Replication issues: Operations Master shows ERROR and attempting to connect to server shares gets "the target account name is incorrect"

Question

I think this should be easily resolved, but I need some guidance.
I have a client with 2 Server 2003 R2 x64 DCs: BORIS & NATASHA. Last year I upgraded both of them from x86 to x64 one at a time, allowing replication to occur between the upgrades. BORIS is the FSMO roles holder as it is currently the production server,
while NATASHA is a backup DC. One thing that puzzles me though is that if I look at the NS record in DNS on the SOA tab, it says NATASHA is the Primary server.
While doing some routine maintenance I noticed an error in the File Replication Service events about a 'Tombstone' situation (Event ID 2042). I looked at article cc757610 in the Technet Library and opted for remedy #3 as I did not want to demote NATASHA
and I got confused looking at the help about using "repadmin /removelingeringobjects". I have no idea how to determine which DC has the good copy of the directory.
Now, in running "repadmin /showrepl" I get
"DC=CPA,DC=local
    Default-First-Site-Name\BORIS via RPC
        DC object GUID: 0267a090-1890-40e2-9a15-ea928cabd425
        Last attempt @ 2012-12-27 08:28:55 failed, result -2146893022 (0x80090322):
            The target principal name is incorrect.
        1179 consecutive failure(s).        Last success @ 2012-12-21 23:30:15." <-- THIS IS WEIRD SINCE THIS IS THE DATE THAT I DISCOVERED THE TOMBSTONE EVENT AND MADE THE REGISTRY CHANGE
(I THINK).
When I try to look at the FSMO roles on NATASHA, it shows ERROR for RID, PDC & Infrastructure and says "The current Operations Master is offline. The role cannot be transferred." The other issue I'm having is that client PCs are intermittently having
trouble reconnecting to necessary server shares.
TIA
Wayne S. CompTIA A+ CompTIA Network+ Microsoft MCP

Answer 1

Hello Sandesh,
I spent a lot of time trying to understand using NETDOM to reset machine account passwords (don't understand it yet), but I see that you're saying that won't work anyway.
I'm not really sure how to tell which DC is the broken one, but I'm assuming it's BORIS since that's the one users are unable to connect to. Since it is the FSMO role holder and GC I want to make sure I understand the steps correctly:
1.Use dcpromo to forcefully demote BORIS
2.Do metadata cleanup on NATASHA (using ntdsutil?)
3.Promote BORIS again to DC
Should I leave NATASHA as the FSMO role holder and GC? BORIS is the better (more resources/faster processor) machine and it's the file server. Or should the better machine be the FSMO role holder and GC as well as the file server. NATASHA is meant to be
a backup in case BORIS dies.
Thanks,
Wayne S. CompTIA A+ CompTIA Network+ Microsoft MCP www.InfoTek831.com
Hi,
The step you are performing is correct but you also need to seize the FSMO role on other DC if BORIS is FSMO role holder and configure authorative time server role.You can later move the famo role to  BORIS server the choice is your however if you are
moveing the role then you need configure authorative time server on BORIS server.
Configuring the time service on the PDC Emulator FSMO role holder
http://msmvps.com/blogs/acefekay/archive/2009/09/18/configuring-the-windows-time-service-for-windows-server.aspx
Domain Replication has exceeded the tombstone lifetime
http://pmeijden.wordpress.com/2011/01/12/domain-replication-has-exceeded-the-tombstone-lifetime/
Forcefull removal of DC:
http://support.microsoft.com/kb/332199
How to transfer or seize FSMO roles
http://sandeshdubey.wordpress.com/2011/10/07/how-to-transfer-or-seize-fsmo-roles/
Metadata Cleanup of a Domain controller
http://sandeshdubey.wordpress.com/2011/10/12/metadata-cleanup-of-a-domain-controller/
Once both server is online check the health of DC by running dcdiag /q and repadmin /replsum.Ensure that DNS/GC role is configured on both DC's
Hope this helps
Best Regards,
Sandesh Dubey.
MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator |
My Blog
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.