep dat ik een authorative restore moest toepassen.
Iemand ervaring met dit probleem?
Meer info nodig? trek ff aan de bel!

[ Voor 1% gewijzigd door Verwijderd op 12-12-2006 16:07 . Reden: topictitel ]

[elevator]

Ehm, begin eens simpel met het controleren of je DNS wel juist is. Oftewel, geef eens de IP addressen van alle domain controllers, en geef vervolgens eens de ipconfig /all output van de domain controllers die de fouten geven?

[ElCondor]

Kijk even in mijn eigen post history, daar vind je een post over een overleden DC, daarin staan een aantal artikelen en hints en tips over het authoritief restoren van je SYSVOL share.
Ik heb er behoorlijk wat tijd in gestoken om het voor te bereiden, maar de uiteindelijke handeling is zo gebeurd.
In het kort komt het hier op neer:
Stop de NETLOGON service, en dan de NTFRS service.
Zorg dat één van de DC's netjes opgeruimd is, en een fatsoenlijk uitziende SYSVOL share heeft. Deze is dan nog niet officieel geshared. Dat komt.
Vervolgens back je alle andere DC's up, en maak je de SYSVOL folders leeg.
Dan pas je het registry op de authoritieve DC aan, dmv de burrflag naar D4 (meen ik) en op alle andere DC's geef je de burrflag de waarde D2 (of andersom dus, lees daarvoor de artikelen aandachtig door).
Dan kun je de NTFRS service herstarten en dan de NETLOGON herstarten.
Check van tevoren inderdaad wel eerst even of ze elkaar zowel forward als backwards kunnen pingen, met wander woorden, dat er op GEEN van de DC's communicatie problemen zijn met de andere DC's.
Deze burrflags worden na de authoritieve restore weggehaald, en alles zou moeten terugkeren zoals het was.
Wellicht zul je costum GPO objecten opnieuw aan moeten maken.
Verder is het belangrijk dat je de GPO folder (policies) NIET naar een andere partitie copyed, want dan blijven de NTFS (let op: NIET NTFRS) security instellingen niet bewaard.
Dan zou het kunnen gebeuren dat ongeautoriseerden GPO's opeens kunnen aanpassen.

Als je nog vragen hebt, dan laat even horen.

Succes er mee, en laat even weten of het goed gegaan is!

[Verwijderd]

Replicatie is gelukt.
Was allemaal niet zo moeilijk.
Heb op mn DC1 de burflags registry op D4 gezet (master) en op DC2 de key op D2 (slaaf, naja als de strekking maar duidelijk is. Vond zelf de artikelen nogal onduidelijk hierover.) En de boel gemonitord met Sonar.


Heb een van mn nieuwe mailserver ook maar even een dc gemaakt (W2003) en tevens gc.

Heb nu enkel nog de volgende sores op mijn DC1:
Output van DCDIAG /test:knowsofroleholders

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\dc3
Starting test: Connectivity
......................... dc3 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\dc3
Starting test: KnowsOfRoleHolders
Warning: CN=NTDS Settings\0ADEL:2502f91f-d076-41a1-83a2-bbcc89d3d61f,CN=dc1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mijndomein,DC=nl is the Domain Owner, but is deleted.
......................... dc3 failed test KnowsOfRoleHolders

Running partition tests on : Schema

Running partition tests on : Configuration

Running partition tests on : mijndomein

Running enterprise tests on : mijndomein.nl

Welke rol moet ik nu precies seizen en hoe fix ik dit? PDC/RID? ik kom er niet uit met googelen en mijn parate kennis schiet hier net ff te kort.
De rest van de fsmorollen komen allemaal goed door de test.

[ Voor 69% gewijzigd door Verwijderd op 29-12-2006 16:49 ]

[Zwelgje]

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

[Verwijderd]

Zwelgje schreef op vrijdag 29 december 2006 @ 18:35:
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller

Denk je dat ik die nog niet allemaal doorgespit heb?
Moet dus alleen de domain owner rol door een andere dc over laten nemen, maar welke rol bedoelt dcdiag daar nou weer? Schema master? PDC emulator? RID master? Staat toch echt nergens duidelijk in volgens mij, of ik heb teveel gezocht.

[Zwelgje]

Verwijderd schreef op zaterdag 30 december 2006 @ 19:24:
[...]

Denk je dat ik die nog niet allemaal doorgespit heb?
Moet dus alleen de domain owner rol door een andere dc over laten nemen, maar welke rol bedoelt dcdiag daar nou weer? Schema master? PDC emulator? RID master? Staat toch echt nergens duidelijk in volgens mij, of ik heb teveel gezocht.

ntdsutil kun je dus ook gebruiken om dat te zien... maar goed dat heb je natuurlijk al helemaal doorgespit.

[Verwijderd]

Heb nog niet zoveel met ntdsutil gedaan, maar ik ga er wel ff naar kijken.

[Verwijderd]

Dank!
Weer wat geleerd