Active directory intersite replication minimum polling interval is 15 min or 7.5 min ?

in  MCITP 70-640 R2 Self-paced training kit , at page 593, we read :
"The minimum polling interval is 15 minutes. With this setting, and using Active Directory’s
default replication configuration, a change made to the directory in one site takes on average
seven and a half minutes to replicate to domain controllers in another site."
i don't underestand which one is true at last ? 15 min or  7.5 min ?
i wonder at my exercises i noticed that replication occured between sites at about that 7.5 min  and didn't take  15 min.
if that is 7.5 min , so what is the reason that they wrote 15 min ?

at a maximum 15 min.
the so called average is 7,5 min <----- forget this!
remember the following as your rule of thumb: the minimum interval that can be configured is 15 min and the default is 180 min (3 hours). The interval is the max amount of time that needs to pass before the DCs (between sites) initiates inbound replication.
So it will take the period of the interval or less before replications starts
<o:p></o:p>
Cheers,<o:p></o:p>
(HOPEFULLY THIS INFORMATION HELPS YOU!)
Jorge de Almeida Pinto | MVP Identity & Access - Directory Services
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/
################# Jorge's Quest For Knowledge ###############
###### BLOG URL: http://JorgeQuestForKnowledge.wordpress.com/ #####
#### RSS Feed URL: http://jorgequestforknowledge.wordpress.com/feed/ ####
-------------------------------------------------------------------------------------------------------<o:p></o:p>
"john.s2011" wrote in message news:[email protected]...
in  MCITP 70-640 R2 Self-paced training kit , at page 593, we read :
"The minimum polling interval is 15 minutes. With this setting, and using Active Directory�??s
default replication configuration, a change made to the directory in one site takes on average
seven and a half minutes to replicate to domain controllers in another site."
i don't underestand which one is true at last ? 15 min or  7.5 min ?
i wonder at my exercises i noticed that replication occured between sites at about that 7.5 min  and didn't take  15 min.
if that is 7.5 min , so what is the reason that they wrote 15 min ?
Jorge de Almeida Pinto [MVP-DS] (http://jorgequestforknowledge.wordpress.com/)

Similar Messages

  • Active directory SYSVOL replication issues

    Hello. 
    I have 2 domain controllers, both of them on the same site DC1 & DC2. I have added a new site with a DC3. When I have added DC3 to the domain, I have realized, SYSVOL was not initialized correctly. I went back to DC1 and found out, there's following
    error in the event viewer:
    Error: 4012 on DC1
    The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter
    (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.
    Error: 2213 on DC2
    The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication
    WMI method to resume replication. 
    This indicates a DFS replication issue between DC1 & DC2 and probably this would be the reason, why the SYSVOL was not properly initialized on DC3. 
    How can I restore correct DFS replication between DC1 & DC2? I've read
    this article, but it's not clear to me, which of the 2 domain controllers has a good version of SYSVOL + I can not find a decent step-by-step article for reconnecting Windows 2012 domain controller.
    Any idea, how I can proceed further here?

    Here's a complete documentation with resolution of my issue. I have created this documentation for my own purposes in our WIKI, so I will paste it here (I hope, it will help somebody else in the future):
    The Problem
    We have bought a new server for our domain. This server (NEWDC01) was promoted to be a domain
    controller in the DOMAIN. After the promotion, I have added a single computer to the domain. When I have logged on the client to the domain, I realized, this computer is not using the new domain controller (NEWDC01)
    for authentication, but DC02 domain controller instead. This is not intended. Local clients should use local domain controllers for authentication (assuming, the Active directory sites & services are configured properly). Further investigation revealed,
    there are some replication errors on OLDDC01 & OLDDC02 servers. First I need to solve these replication errors. Then I can
    add the NEWDC01 server to domain properly.
    Analysis
    There are several errors related to DFSR replication on both domain controllers:
    Error: 4012 on OLDDC01
    The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain.
    This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder
    until this error is corrected.
    Error: 2213 on OLDDC02
    The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database
    is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
    In order to have active directory in a healthy condition, one must ensure, there’s a successful
    replication between existing domain controllers up and running. If the replication does not work correctly, you can expect bunch of issues.
    group policies and logon scripts are not applied correctly, or as intended
    when you want to add a new domain controller to the domain, it will not work as expected (although, you will not see any specific errors after the
    server is promoted to be a domain controller)
    Active directory backup
    I have scheduled an AD backup on OLDDC01 server using the ‘Windows Backup’ solution to make sure,
    I can restore the AD / SYSVOL, in case something goes wrong. The backup is scheduled to be executed every day.
    Active directory restore
    In this particular case, I will talk only about SYSVOL restore. As indicated above, we must get
    rid of the DFSR event viewer errors which you can find in event viewer. One of them is indicating, that the JET database was not shut down cleanly and autorecovery was disabled. The other error indicates, the SYSVOL volume is no longer replicated. I am not
    sure, what is the reason, why the AD’s in the domain stopped to replicate. Probably it was an unclean server shutdown. The DFSR service stopped to replicate the SYSVOL share and I was not aware about that. When the replication did not run for more than ~99
    days, the SYSVOL share was excluded from the DFSR replications.
    Find out the most accurate SYSVOL share in the domain
    I have compared the content of the SYSVOL directories on both OLDDC01 and OLDDC02 servers: C:\Windows\SYSVOL\domain\Policies.
    Both directories have 37 subdirectories. Each subdirectory corresponds to one group policy. This means, that the content is approximately the same, thus I can’t tell, which version is most recent. I do most of the GPO changes on OLDDC01, so I made a conclusion,
    that this server contains the most recent version of the SYSVOL share.
    There are 2 types of SYSVOL restores, you can do:
    Authoritative restore
    Non-authoritative restore
    Non-authoritative restore
    This is a more simple kind of a restore. You can perform this kind of restore, when you are sure,
    that one of the domain controllers is authoritative (e.g. you presume, the SYSVOL share is intact and working properly). If you can identify such a working server, you can perform non-authoritative restore of the active directory on a broken domain controller.
    Authoritative restore
    In this case, you can designate a specific domain controller to be authoritative. You set a special
    flag on this server, which will prohibit to overwrite it’s state from another domain controllers, when the replication is enabled on the server again. After you designate one server to be authoritative, you need to update all the another domain controllers
    using the non-authoritative procedure.
    In this article, you can find, how to perform authoritative vs. non authoritative AD resotre:
    http://support.microsoft.com/kb/2218556.
    In my case, I was not sure, which of the domain controllers had a more recent copy of AD, so I
    have decided to make OLDDC01 authoritative (check the link above). Once this has been done, I have made a non-authoritative update on OLDDC02 server.
    Everything was almost ready. The last step, I needed to execute was, I needed to fix the ‘JET’
    event viewer error on SRVBK1. In the event log entry on the bottom, you can find following:
    Recovery Steps
    1. Back up the files in all replicated folders on the volume. Failure to do
    so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
    2. To resume the replication for this volume, use the WMI method ResumeReplication
    of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
    wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig
    where volumeGuid="D37A9FC3-8B1D-11E2-93E8-806E6F6E6963" call ResumeReplication
    For more information, see http://support.microsoft.com/kb/2663685.
    Final words
    After I have executed this command, the replication was again started between OLDDC01 and OLDDC02
    servers. After I have started up the NEWDC01 server, I have realized, it has automatically replicated the contents of the SYSVOL share - almost immediately after the server was started up. I have again tried to login with the local client into DOMAIN domain
    and now I see, that local client is using local Domain controller for authentication.
    Everything seems to be OK now.

  • Active Directory - SharePoint Replication Problem with User Information

    Hi, we have a implementation of SharePoint 2010 stand alone server, when we start to work in this server, we add the users from Active Directory services implemented in our company. This users had information like the email and department. When i add one
    user to SharePoint, sharepoint import all information user.
    The problem is when i change the email information from the user in Active Directory, this information didnt replicate to SharePoint.  The user have the new email In Active Directory and the old email in SharePoint.
    How can i replicate new one all information from the user to SharePoint?
    I hope someone can help me..
    thanks. 

    Standalone installations of SharePoint do not support the User Profile Sync Service. You'll want to use a farm installation for that functionality.
    Are you using SharePoint Foundation, Standard, or Enterprise? The UPSS only comes with Standard and Enterprise.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Active Directory data replication to database

    Hi Guys
    Does anybody known how to replicate data from Active Directory (groups and users) direct to database table like Oracle?
    My research drive me to code a program that make persistent search on Active Directory monitoring object changes to make insert or update in my table.
    Java Technology Forums - JNDI, Active Directory and Persistent Searches (part 1)
    http://forum.java.sun.com/thread.jspa?threadID=578338&tstart=200
    Java Technology Forums - JNDI, Active Directory and Persistent Searches (part 2)
    http://forum.java.sun.com/thread.jspa?forumID=51&threadID=672007
    Is it a good idea ?
    Thanks
    MHM

    As I said previously, it depends on how frequently you need to synchronise the database; weekly, daily, hourly, realtime.
    LDIFDE, CSVDE can be used to export LDIF or CSV files respectively, which you could then import into a database. That would be a good pragmatic solution for something that needs to be done daily or weekly.
    The DIRSYNC control is good for any schedule synchronisation, whereas the LDAP Notification Control is better suited to real time applications.
    I am rather flattered that the post you referred to http://www.forumeasy.com/forums/thread.jsp?tid=117381285598&fid=ldapprof2&highlight=LDAP+Persistent+Search+Control+JNDI+Client
    is based on my original sample titled "JNDI, Active Directory and Persistent Searches (part 2)" which I posted at
    http://forum.java.sun.com/thread.jspa?threadID=672007&tstart=90
    BTW, the sample for using the dirscnc control which is titled "JNDI, Active Directory & Persistent Searches (part 1)" is available at
    http://forum.java.sun.com/thread.jspa?threadID=578338&tstart=200
    Another alternative would be to install another server with Active Directory Application Mode (ADAM) specifically for your "expensive" queries and use a tool such as ADAMSync to populate it from your other Active Directory domain controllers.
    ADAMSync is included with ADAM and you can find the command line options described at http://technet2.microsoft.com/windowsserver/en/library/c64799ab-88c0-4e5a-b296-bc26031141291033.mspx?mfr=true
    Personally, I would much prefer to use something like LDIFDE, CSVDE, ADAMSync or a full fledged synchrisation/provision product such as Identity Lifecycle Manager rather than write (and debug/maintain) my own code.

  • Active Directory Domain replication

    davidr4 wrote:
    Is your DC virtual?  Just clone it and put it on an isolated networktechnically they have created another environment and ask us to duplicate the data and the Infrastructure.

    Good afternoon Spicers, what is the best option and way to replicate an AD infrastructure for testing purpose? I want everything in the production be cloned so that I can test in a test environment. how do I go by doing that?
    Please helpp!!
    This topic first appeared in the Spiceworks Community

  • "I'm a Mac" in an Active Directory World . . .

    Hi -
    Here is the brief summary of my question/dilemma: what is the absolutely best, most seamless, reliable VPN methodology for connecting my Mac to my work environment when I am traveling? Here is the kicker: our corporate environment is a Windows 2003 Active Directory environment. We use Microsoft's built-in VPN over PPTP and it is fraught with issues (see below). I am even open to buying something just so my connection works well to the active directory network like a Cisco VPN appliance or even buying a Mac Mini Snow Leopard Server box if the built-in VPN server in that box will work best with my Mac and allow me to access all the active directory resources from outside the office.
    Many thanks!
    Matt
    More Context on Issues
    When I am outside of work and want to VPN in it just doesn't work well. If I use Apple's built-in PPTP client I can get it to work but there is no check box like on Windows called "Send all network traffic through VPN" that I can turn off so that only traffic going to my work network goes through the VPN. Thus whenever I am on the VPN I can't use any internet resources.
    In addition, the internal DNS resolution just doesn't seem to work well as I have to often use IP addresses for file servers when connected through the VPN as opposed to the "server names."
    Finally, it is just much slower compared to connecting from a Windows laptop over the VPN over the exact same broadband connection. Especially for file server access.
    Also, our Microsoft VPN does use L2TP for our windows machines but requires a Windows certificate, which I have assumed Mac OS does not support.

    I found this article that you might take a look at:
    http://www.peachpit.com/articles/article.aspx?p=676983&seqNum=5
    It's a bit dated and so many of the settings are in different locations now (in Snow Leopard they're all in the Network system preference) but it might be of help. As to your certificate question, the Keychain Access utility on your system allows importing of certificates (select Certificates in the sidebar and click the "+" button) and it looks like it does support Microsoft certs - there's a category specifically for them - so it does look possible. But not having set up a VPN to a Windows system (we use Cisco here) I can't be certain.
    Hope this helps.

  • Active Directory Replication Servers (wont replicate SYSVOL and NETLOGON Not showing)

    I have my first DC Server (DC1). DC1.DOMAIN.lOCAL, I decided to add another Domain Controller. Made it a secondary DNS Server and also GC. Everything seems to replicate, but its missing NETLOGON and SYSVOL Wont replicate. 
    Windows 2008 R2

    Errr 5706
    The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\INFGRP.LOCAL\SCRIPTS.  The following error occurred: 
    The system cannot find the file specified.
    Event 7009
    A timeout was reached (30000 milliseconds) while waiting for the File Replication service to connect.
    Event 1058
    The processing of Group Policy failed. Windows attempted to read the file \\INFGRP.LOCAL\SysVol\INFGRP.LOCAL\Policies\{55DE4000-0D51-44CD-92A1-30F286B2BC86}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until
    this event is resolved. This issue may be transient and could be caused by one or more of the following: 
    a) Name Resolution/Network Connectivity to the current domain controller. 
    b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
    c) The Distributed File System (DFS) client has been disabled.
    All Critical
    This domain controller has migrated to using the DFS Replication service to replicate the SYSVOL share. Use of the File Replication Service for replication of non-SYSVOL content sets has been deprecated and therefore, the service has been stopped. The DFS
    Replication service is recommended for replication of folders, the SYSVOL share on domain controllers and DFS link targets.
    Test replication
    Domain Controller Diagnosis
    Performing initial setup:
       * Verifying that the local machine dc, is a DC. 
       * Connecting to directory service on server dc.
       * Collecting site info.
       * Identifying all servers.
       * Identifying all NC cross-refs.
       * Found 2 DC(s). Testing 1 of them.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\dc
          Starting test: Connectivity
             * Active Directory LDAP Services Check
             * Active Directory RPC Services Check
             ......................... dc passed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\dc
          Starting test: Replications
             * Replications Check
             * Replication Latency Check
                DC=ForestDnsZones,DC=GRP,DC=LOCAL
                   Latency information for 7 entries in the vector were ignored.
                      7 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                DC=DomainDnsZones,DC=GRP,DC=LOCAL
                   Latency information for 7 entries in the vector were ignored.
                      7 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                CN=Schema,CN=Configuration,DC=GRP,DC=LOCAL
                   Latency information for 8 entries in the vector were ignored.
                      8 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                CN=Configuration,DC=GRP,DC=LOCAL
                   Latency information for 9 entries in the vector were ignored.
                      9 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                DC=GRP,DC=LOCAL
                   Latency information for 9 entries in the vector were ignored.
                      9 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
             ......................... dc passed test Replications
          Test omitted by user request: Topology
          Test omitted by user request: CutoffServers
          Test omitted by user request: NCSecDesc
          Test omitted by user request: NetLogons
          Test omitted by user request: Advertising
          Test omitted by user request: KnowsOfRoleHolders
          Test omitted by user request: RidManager
          Test omitted by user request: MachineAccount
          Test omitted by user request: Services
          Test omitted by user request: OutboundSecureChannels
          Test omitted by user request: ObjectsReplicated
          Test omitted by user request: frssysvol
          Test omitted by user request: frsevent
          Test omitted by user request: kccevent
          Test omitted by user request: systemlog
          Test omitted by user request: VerifyReplicas
          Test omitted by user request: VerifyReferences
          Test omitted by user request: VerifyEnterpriseReferences
          Test omitted by user request: CheckSecurityError
       Running partition tests on : ForestDnsZones
          Test omitted by user request: CrossRefValidation
          Test omitted by user request: CheckSDRefDom
       Running partition tests on : DomainDnsZones
          Test omitted by user request: CrossRefValidation
          Test omitted by user request: CheckSDRefDom
       Running partition tests on : Schema
          Test omitted by user request: CrossRefValidation
          Test omitted by user request: CheckSDRefDom
       Running partition tests on : Configuration
          Test omitted by user request: CrossRefValidation
          Test omitted by user request: CheckSDRefDom
       Running partition tests on : GRP
          Test omitted by user request: CrossRefValidation
          Test omitted by user request: CheckSDRefDom
       Running enterprise tests on : GRP.LOCAL
          Test omitted by user request: Intersite
          Test omitted by user request: FsmoCheck
          Test omitted by user request: DNS
          Test omitted by user request: DNS
    On the second DC (DCR). I see SYSVOL, no files replicated, also theres no NETLOGON.

  • The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error. : Error: An Active Directory Constraint Violation error occurred

    Hello,
    We have a multi domain parent child AD domain infrastructure and now we upgraded our exchange from Exchange 2007 to Exchange 2013. Since last few days, we see the below error on the mailbox server event viewer.
    EVENT ID : 1121
    The Microsoft Exchange Mailbox Replication service was unable to process a request due to an unexpected error. 
    Request GUID: '93a7d1ca-68a1-4cd9-9edb-a4ce2f7bb4cd' 
    Database GUID: '83d028ec-439d-4904-a0e4-1d3bc0f58809' 
    Error: An Active Directory Constraint Violation error occurred on <domain controller FQDN>. Additional information: The name reference is invalid. 
    This may be caused by replication latency between Active Directory domain controllers. 
    Active directory response: 000020B5: AtrErr: DSID-0315286E, #1:
    Our Exchange setup is in parent domain, but we keep on getting this error for various domain controllers in each child domain in the same site. We then configured one of the parent domain domain controller on Exchange. Still we are getting this error for
    the configured parent domain DC.
    Verified the AD replication and there is no latency or pending stuffs.
    Any support  to resolve this issue will be highly appreciated. Thank you in advance.
    Regards,
    Jnana R Dash

    Hi,
    In addition to Ed's suggestion, I would like to clarify the following things for troubleshooting:
    1. Please restart IIS at first.
    2. If the issue persists, please ping your DC on your Exchange server to check if Exchange can communicate with DC.
    Hope it helps.
    Best regards,
    Amy Wang
    TechNet Community Support

  • Active Directory : Replication Issue - "Disconnected" sub-domain from the Forest

    Hello everyone,
    I'm managing a multi-domain forest (with 7 sub-domain).  All are working fine except for one.  Throught repadmin (Repadmin /replsum /bysrc /bydest /sort:delta), I noticed I got both domain controllers of a subdomain (there are only 2 DCs in that
    subdomain), who hadn't replicated with the rest of the forest for more than 60 days.
    According to my research, it's usually recommended to Depromote and repromote the problematic DC to avoid the issue of lingering objects.  In this case, it's both DC of a sub-domain.  Of course, on the others DCs in the forest, I got the event
    ID 2012 "it has been too long since this machine last replicated with the named source machine....". 
     HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
    to a value of 1. 
    As I understand it, this may cause lingering objects to appear (they can be removed with repadmin /removelingeringobjects command with the DSA GUID, naming context, etc..).  So far, I haven't used that registry key yet because of the associated risks.
    I didn't noticed any other issue so far.  Users in the problematic sub-domain are fine, and the problematic sub-domain seems to be able to pull replication data from the others DCs in the forests. (at least, I'm not getting any error in the A.D. Sites
    and Services)
    I added two new DCs for the affected sub-domains, so the number of DCs for that domain went from 2 to 4 DCs.  The two old DCs that hadn't replicated for 60 days are windows Server 2003 and the two new DCs are Server 2008 R2. 
    Unfortunately (and I was half expecting this, but did it anyway since I must eventually replace the old DCs), that didn't solve my issue, since the rest of the forest "doesn't see" the two new DCs of the sub-domain.  By that, I mean that I
    cannot add an Active Directory Domain Services Connection in Sites & Services console (from a DC in another domain of the forest or even the root domain).  I see all the DCs, including the two old DCs that are server 2003, but not the new ones. 
    I believe it's because the others DCs doesn't pull/replicate the information from the old DCs anymore, so they aren't "aware" of the two new DCs for that problematic sub-domain.
    I was wondering what is the best course of action. Is it worthwhilte to use the registry key force replication with the old DCs ?  (and hopefully, the new DCs will get their AD Services connection/replication vector created, so I can depromote
    the old DCs.
    Since the Old DCs from the problematic sub-domain seems to be able to pull the replication from the rest of the forest, does the risk of Lingering object isn't that great ?
    Or is it too risky and I must create a new sub-domain and migrate one way or another the users ? (which would be time-consuming)
    Thanks in advance,
    Adam

    Thanks for the reply.  One of the link had another link to a good article about the use of repadmin :
    So, I ran the command "repadmin /removinglingerobjects " on one of the problematic DCs ().
    For clarity purpose, let's say I used the domain :
    domain = main domain
    subdomain = the domain whose DC are problematic (all of them).
    AnotherSubDomain = Just another subdomain I used as a "reference" DC to cleanup the appropriate partition.
    Command (the DSA guid is from a DC "clean" in another domain)
    repadmin /removelingeringobjects adrec01.mysubdomain.domain.ca C4081E00-921A-480D-9FDE-C4C34F96E7AC dc=ANOTHERsubdomain,dc=domain,dc=ca /advisory_mode
    I got the following message in the event viewer :
    Active Directory Domain Services has completed the verification of lingering objects on the local domain controller in advisory mode. All objects on this domain controller have had their existence verified on the following source domain controller.
    Source domain controller:
    c4081e00-921a-480d-9fde-c4c34f96e7ac._msdcs.mydomain.ca
    Number of objects examined and verified:
    0
    Objects that have been deleted and garbage collected on the source domain controller yet still exist on this domain controller have been listed in past event log entries. To permanently delete the lingering objects, restart this procedure without using the
    advisory mode option.
    How should I interpret the message "number of objects examined and verified 0".  Does it mean it just didn't find any object to compare ? (which would be odd IMHO)  Or there is another problem ?
    Thanks in advance,
    Adam

  • Active Directory error 1864 (replication)

    Hello colleagues
    I have 5 DC's (1dc.test.local - 5dc.test.local) and 1 DC (6dc.test.local) out of domain 3 months. All DC's is Windows 2003 in one domain test.local. Then I changed IP address for 6dc.test.local and connect it to LAN of domain (to another 5 DC's). I see that
    6dc.test.local now have lastest update copy of DNS zone and AD. Now I want remove 6dc.test.local from a domain but I can't do this, after run DCPROMO I take an error:
    "The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime."
    and have error 1864 (about replication) in events.
    Maybe someone already have this problem? How can I remove 6dc.test.local from domain and that another DC's in domain khows about it?
    Please help!

    Hi,
    Please remove the 6th dc using following command.
    DCPROMO /Forceremoval
    If that one also failed run the metadata cleanup using script given below. make sure you run this scriptfrom PDC server and then delete the records manually from DNS console given below. Once you have done that kindly Rebuild the OS & then Promote as
    Domain controller.
    https://gallery.technet.microsoft.com/scriptcenter/d31f091f-2642-4ede-9f97-0e1cc4d577f3
    Repeat running the vbs script till the wrong/unnecessary dc’s are removed.
             Cross check the removal – dsa.msc [ad users and computers] > Domain Controllers OU
     Adsiedit.msc
     Expand domain partition, select OU=Domain Controllers, make sure only the necessary domain controllers are listed.
     Delete the incorrect domain controllers.
    Dnsmgmt.msc [Dns Management]
          Expand the forward lookup zones\_msdcs folder
    i.      Make sure only the actual domain controllers are listed, delete wrong Alias recordsremove wrong name server records
    ii.      Select the container [forward lookup zones\_msdcs.domain.com\dc\_sites_\sitename\_tcp] > delete incorrect _ldap and _kerberos records are listed.
    iii.      Select the container [forward lookup zones\_msdcs.domain.com\dc\_tcp] and delete incorrect _ldap and _kerberos records
    iv.      Expand the [forward lookup zones\_msdcs.domain.com\domains\guid\_tcp] and delete incorrect _ldap entries
    v.      Select [forward lookup zones\_msdcs.domain.com\gc] – delete incorrect HostA records
    vi.      Expand the [forward lookup zones\_msdcs.domain.com\gc\_sites\sitename\_tcp] – delete incorrect _ldap entries
    vii.      Select the [forward lookup zones\_msdcs.domain.com\gc\_tcp] – delete incorrect _ldap entries
    viii.      Select the [forward lookup zones\_msdcs.domain.com\pdc\_tcp] – delete incorrect _ldap entries
          Expand the forward lookup zones\domain.com folder
    i.           
    Delete Host(A) records of dc’s which are non-existant.
    ii.           
    Correct the NameServer (NS) records
    iii.           
    Follow steps similar to ’ A ii ‘ >> ‘ A viii’
             Dssite.msc [Sites and Services]
          Expand the [Sites\Sitename\Servers] – delete incorrect server’s
    B.      Delete incorrect subnet configurations [Sites\Subnets]
          Delete incorrect site links [Sites\IP]

  • Replication Active Directory, ports issues in firewall

    Hi,
    i am facing some issue  in active directory replication between my Active Directory User  Database located in two different locations.
    I  am not doing any Port based ACL in the firewall, and there is no static  / dynamic NAT-ng used between the server ip ranges (nat 0).
    1) what could be the possible issue in this?2) do i need to issue any command in the FWSM Module to make use / open the dynamic ports ?3) How can i make sure that these ports are not opend or not blocked on the firewall.
    below are some of the ports used for this, based on the information from Microsoft Team.
    tcp 5389
    tcp 5722
    tcp 5729
    tcp3268
    tcp 3269
    tcp 445
    udp 445
    udp 88
    udp 2535
    udp 389
    tcp 1025 - 5000
    tcp 44152 - 65535
    Appreciate your valuable support.
    regards
    Sunny

    Hi Bro
    If you’re not doing any port based ACL in your FWSM, I can only assume you’re permitting the rules between both the AD by IP e.g. access-list inside permit ip host 1.1.1.1 host 2.2.2.2, am I right? I hope you can PING between both the AD, otherwise this could be a routing issue.
    Listed below are some commands that you could type to investigate this issue further;
    a)   show np block (hardware buffer counters) - if they are non-zero and increasing it's bad. You're most likely running into hardware limitation of the FWSM.
    b)   show np all stats | i RTL and show np all stats | i RL will show you if the packets are dropped because of software rate limiting mechanisms built into network processors.
    Perhaps, what you need is to enable the “xlate-bypass” command. By default, the FWSM creates NAT sessions for all connections even if you do not use NAT. You can disable NAT sessions for untranslated network traffic, which is called xlate bypass, in order to avoid the maximum NAT session limit. The xlate-bypass command can be configured as shown:
    hostname(config)#xlate-bypass
    If the xlate-bypass doesn’t resolve your issue, please do ensure you’ve a static NAT or dedicated nat/global in place.
    The last resort is to enable sysoption np completion-unit, this magic option is invoking special processing created to address scenarios in which FWSM was known to introduce out of order packets for TCP streams.

  • Active Directory Ghost Object replication issue

    I have a Windows 2003, Single Forest with nearly 50 Domains. This is a constantly changing, deployable system where not all Domains are connected and online at all times.
    Some months ago 2 of these domains were held up in transit and tombstoned. Before they were connected to the Forest again they went to our Hardware support department to be "cleaned" meaning remove dust etc, instead they wiped the arrays on all
    servers.
    Our Level 4 Support team reanimated these node after restoring them from a really old backup.
    This backup did not refelect the AD as it was when it was deleted, therefore we have several orphaned objects form those domains. The Domains are functioning correctly and replicating, however, the GC in the forest is inconsistent and the orphaned/ghost
    objects are still being replicated.
    We have rehosted the directory partitions from the problem nodes to online domains which works fine, but as soon as another domain comes online the orphaned objects are again replicated into the Global Catalog. The nature of our system means that we cannot
    control when the other domains are coming back online to rehost them before replicating the object items back into the GC.
    I have made several LDAP queries and can see that the items no longer exist on the problem domain, the only reference to the objects is in the GC directory partitions of those domains.
    The biggest issue I have is that these objects were mail enabled users and when the GAL queries the GC it is repopulating them. 
    I've hit a bit of a wall now and do not know how we can remove these ghost objects without having all domains online at the same time and rehosting the problem domains partitions forest wide. I'd appreciate any assistnce.
    I have asked this question before but with less detail so I'm having another go!

    An AD backup is as good as the Tombstone lifetime. By default the TSL of a 2003 forest functional level is 60. So if you haven't done this already you should probably configure a higher value for the TSL. By default Strict Replication
    Consistency is also enabled to prevent DC that have been disconnected for a long time to propagate lingering objects into the AD topology, check to see if you have this enabled. You should use "repadmin" to remove the lingering objects.
    "When a domain controller in your Active Directory environment is disconnected from the replication topology for an extended period of time, all objects that are deleted from AD DS on all other domain controllers might remain on the disconnected
    domain controller. Such objects are called lingering objects. When this domain controller is reconnected to the replication topology, it acts as a source replication partner that has one or more objects that its destination replication partners no longer have.
    Problems occur when these lingering objects on the source domain controller are updated and these updates are sent by replication to the destination domain controllers. A destination domain controller can respond in one of two ways:
    If the destination domain controller has strict replication consistency enabled, it recognizes that it cannot update the object (because the object does not exist), and it locally halts inbound replication of the directory partition from that source
    domain controller.
    If the destination domain controller does not have strict replication consistency enabled, it requests the full replica of the updated object, which introduces a lingering object into the directory."
    Also keep in mind that the Infrastructure Master role handles the cross-domain references and phantoms from the global catalog in its domain. Make sure that you either have all DCs as Global Catalogs or do not place the GC on the DC with the IM role.
    Here are some useful links:
    Determine the tombstone lifetime for the forest
    Event ID 1388 or 1988: A lingering object is detected
    Use Repadmin to remove lingering objects
    Enable strict replication consistency
    FSMO placement and optimization on Active Directory domain controllers
    Phantoms, tombstones and the infrastructure master
    http://mariusene.wordpress.com/

  • Replication with Domain and Sub domain in Active directory sites and services

    I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically because
    it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?

    I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically
    because it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?
    Two way transitive trusts are configured automatically when you create a child domain or tree root domain. You don't have to worry about site/subnet or replication part at least from trust perspective. But make sure site's names are unique in each domain.
    How Domain and Forest Trusts Work
    http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx
    http://technet.microsoft.com/en-us/library/cc730868.aspx
    http://blogs.technet.com/b/askds/archive/2008/09/24/domain-locator-across-a-forest-trust.aspx
    Awinish Vishwakarma - MVP
    My Blog: awinish.wordpress.com
    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

  • Can't fix Active Directory replication

    Hi,
    I am not sure when the replication issue started, but it is for month now. Whe have two AD's and so actually, we have one working fine (probably). Users are replicated fine (at least they show in the second AD tree) and also, the group policies replicates
    (they show in the group policy tree).
    But, in the \\dc02\SYSVOL\domainname.com\Policies directory, nothing is shared. It's completely out of date. Also the group policy manager gives an warning: 1 Domain controller(s) with replication in progress.
    Anyway, me, and other members of the IT-staff looked into it but it looks that the problem goes deep.
    So my question is, what is the best way to solve this. Start to place some errors here or maybe we should completely re-install the second DC? Or both? Or is that a bad idea?
    Thanks for any help!

    Thanks for the responses!
    Problem is, Event viewer keeps giving different errors. I just restarted my secondary DC and it gives this error:
    This domain controller has migrated to using the DFS Replication service to replicate the SYSVOL share. Use of the File Replication Service for replication of non-SYSVOL content sets has been deprecated and therefore, the service has been stopped. The DFS Replication service is recommended for replication of folders, the SYSVOL share on domain controllers and DFS link targets.
    Before restart, I ran dcdiag again and it gave problems with NCSecDesc. So permission problem. I fixed that and after that I ran dcdiag again and no errors were showing. But sysvol directory was still not in sync.
    After that, I restarted and the top error is shown in event viewer and dcdiag gives me another, new error:
    Starting test: SystemLog
    A warning event occurred. EventID: 0x000727A5
    Time Generated: 04/16/2014 18:02:36
    Event String: The WinRM service is not listening for WS-Management requests.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 04/16/2014 18:03:13
    Event String:
    The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may o
    ccur.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 04/16/2014 18:03:13
    Event String:
    The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may o
    ccur.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 04/16/2014 18:03:13
    Event String:
    The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may o
    ccur.
    An error event occurred. EventID: 0xC0001B61
    Time Generated: 04/16/2014 18:03:40
    Event String:
    A timeout was reached (30000 milliseconds) while waiting for the File Replication service to connect.
    An error event occurred. EventID: 0xC0001B6F
    Time Generated: 04/16/2014 18:03:41
    Event String: The Diagnostic System Host service terminated with the following error:
    An error event occurred. EventID: 0xC0001B6F
    Time Generated: 04/16/2014 18:03:41
    Event String: The Diagnostic Service Host service terminated with the following error:
    ......................... DC02 failed test SystemLog
    After restarting the secondary DC, the primary DC gives an error on DFSREvent but I think that's OK because it lost the secondary DC for a minute. No further errors there.
    After restarting the primary DC, it gives also a SystemLog error, but different from the other DC with dcdiag:
    Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source
    , but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain
    hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domai
    n, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function a
    s the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this c
    omputer, you may choose to disable the NtpClient.
    A warning event occurred. EventID: 0x00000090
    Time Generated: 04/16/2014 18:31:25
    Event String: The time service has stopped advertising as a good time source.
    ......................... DC01 failed test SystemLog
    Now this is the current status. I am pretty desperate. Maybe you have some suggestions? Otherwise, I will try pbbergs' suggestion.
    Other errors in the event viewer (not sure if they are related but just posting to be sure):
    This domain controller has migrated to using the DFS Replication service to replicate the SYSVOL share. Use of the File Replication Service for replication of non-SYSVOL content sets has been deprecated and therefore, the service has been stopped. The DFS Replication service is recommended for replication of folders, the SYSVOL share on domain controllers and DFS link targets.
    Active Directory Web Services could not find a server certificate with the specified certificate name. A certificate is required to use SSL/TLS connections. To use SSL/TLS connections, verify that a valid server authentication certificate from a trusted Certificate Authority (CA) is installed on the machine.
    Certificate name: dc01.domainname.com
    The DNS server is waiting for Active Directory Domain Services (AD DS) to signal that the initial synchronization of the directory has been completed. The DNS server service cannot start until the initial synchronization is complete because critical DNS data might not yet be replicated onto this domain controller. If events in the AD DS event log indicate that there is a problem with DNS name resolution, consider adding the IP address of another DNS server for this domain to the DNS server list in the Internet Protocol properties of this computer. This event will be logged every two minutes until AD DS has signaled that the initial synchronization has successfully completed.
    Thanks for the help!

  • The Active Directory cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.

    the solution what i got from this from is to Depromote and promote it again to DC, my question when i depromote, will the OU , object will remain as it is or it will be lost. And what precautions do i need to take?
    Adding to the above points, my Domain has only 2 DC, should both the DC be demoted and promoted

     Under NO curcumstances you demote both of your DCs. You must always have one or 2DCs running, otherwise you will loose your entire AD. Only 1 DC should be demoted. you should wait couple of hours prior to promoting it back to DC role again.
    Ideally your primary DC will continue maintaining the OUs, GPOs, and user accounts.
    I would suggest brining in a new, 3rd DC intro play, leave it for a day or 2 to replicate everything properly, confirm that its propagating properly with the primary DC, and only then demote and remove the offending DC.
    There are actually ways for recovering from tombstone lifetime much painlessly than DC demotion/promotion. Depending on what is your AD running on, Windows 2003 or 2012 R2 servers:
    here a few links that might help you understand how it works:
    Primary link :http://blogs.technet.com/b/askpfeplat/archive/2012/11/23/fixing-when-your-domain-traveled-back-in-time-the-great-system-time-rollback-to-the-year-2000.aspx
    http://community.spiceworks.com/topic/343609-ad-replication-can-t-because-exceeded-tombstone-life
    https://support.microsoft.com/en-us/kb/2020053?wa=wsignin1.0
    http://shebangme.blogspot.com/2011/01/active-directory-time-since-last.html

Maybe you are looking for

  • Problem with iTunes loading

    I am having problems with iTunes. I would click on the icon and it does nothing. If anyone could help that would be great. Cassidy www.quitmyscene.com

  • Proxy plugin for load balance

    I set up a cluster with two managed servers , one is ServerA:8001 and another is ServerB :9001 , i have enabled SSL for both servers , the access URL for proxy is https://Server:80/Applicatiion , the purpose of proxy server is to transfer the request

  • Remove Server from /private/Network/Servers?

    I'm integrated with a Windows AD Network. We moved this user's home directory to another server but the old server still shows up in /private/Network/Servers and if the woman tries to save something to the old server instead of going to the server (s

  • Issue with upload of time events through SAPCDT45

    Dear Consultants, I am facing an issue while uploading the clocking data for locked entries. When the entries are uploaded from CC1TEV to TEVEN table using program SAPCDT45, "Changed By" and "Changed On" fields are coming blank in PA30 IT2011 PFA the

  • Download password prompting - want to prompt everytime

    I want to force entry of account password for every download. This is what is in the manual: Downloads for purchase are charged to your iTunes Store account. For additional downloads made within the next fifteen minutes, you don't have to enter your