DFS replication issue
Hello,
We have 1 server at branch office and 1 server at datacenter and have DFS-R enabled for user related data. By default we have enabled branch office server DFS path for end users.
Replication was broken some time back since the branch server OS was crashed. We fixed the issue by reinstalling the OS, but unfortunately a month later we found branch server is not replicating the data with its partner datacenter server
as the GUID of the branch server was changed post rebuild. I have removed the old GUID and re-add the branch server to replication group again.
But, I don't see replication is taking place properly still. If I create a new test folder its getting replicated to datacenter server, but not the old folders which have data modified between these broken replication period.
What is the best way solving this? since the over all data size is in TBs.
Mahi
You can check the backlog on dfs : http://www.planetcobalt.net/sdb/dfscmds.shtml
Command syntax :
dfsrdiag backlog /rgname:KeyMaster /rfname:Gatekeeper /sendingmember:DontCrossTheStreams
/receivingmember:StayPuffed
You may stop sharing and check the results if replication works well.
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.
Similar Messages
-
Active directory SYSVOL replication issues
Hello.
I have 2 domain controllers, both of them on the same site DC1 & DC2. I have added a new site with a DC3. When I have added DC3 to the domain, I have realized, SYSVOL was not initialized correctly. I went back to DC1 and found out, there's following
error in the event viewer:
Error: 4012 on DC1
The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter
(60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.
Error: 2213 on DC2
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication
WMI method to resume replication.
This indicates a DFS replication issue between DC1 & DC2 and probably this would be the reason, why the SYSVOL was not properly initialized on DC3.
How can I restore correct DFS replication between DC1 & DC2? I've read
this article, but it's not clear to me, which of the 2 domain controllers has a good version of SYSVOL + I can not find a decent step-by-step article for reconnecting Windows 2012 domain controller.
Any idea, how I can proceed further here?Here's a complete documentation with resolution of my issue. I have created this documentation for my own purposes in our WIKI, so I will paste it here (I hope, it will help somebody else in the future):
The Problem
We have bought a new server for our domain. This server (NEWDC01) was promoted to be a domain
controller in the DOMAIN. After the promotion, I have added a single computer to the domain. When I have logged on the client to the domain, I realized, this computer is not using the new domain controller (NEWDC01)
for authentication, but DC02 domain controller instead. This is not intended. Local clients should use local domain controllers for authentication (assuming, the Active directory sites & services are configured properly). Further investigation revealed,
there are some replication errors on OLDDC01 & OLDDC02 servers. First I need to solve these replication errors. Then I can
add the NEWDC01 server to domain properly.
Analysis
There are several errors related to DFSR replication on both domain controllers:
Error: 4012 on OLDDC01
The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain.
This server has been disconnected from other partners for 99 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder
until this error is corrected.
Error: 2213 on OLDDC02
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database
is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
In order to have active directory in a healthy condition, one must ensure, there’s a successful
replication between existing domain controllers up and running. If the replication does not work correctly, you can expect bunch of issues.
group policies and logon scripts are not applied correctly, or as intended
when you want to add a new domain controller to the domain, it will not work as expected (although, you will not see any specific errors after the
server is promoted to be a domain controller)
Active directory backup
I have scheduled an AD backup on OLDDC01 server using the ‘Windows Backup’ solution to make sure,
I can restore the AD / SYSVOL, in case something goes wrong. The backup is scheduled to be executed every day.
Active directory restore
In this particular case, I will talk only about SYSVOL restore. As indicated above, we must get
rid of the DFSR event viewer errors which you can find in event viewer. One of them is indicating, that the JET database was not shut down cleanly and autorecovery was disabled. The other error indicates, the SYSVOL volume is no longer replicated. I am not
sure, what is the reason, why the AD’s in the domain stopped to replicate. Probably it was an unclean server shutdown. The DFSR service stopped to replicate the SYSVOL share and I was not aware about that. When the replication did not run for more than ~99
days, the SYSVOL share was excluded from the DFSR replications.
Find out the most accurate SYSVOL share in the domain
I have compared the content of the SYSVOL directories on both OLDDC01 and OLDDC02 servers: C:\Windows\SYSVOL\domain\Policies.
Both directories have 37 subdirectories. Each subdirectory corresponds to one group policy. This means, that the content is approximately the same, thus I can’t tell, which version is most recent. I do most of the GPO changes on OLDDC01, so I made a conclusion,
that this server contains the most recent version of the SYSVOL share.
There are 2 types of SYSVOL restores, you can do:
Authoritative restore
Non-authoritative restore
Non-authoritative restore
This is a more simple kind of a restore. You can perform this kind of restore, when you are sure,
that one of the domain controllers is authoritative (e.g. you presume, the SYSVOL share is intact and working properly). If you can identify such a working server, you can perform non-authoritative restore of the active directory on a broken domain controller.
Authoritative restore
In this case, you can designate a specific domain controller to be authoritative. You set a special
flag on this server, which will prohibit to overwrite it’s state from another domain controllers, when the replication is enabled on the server again. After you designate one server to be authoritative, you need to update all the another domain controllers
using the non-authoritative procedure.
In this article, you can find, how to perform authoritative vs. non authoritative AD resotre:
http://support.microsoft.com/kb/2218556.
In my case, I was not sure, which of the domain controllers had a more recent copy of AD, so I
have decided to make OLDDC01 authoritative (check the link above). Once this has been done, I have made a non-authoritative update on OLDDC02 server.
Everything was almost ready. The last step, I needed to execute was, I needed to fix the ‘JET’
event viewer error on SRVBK1. In the event log entry on the bottom, you can find following:
Recovery Steps
1. Back up the files in all replicated folders on the volume. Failure to do
so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
2. To resume the replication for this volume, use the WMI method ResumeReplication
of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig
where volumeGuid="D37A9FC3-8B1D-11E2-93E8-806E6F6E6963" call ResumeReplication
For more information, see http://support.microsoft.com/kb/2663685.
Final words
After I have executed this command, the replication was again started between OLDDC01 and OLDDC02
servers. After I have started up the NEWDC01 server, I have realized, it has automatically replicated the contents of the SYSVOL share - almost immediately after the server was started up. I have again tried to login with the local client into DOMAIN domain
and now I see, that local client is using local Domain controller for authentication.
Everything seems to be OK now. -
Files Stuck in DFS Replication Backlog
We have two Windows Server 2012 servers with several different replication groups configured to replicate different folder structures between them. One of these replication groups seems to have a permanent backlog of files stuck in the queue. the "dfsrdiag
backlog" command always shows 343 files waiting to replicate in one direction when run at the end of the day. The first 100 files are listed by the command and they are always the same files. When run during the day the dfsrdiag command shows the backlog
going up to several thousand (with the same first 100 files listed), but it always returns to 343. There is no backlog in the other direction. All other replication groups set up show no backlogs in either directions. There are no errors or warning in the
event logs to say DFS replication has stopped for that particular volume or that the files couldn't be replicated due to sharing violations. I have tried forcing replication and rebooting both servers.
Does anyone have any idea how I can get these files to replicate?Hi,
First please check if staging folder is large enough. A recommended size is 1.5x<size of your largest file in replication group>.
Also here is a tuning guide of DFSR. Please see if it could help:
http://blogs.technet.com/b/askds/archive/2010/03/31/tuning-replication-performance-in-dfsr-especially-on-win2008-r2.aspx
Also this article provided many general steps about troubleshooting DFS replication issue. Please see:
Top 10 Common Causes of Slow Replication with DFSR
http://blogs.technet.com/b/askds/archive/2007/10/05/top-10-common-causes-of-slow-replication-with-dfsr.aspx
If you have any feedback on our support, please send to [email protected] -
DFS replication stopped working and cannot be debugged because WMI repository cannot be accessed
Hello,
two days ago our DFS replication suddendly stopped working sometime around midnight local time. At least this is what our second domain controller is reporting. Event log is flooded with event id 5002 from DFSR. It is unclear what caused this sudden problem
and even worse, how to solve it. First thing I tried was to perform propagation tests. According to propagation report none of them was successful. Creating an integrity report brought me to another problem: It fails with two errors. First it is unable to
connect to the other DC. Second it is unable to access local WMI repository. This is true for both machines.
First I tried to find information on possible problems with WMI. WMIdiag provided a lot of information. However, opinions I found on the net largely disagree whether output from WMIdiag is useful or not. Yet I tried to re-compile .mof files and rebuild the
repository. So far, nothing changed. This is my output from WMIdiag:
34309 13:02:46 (0) ** WMIDiag v2.1 started on Donnerstag, 22. Mai 2014 at 12:49.
34310 13:02:46 (0) **
34311 13:02:46 (0) ** Copyright (c) Microsoft Corporation. All rights reserved - July 2007.
34312 13:02:46 (0) **
34313 13:02:46 (0) ** This script is not supported under any Microsoft standard support program or service.
34314 13:02:46 (0) ** The script is provided AS IS without warranty of any kind. Microsoft further disclaims all
34315 13:02:46 (0) ** implied warranties including, without limitation, any implied warranties of merchantability
34316 13:02:46 (0) ** or of fitness for a particular purpose. The entire risk arising out of the use or performance
34317 13:02:46 (0) ** of the scripts and documentation remains with you. In no event shall Microsoft, its authors,
34318 13:02:46 (0) ** or anyone else involved in the creation, production, or delivery of the script be liable for
34319 13:02:46 (0) ** any damages whatsoever (including, without limitation, damages for loss of business profits,
34320 13:02:46 (0) ** business interruption, loss of business information, or other pecuniary loss) arising out of
34321 13:02:46 (0) ** the use of or inability to use the script or documentation, even if Microsoft has been advised
34322 13:02:46 (0) ** of the possibility of such damages.
34323 13:02:46 (0) **
34324 13:02:46 (0) **
34325 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34326 13:02:46 (0) ** ----------------------------------------------------- WMI REPORT: BEGIN ----------------------------------------------------------
34327 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34328 13:02:46 (0) **
34329 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34330 13:02:46 (0) ** Windows Server 2008 R2 - Service pack 1 - 64-bit (7601) - User 'COM\ABCDEF' on computer 'DC2'.
34331 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34332 13:02:46 (0) ** INFO: Environment: .................................................................................................. 1 ITEM(S)!
34333 13:02:46 (0) ** INFO: => 1 possible incorrect shutdown(s) detected on:
34334 13:02:46 (0) ** - Shutdown on 01 April 2014 10:20:54 (GMT-0).
34335 13:02:46 (0) **
34336 13:02:46 (0) ** System drive: ....................................................................................................... C: (Datenträgernr. 0 Partitionsnr. 1).
34337 13:02:46 (0) ** Drive type: ......................................................................................................... SCSI (Adaptec Array SCSI Disk Device).
34338 13:02:46 (0) ** There are no missing WMI system files: .............................................................................. OK.
34339 13:02:46 (0) ** There are no missing WMI repository files: .......................................................................... OK.
34340 13:02:46 (0) ** WMI repository state: ............................................................................................... CONSISTENT.
34341 13:02:46 (0) ** AFTER running WMIDiag:
34342 13:02:46 (0) ** The WMI repository has a size of: ................................................................................... 26 MB.
34343 13:02:46 (0) ** - Disk free space on 'C:': .......................................................................................... 10665 MB.
34344 13:02:46 (0) ** - INDEX.BTR, 4276224 bytes, 22.05.2014 12:52:30
34345 13:02:46 (0) ** - MAPPING1.MAP, 67248 bytes, 22.05.2014 12:52:30
34346 13:02:46 (0) ** - MAPPING2.MAP, 67168 bytes, 22.05.2014 12:48:33
34347 13:02:46 (0) ** - OBJECTS.DATA, 23126016 bytes, 22.05.2014 12:52:30
34348 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34349 13:02:46 (0) ** INFO: Windows Firewall status: ...................................................................................... ENABLED.
34350 13:02:46 (0) ** Windows Firewall Profile: ........................................................................................... DOMAIN.
34351 13:02:46 (0) ** Inbound connections that do not match a rule BLOCKED: ............................................................... ENABLED.
34352 13:02:46 (0) ** => This will prevent any WMI remote connectivity to this computer except
34353 13:02:46 (0) ** if the following three inbound rules are ENABLED and non-BLOCKING:
34354 13:02:46 (0) ** - 'Windows Management Instrumentation (DCOM-In)'
34355 13:02:46 (0) ** - 'Windows Management Instrumentation (WMI-In)'
34356 13:02:46 (0) ** - 'Windows Management Instrumentation (ASync-In)'
34357 13:02:46 (0) ** Verify the reported status for each of these three inbound rules below.
34358 13:02:46 (0) **
34359 13:02:46 (0) ** Windows Firewall 'Windows Management Instrumentation (WMI)' group rule: ............................................. DISABLED.
34360 13:02:46 (0) ** => This will prevent any WMI remote connectivity to/from this machine.
34361 13:02:46 (0) ** - You can adjust the configuration by executing the following command:
34362 13:02:46 (0) ** i.e. 'NETSH.EXE ADVFIREWALL FIREWALL SET RULE GROUP="Windows Management Instrumentation (WMI)" NEW ENABLE=YES'
34363 13:02:46 (0) ** Note: With this command all inbound and outbound WMI rules are activated at once!
34364 13:02:46 (0) ** You can also enable each individual rule instead of activating the group rule.
34365 13:02:46 (0) **
34366 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34367 13:02:46 (0) ** DCOM Status: ........................................................................................................ OK.
34368 13:02:46 (0) ** WMI registry setup: ................................................................................................. OK.
34369 13:02:46 (0) ** INFO: WMI service has dependents: ................................................................................... 1 SERVICE(S)!
34370 13:02:46 (0) ** - Internet Connection Sharing (ICS) (SHAREDACCESS, StartMode='Disabled')
34371 13:02:46 (0) ** => If the WMI service is stopped, the listed service(s) will have to be stopped as well.
34372 13:02:46 (0) ** Note: If the service is marked with (*), it means that the service/application uses WMI but
34373 13:02:46 (0) ** there is no hard dependency on WMI. However, if the WMI service is stopped,
34374 13:02:46 (0) ** this can prevent the service/application to work as expected.
34375 13:02:46 (0) **
34376 13:02:46 (0) ** RPCSS service: ...................................................................................................... OK (Already started).
34377 13:02:46 (0) ** WINMGMT service: .................................................................................................... OK (Already started).
34378 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34379 13:02:46 (0) ** WMI service DCOM setup: ............................................................................................. OK.
34380 13:02:46 (0) ** WMI components DCOM registrations: .................................................................................. OK.
34381 13:02:46 (0) ** WMI ProgID registrations: ........................................................................................... OK.
34382 13:02:46 (0) ** WMI provider DCOM registrations: .................................................................................... OK.
34383 13:02:46 (0) ** WMI provider CIM registrations: ..................................................................................... OK.
34384 13:02:46 (0) ** WMI provider CLSIDs: ................................................................................................ OK.
34385 13:02:46 (2) !! WARNING: Some WMI providers EXE/DLL file(s) are missing: ............................................................ 1 WARNING(S)!
34386 13:02:46 (0) ** - ROOT/MICROSOFTACTIVEDIRECTORY, ReplProv1, replprov.dll
34387 13:02:46 (0) ** => This will make any operations related to the WMI class supported by the provider(s) to fail.
34388 13:02:46 (0) ** This can be due to:
34389 13:02:46 (0) ** - the de-installation of the software.
34390 13:02:46 (0) ** - the deletion of some files.
34391 13:02:46 (0) ** => If the software has been de-installed intentionally, then this information must be
34392 13:02:46 (0) ** removed from the WMI repository. You can use the 'WMIC.EXE' command to remove
34393 13:02:46 (0) ** the provider registration data.
34394 13:02:46 (0) ** i.e. 'WMIC.EXE /NAMESPACE:\\ROOT\MICROSOFTACTIVEDIRECTORY path __Win32Provider Where Name='ReplProv1' DELETE'
34395 13:02:46 (0) ** => If not, you must restore a copy of the missing provider EXE/DLL file(s) as indicated by the path.
34396 13:02:46 (0) ** You can retrieve the missing file from:
34397 13:02:46 (0) ** - A backup.
34398 13:02:46 (0) ** - The Windows CD.
34399 13:02:46 (0) ** - Another Windows installation using the same version and service pack level of the examined system.
34400 13:02:46 (0) ** - The original CD or software package installing this WMI provider.
34401 13:02:46 (0) **
34402 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34403 13:02:46 (0) ** INFO: User Account Control (UAC): ................................................................................... DISABLED.
34404 13:02:46 (0) ** INFO: Local Account Filtering: ...................................................................................... ENABLED.
34405 13:02:46 (0) ** => WMI tasks remotely accessing WMI information on this computer and requiring Administrative
34406 13:02:46 (0) ** privileges MUST use a DOMAIN account part of the Local Administrators group of this computer
34407 13:02:46 (0) ** to ensure that administrative privileges are granted. If a Local User account is used for remote
34408 13:02:46 (0) ** accesses, it will be reduced to a plain user (filtered token), even if it is part of the Local Administrators group.
34409 13:02:46 (0) **
34410 13:02:46 (0) ** DCOM security for 'My Computer' (Access Permissions/Edit Limits): ................................................... MODIFIED.
34411 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\ANONYMOUS LOGON' has been REMOVED!
34412 13:02:46 (0) ** - REMOVED ACE:
34413 13:02:46 (0) ** ACEType: &h0
34414 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34415 13:02:46 (0) ** ACEFlags: &h0
34416 13:02:46 (0) ** ACEMask: &h7
34417 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34418 13:02:46 (0) ** DCOM_RIGHT_ACCESS_LOCAL
34419 13:02:46 (0) ** DCOM_RIGHT_ACCESS_REMOTE
34420 13:02:46 (0) **
34421 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34422 13:02:46 (0) ** Removing default security will cause some operations to fail!
34423 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34424 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34425 13:02:46 (0) **
34426 13:02:46 (0) ** DCOM security for 'My Computer' (Access Permissions/Edit Limits): ................................................... MODIFIED.
34427 13:02:46 (1) !! ERROR: Default trustee 'BUILTIN\PERFORMANCE LOG USERS' has been REMOVED!
34428 13:02:46 (0) ** - REMOVED ACE:
34429 13:02:46 (0) ** ACEType: &h0
34430 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34431 13:02:46 (0) ** ACEFlags: &h0
34432 13:02:46 (0) ** ACEMask: &h7
34433 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34434 13:02:46 (0) ** DCOM_RIGHT_ACCESS_LOCAL
34435 13:02:46 (0) ** DCOM_RIGHT_ACCESS_REMOTE
34436 13:02:46 (0) **
34437 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34438 13:02:46 (0) ** Removing default security will cause some operations to fail!
34439 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34440 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34441 13:02:46 (0) **
34442 13:02:46 (0) ** DCOM security for 'My Computer' (Access Permissions/Edit Limits): ................................................... MODIFIED.
34443 13:02:46 (1) !! ERROR: Default trustee 'EVERYONE' has been REMOVED!
34444 13:02:46 (0) ** - REMOVED ACE:
34445 13:02:46 (0) ** ACEType: &h0
34446 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34447 13:02:46 (0) ** ACEFlags: &h0
34448 13:02:46 (0) ** ACEMask: &h7
34449 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34450 13:02:46 (0) ** DCOM_RIGHT_ACCESS_LOCAL
34451 13:02:46 (0) ** DCOM_RIGHT_ACCESS_REMOTE
34452 13:02:46 (0) **
34453 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34454 13:02:46 (0) ** Removing default security will cause some operations to fail!
34455 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34456 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34457 13:02:46 (0) **
34458 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Default): ..................................... MODIFIED.
34459 13:02:46 (1) !! ERROR: Default trustee 'BUILTIN\ADMINISTRATORS' has been REMOVED!
34460 13:02:46 (0) ** - REMOVED ACE:
34461 13:02:46 (0) ** ACEType: &h0
34462 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34463 13:02:46 (0) ** ACEFlags: &h0
34464 13:02:46 (0) ** ACEMask: &h1F
34465 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34466 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34467 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34468 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34469 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34470 13:02:46 (0) **
34471 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34472 13:02:46 (0) ** Removing default security will cause some operations to fail!
34473 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34474 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34475 13:02:46 (0) **
34476 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Default): ..................................... MODIFIED.
34477 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\INTERACTIVE' has been REMOVED!
34478 13:02:46 (0) ** - REMOVED ACE:
34479 13:02:46 (0) ** ACEType: &h0
34480 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34481 13:02:46 (0) ** ACEFlags: &h0
34482 13:02:46 (0) ** ACEMask: &h1F
34483 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34484 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34485 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34486 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34487 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34488 13:02:46 (0) **
34489 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34490 13:02:46 (0) ** Removing default security will cause some operations to fail!
34491 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34492 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34493 13:02:46 (0) **
34494 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Default): ..................................... MODIFIED.
34495 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
34496 13:02:46 (0) ** - REMOVED ACE:
34497 13:02:46 (0) ** ACEType: &h0
34498 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34499 13:02:46 (0) ** ACEFlags: &h0
34500 13:02:46 (0) ** ACEMask: &h1F
34501 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34502 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34503 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34504 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34505 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34506 13:02:46 (0) **
34507 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34508 13:02:46 (0) ** Removing default security will cause some operations to fail!
34509 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34510 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34511 13:02:46 (0) **
34512 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Limits): ...................................... MODIFIED.
34513 13:02:46 (1) !! ERROR: Default trustee 'BUILTIN\ADMINISTRATORS' has been REMOVED!
34514 13:02:46 (0) ** - REMOVED ACE:
34515 13:02:46 (0) ** ACEType: &h0
34516 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34517 13:02:46 (0) ** ACEFlags: &h0
34518 13:02:46 (0) ** ACEMask: &h1F
34519 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34520 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34521 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34522 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34523 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34524 13:02:46 (0) **
34525 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34526 13:02:46 (0) ** Removing default security will cause some operations to fail!
34527 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34528 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34529 13:02:46 (0) **
34530 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Limits): ...................................... MODIFIED.
34531 13:02:46 (1) !! ERROR: Default trustee 'BUILTIN\PERFORMANCE LOG USERS' has been REMOVED!
34532 13:02:46 (0) ** - REMOVED ACE:
34533 13:02:46 (0) ** ACEType: &h0
34534 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34535 13:02:46 (0) ** ACEFlags: &h0
34536 13:02:46 (0) ** ACEMask: &h1F
34537 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34538 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34539 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34540 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34541 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34542 13:02:46 (0) **
34543 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34544 13:02:46 (0) ** Removing default security will cause some operations to fail!
34545 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34546 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34547 13:02:46 (0) **
34548 13:02:46 (0) ** DCOM security for 'My Computer' (Launch & Activation Permissions/Edit Limits): ...................................... MODIFIED.
34549 13:02:46 (1) !! ERROR: Default trustee 'EVERYONE' has been REMOVED!
34550 13:02:46 (0) ** - REMOVED ACE:
34551 13:02:46 (0) ** ACEType: &h0
34552 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34553 13:02:46 (0) ** ACEFlags: &h0
34554 13:02:46 (0) ** ACEMask: &hB
34555 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34556 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34557 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34558 13:02:46 (0) **
34559 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34560 13:02:46 (0) ** Removing default security will cause some operations to fail!
34561 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34562 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34563 13:02:46 (0) **
34564 13:02:46 (0) ** DCOM security for 'Microsoft WMI Provider Subsystem Host' (Launch & Activation Permissions): ........................ MODIFIED.
34565 13:02:46 (1) !! ERROR: Default trustee 'BUILTIN\ADMINISTRATORS' has been REMOVED!
34566 13:02:46 (0) ** - REMOVED ACE:
34567 13:02:46 (0) ** ACEType: &h0
34568 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34569 13:02:46 (0) ** ACEFlags: &h0
34570 13:02:46 (0) ** ACEMask: &h1F
34571 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34572 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34573 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34574 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34575 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34576 13:02:46 (0) **
34577 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34578 13:02:46 (0) ** Removing default security will cause some operations to fail!
34579 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34580 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34581 13:02:46 (0) **
34582 13:02:46 (0) ** DCOM security for 'Microsoft WMI Provider Subsystem Host' (Launch & Activation Permissions): ........................ MODIFIED.
34583 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\INTERACTIVE' has been REMOVED!
34584 13:02:46 (0) ** - REMOVED ACE:
34585 13:02:46 (0) ** ACEType: &h0
34586 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34587 13:02:46 (0) ** ACEFlags: &h0
34588 13:02:46 (0) ** ACEMask: &h1F
34589 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34590 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34591 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34592 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34593 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34594 13:02:46 (0) **
34595 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34596 13:02:46 (0) ** Removing default security will cause some operations to fail!
34597 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34598 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34599 13:02:46 (0) **
34600 13:02:46 (0) ** DCOM security for 'Microsoft WMI Provider Subsystem Host' (Launch & Activation Permissions): ........................ MODIFIED.
34601 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\SYSTEM' has been REMOVED!
34602 13:02:46 (0) ** - REMOVED ACE:
34603 13:02:46 (0) ** ACEType: &h0
34604 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34605 13:02:46 (0) ** ACEFlags: &h0
34606 13:02:46 (0) ** ACEMask: &h1F
34607 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34608 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34609 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34610 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34611 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34612 13:02:46 (0) **
34613 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34614 13:02:46 (0) ** Removing default security will cause some operations to fail!
34615 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34616 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34617 13:02:46 (0) **
34618 13:02:46 (0) ** DCOM security for 'Microsoft WMI Provider Subsystem Host' (Launch & Activation Permissions): ........................ MODIFIED.
34619 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\NETWORK SERVICE' has been REMOVED!
34620 13:02:46 (0) ** - REMOVED ACE:
34621 13:02:46 (0) ** ACEType: &h0
34622 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34623 13:02:46 (0) ** ACEFlags: &h0
34624 13:02:46 (0) ** ACEMask: &h1F
34625 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34626 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34627 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34628 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34629 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34630 13:02:46 (0) **
34631 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34632 13:02:46 (0) ** Removing default security will cause some operations to fail!
34633 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34634 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34635 13:02:46 (0) **
34636 13:02:46 (0) ** DCOM security for 'Microsoft WMI Provider Subsystem Host' (Launch & Activation Permissions): ........................ MODIFIED.
34637 13:02:46 (1) !! ERROR: Default trustee 'NT AUTHORITY\LOCAL SERVICE' has been REMOVED!
34638 13:02:46 (0) ** - REMOVED ACE:
34639 13:02:46 (0) ** ACEType: &h0
34640 13:02:46 (0) ** ACCESS_ALLOWED_ACE_TYPE
34641 13:02:46 (0) ** ACEFlags: &h0
34642 13:02:46 (0) ** ACEMask: &h1F
34643 13:02:46 (0) ** DCOM_RIGHT_EXECUTE
34644 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_LOCAL
34645 13:02:46 (0) ** DCOM_RIGHT_LAUNCH_REMOTE
34646 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_LOCAL
34647 13:02:46 (0) ** DCOM_RIGHT_ACTIVATE_REMOTE
34648 13:02:46 (0) **
34649 13:02:46 (0) ** => The REMOVED ACE was part of the DEFAULT setup for the trustee.
34650 13:02:46 (0) ** Removing default security will cause some operations to fail!
34651 13:02:46 (0) ** It is possible to fix this issue by editing the security descriptor and adding the ACE.
34652 13:02:46 (0) ** For DCOM objects, this can be done with 'DCOMCNFG.EXE'.
34653 13:02:46 (0) **
34654 13:02:46 (0) **
34655 13:02:46 (0) ** DCOM security warning(s) detected: .................................................................................. 0.
34656 13:02:46 (0) ** DCOM security error(s) detected: .................................................................................... 14.
34657 13:02:46 (0) ** WMI security warning(s) detected: ................................................................................... 0.
34658 13:02:46 (0) ** WMI security error(s) detected: ..................................................................................... 0.
34659 13:02:46 (0) **
34660 13:02:46 (1) !! ERROR: Overall DCOM security status: ................................................................................ ERROR!
34661 13:02:46 (0) ** Overall WMI security status: ........................................................................................ OK.
34662 13:02:46 (0) ** - Started at 'Root' --------------------------------------------------------------------------------------------------------------
34663 13:02:46 (0) ** INFO: WMI permanent SUBSCRIPTION(S): ................................................................................ 1.
34664 13:02:46 (0) ** - ROOT/SUBSCRIPTION, NTEventLogEventConsumer.Name="SCM Event Log Consumer".
34665 13:02:46 (0) ** 'select * from MSFT_SCMEventLogEvent'
34666 13:02:46 (0) **
34667 13:02:46 (0) ** WMI TIMER instruction(s): ........................................................................................... NONE.
34668 13:02:46 (0) ** INFO: WMI namespace(s) requiring PACKET PRIVACY: .................................................................... 3 NAMESPACE(S)!
34669 13:02:46 (0) ** - ROOT/CIMV2/SECURITY/MICROSOFTTPM.
34670 13:02:46 (0) ** - ROOT/CIMV2/TERMINALSERVICES.
34671 13:02:46 (0) ** - ROOT/SERVICEMODEL.
34672 13:02:46 (0) ** => When remotely connecting, the namespace(s) listed require(s) the WMI client to
34673 13:02:46 (0) ** use an encrypted connection by specifying the PACKET PRIVACY authentication level.
34674 13:02:46 (0) ** (RPC_C_AUTHN_LEVEL_PKT_PRIVACY or PktPrivacy flags)
34675 13:02:46 (0) ** i.e. 'WMIC.EXE /NODE:"ISWDC2" /AUTHLEVEL:Pktprivacy /NAMESPACE:\\ROOT\SERVICEMODEL Class __SystemSecurity'
34676 13:02:46 (0) **
34677 13:02:46 (0) ** WMI MONIKER CONNECTIONS: ............................................................................................ OK.
34678 13:02:46 (0) ** WMI CONNECTIONS: .................................................................................................... OK.
34679 13:02:46 (1) !! ERROR: WMI GET operation errors reported: ........................................................................... 32 ERROR(S)!
34680 13:02:46 (0) ** - Root/CIMV2, MSFT_NetInvalidDriverDependency, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34681 13:02:46 (0) ** MOF Registration: ''
34682 13:02:46 (0) ** - Root/CIMV2, Win32_OsBaselineProvider, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34683 13:02:46 (0) ** MOF Registration: ''
34684 13:02:46 (0) ** - Root/CIMV2, Win32_OsBaseline, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34685 13:02:46 (0) ** MOF Registration: ''
34686 13:02:46 (0) ** - Root/CIMV2, Win32_DriverVXD, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34687 13:02:46 (0) ** MOF Registration: ''
34688 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_BITS_BITSNetUtilization, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34689 13:02:46 (0) ** MOF Registration: ''
34690 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_BITS_BITSNetUtilization, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34691 13:02:46 (0) ** MOF Registration: ''
34692 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34693 13:02:46 (0) ** MOF Registration: ''
34694 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_GenericIKEandAuthIP, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34695 13:02:46 (0) ** MOF Registration: ''
34696 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34697 13:02:46 (0) ** MOF Registration: ''
34698 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34699 13:02:46 (0) ** MOF Registration: ''
34700 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34701 13:02:46 (0) ** MOF Registration: ''
34702 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecAuthIPv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34703 13:02:46 (0) ** MOF Registration: ''
34704 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34705 13:02:46 (0) ** MOF Registration: ''
34706 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv4, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34707 13:02:46 (0) ** MOF Registration: ''
34708 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34709 13:02:46 (0) ** MOF Registration: ''
34710 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_Counters_IPsecIKEv6, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34711 13:02:46 (0) ** MOF Registration: ''
34712 13:02:46 (0) ** - Root/CIMV2, Win32_PerfFormattedData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34713 13:02:46 (0) ** MOF Registration: ''
34714 13:02:46 (0) ** - Root/CIMV2, Win32_PerfRawData_TermService_TerminalServices, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34715 13:02:46 (0) ** MOF Registration: ''
34716 13:02:46 (0) ** - Root/WMI, ReserveDisjoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34717 13:02:46 (0) ** MOF Registration: ''
34718 13:02:46 (0) ** - Root/WMI, ReserveLateCount, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34719 13:02:46 (0) ** MOF Registration: ''
34720 13:02:46 (0) ** - Root/WMI, ReserveJoinThread, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34721 13:02:46 (0) ** MOF Registration: ''
34722 13:02:46 (0) ** - Root/WMI, ReserveDelete, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34723 13:02:46 (0) ** MOF Registration: ''
34724 13:02:46 (0) ** - Root/WMI, ReserveBandwidth, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34725 13:02:46 (0) ** MOF Registration: ''
34726 13:02:46 (0) ** - Root/WMI, ReserveCreate, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34727 13:02:46 (0) ** MOF Registration: ''
34728 13:02:46 (0) ** - Root/WMI, SystemConfig_PhyDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34729 13:02:46 (0) ** MOF Registration: ''
34730 13:02:46 (0) ** - Root/WMI, SystemConfig_Video, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34731 13:02:46 (0) ** MOF Registration: ''
34732 13:02:46 (0) ** - Root/WMI, SystemConfig_IDEChannel, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34733 13:02:46 (0) ** MOF Registration: ''
34734 13:02:46 (0) ** - Root/WMI, SystemConfig_NIC, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34735 13:02:46 (0) ** MOF Registration: ''
34736 13:02:46 (0) ** - Root/WMI, SystemConfig_Network, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34737 13:02:46 (0) ** MOF Registration: ''
34738 13:02:46 (0) ** - Root/WMI, SystemConfig_CPU, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34739 13:02:46 (0) ** MOF Registration: ''
34740 13:02:46 (0) ** - Root/WMI, SystemConfig_LogDisk, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34741 13:02:46 (0) ** MOF Registration: ''
34742 13:02:46 (0) ** - Root/WMI, SystemConfig_Power, 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found.
34743 13:02:46 (0) ** MOF Registration: ''
34744 13:02:46 (0) ** => When a WMI performance class is missing (i.e. 'Win32_PerfRawData_TermService_TerminalServices'), it is generally due to
34745 13:02:46 (0) ** a lack of buffer refresh of the WMI class provider exposing the WMI performance counters.
34746 13:02:46 (0) ** You can refresh the WMI class provider buffer with the following command:
34747 13:02:46 (0) **
34748 13:02:46 (0) ** i.e. 'WINMGMT.EXE /SYNCPERF'
34749 13:02:46 (0) **
34750 13:02:46 (0) ** WMI MOF representations: ............................................................................................ OK.
34751 13:02:46 (0) ** WMI QUALIFIER access operations: .................................................................................... OK.
34752 13:02:46 (0) ** WMI ENUMERATION operations: ......................................................................................... OK.
34753 13:02:46 (0) ** WMI EXECQUERY operations: ........................................................................................... OK.
34754 13:02:46 (2) !! WARNING: WMI GET VALUE operation errors reported: ................................................................... 5 WARNING(S)!
34755 13:02:46 (0) ** - Root, Instance: __EventConsumerProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
34756 13:02:46 (0) ** - Root, Instance: __EventProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
34757 13:02:46 (0) ** - Root, Instance: __EventSinkCacheControl=@, Property: ClearAfter='00000000000015.000000:000' (Expected default='00000000000230.000000:000').
34758 13:02:46 (0) ** - Root, Instance: __ObjectProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
34759 13:02:46 (0) ** - Root, Instance: __PropertyProviderCacheControl=@, Property: ClearAfter='00000000000030.000000:000' (Expected default='00000000000500.000000:000').
34760 13:02:46 (0) **
34761 13:02:46 (0) ** WMI WRITE operations: ............................................................................................... NOT TESTED.
34762 13:02:46 (0) ** WMI PUT operations: ................................................................................................. NOT TESTED.
34763 13:02:46 (0) ** WMI DELETE operations: .............................................................................................. NOT TESTED.
34764 13:02:46 (0) ** WMI static instances retrieved: ..................................................................................... 1822.
34765 13:02:46 (0) ** WMI dynamic instances retrieved: .................................................................................... 0.
34766 13:02:46 (0) ** WMI instance request cancellations (to limit performance impact): ................................................... 1.
34767 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34768 13:02:46 (0) ** # of Event Log events BEFORE WMIDiag execution since the last 20 day(s):
34769 13:02:46 (0) ** DCOM: ............................................................................................................. 0.
34770 13:02:46 (0) ** WINMGMT: .......................................................................................................... 0.
34771 13:02:46 (0) ** WMIADAPTER: ....................................................................................................... 0.
34772 13:02:46 (0) **
34773 13:02:46 (0) ** # of additional Event Log events AFTER WMIDiag execution:
34774 13:02:46 (0) ** DCOM: ............................................................................................................. 0.
34775 13:02:46 (0) ** WINMGMT: .......................................................................................................... 0.
34776 13:02:46 (0) ** WMIADAPTER: ....................................................................................................... 0.
34777 13:02:46 (0) **
34778 13:02:46 (0) ** 32 error(s) 0x80041002 - (WBEM_E_NOT_FOUND) Object cannot be found
34779 13:02:46 (0) ** => This error is typically a WMI error. This WMI error is due to:
34780 13:02:46 (0) ** - a missing WMI class definition or object.
34781 13:02:46 (0) ** (See any GET, ENUMERATION, EXECQUERY and GET VALUE operation failures).
34782 13:02:46 (0) ** You can correct the missing class definitions by:
34783 13:02:46 (0) ** - Manually recompiling the MOF file(s) with the 'MOFCOMP <FileName.MOF>' command.
34784 13:02:46 (0) ** Note: You can build a list of classes in relation with their WMI provider and MOF file with WMIDiag.
34785 13:02:46 (0) ** (This list can be built on a similar and working WMI Windows installation)
34786 13:02:46 (0) ** The following command line must be used:
34787 13:02:46 (0) ** i.e. 'WMIDiag CorrelateClassAndProvider'
34788 13:02:46 (0) ** Note: When a WMI performance class is missing, you can manually resynchronize performance counters
34789 13:02:46 (0) ** with WMI by starting the ADAP process.
34790 13:02:46 (0) ** - a WMI repository corruption.
34791 13:02:46 (0) ** In such a case, you must rerun WMIDiag with 'WriteInRepository' parameter
34792 13:02:46 (0) ** to validate the WMI repository operations.
34793 13:02:46 (0) ** Note: ENSURE you are an administrator with FULL access to WMI EVERY namespaces of the computer before
34794 13:02:46 (0) ** executing the WriteInRepository command. To write temporary data from the Root namespace, use:
34795 13:02:46 (0) ** i.e. 'WMIDiag WriteInRepository=Root'
34796 13:02:46 (0) ** - If the WriteInRepository command fails, while being an Administrator with ALL accesses to ALL namespaces
34797 13:02:46 (0) ** the WMI repository must be reconstructed.
34798 13:02:46 (0) ** Note: The WMI repository reconstruction requires to locate all MOF files needed to rebuild the repository,
34799 13:02:46 (0) ** otherwise some applications may fail after the reconstruction.
34800 13:02:46 (0) ** This can be achieved with the following command:
34801 13:02:46 (0) ** i.e. 'WMIDiag ShowMOFErrors'
34802 13:02:46 (0) ** Note: The repository reconstruction must be a LAST RESORT solution and ONLY after executing
34803 13:02:46 (0) ** ALL fixes previously mentioned.
34804 13:02:46 (2) !! WARNING: Static information stored by external applications in the repository will be LOST! (i.e. SMS Inventory)
34805 13:02:46 (0) **
34806 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34807 13:02:46 (0) ** WMI Registry key setup: ............................................................................................. OK.
34808 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34809 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34810 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34811 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34812 13:02:46 (0) **
34813 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34814 13:02:46 (0) ** ------------------------------------------------------ WMI REPORT: END -----------------------------------------------------------
34815 13:02:46 (0) ** ----------------------------------------------------------------------------------------------------------------------------------
34816 13:02:46 (0) **
34817 13:02:46 (0) ** ERROR: WMIDiag detected issues that could prevent WMI to work properly!. Check 'C:\USERS\ABCDEF\APPDATA\LOCAL\TEMP\WMIDIAG-V2.1_2K8R2.SRV.SP1.64_ISWDC2_2014.05.22_12.49.13.LOG' for details.
34818 13:02:46 (0) **
34819 13:02:46 (0) ** WMIDiag v2.1 ended on Donnerstag, 22. Mai 2014 at 13:02 (W:89 E:52 S:1).
There are a lot of error in the report and I don't know, whether they are relevant or how to solve them. To my current knowledge, I need to solve at least some of them so that I can access the local WMI repository again and get replication back working.
But after hours of research I am stuck. Any hints are greatly appreciated.
Regards,
OliverI don't know why, but soon after posting this, I found a solution to the problem. The WMI part was solved in this thread:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/953be9ef-e9e3-4885-a5c4-47fc475ba562/dfs-is-not-working-anymore?forum=winserverfiles
The relevant portion is this:
Open a CMD prompt in %windir%\system32\wbem
mofcomp dfsrprovs.mof
net stop winmgmt
net start winmgmt
net start iphlpsvc
net stop dfsr
net start dfsr
I don't know why recompiling of all mof did not solve the problem, but the solution above did. Restarting the DCs solved the communication issue. I don't know why the primary DC forgot about the WMI DFS provider or why communication failed. However, it is
working again, it seems. -
I apologize in advance for the rambling novella, but I tried to include as many details ahead of time as I could.
I guess like most issues, this one's been evolving for a while, it started out with us trying to add a new member
to a replication group that's on a subnet without connectivity to the FSMO roles holder. I'll try to describe the
layout as best as I can up front.
The AD only has one domain & both the forest & domain are at 2008R2 function level. We've got two sites defined in
Sites & Services, Site A is an off-site datacenter with one associated subnet & Site B with 6 associated subnets, A-F.
The two sites are connected by a WAN link from a cable provider. Subnets E & F at Site B have no connectivity to Site A
across that WAN, only what's available through the front side of the datacenter through the public Internet. The network
engineering group involved refuses to route that WAN traffic to those two subnets & we've got no recourse against that
decision; so I'm trying to find a way to accomplish this without that if possible.
The FSMO roles holder is located at Site A. I know that I can define a Site C, add Subnets E & F to that site, & then
configure an SMTP site link between Sites A & C, but that only handles AD replication, correct? That still wouldn't allow me, for example,
to enumerate DFS namespaces from subnets E & F, or to add a fileserver on either of those subnets as a member to an existing
DFS replication group, right? Also, root scalability is enabled on all the namespace shares.
Is there a way to accomplish both of these things without transferring the FSMO roles from the original DC at Site A to, say,
the bridgehead DC at Site B?
When the infrastructure was originally setup by a former analyst, the topology was much more simple & everything was left
under the Default First Site & no sites/subnets were setup until fairly recently to resolve authentication issues on
Subnets E & F... I bring this up just to say, the FSMO roles holder has held them throughout the build out & addition of
all sorts of systems & I'm honestly not sure what, if anything, the transfer of those roles will break.
I definitely don't claim to be an expert in any of this, I'll be the first to say that I'm a work-in-progress on this AD design stuff,
I'm all for R'ing the FM, but frankly I'm dragging bottom at this point in finding the right FM. I've been digging around
on Google, forums, & TechNet for the past week or so as this has evolved, but no resolution yet.
On VMs & machines on subnets E & F when I go to DFS Management -> Namespace -> Add Namespaces to Display..., none show up
automatically & when I click Show Namespaces, after a few seconds I get "The namespaces on DOMAIN cannot be enumerated. The
specified domain either does not exist or could not be contacted". If I run a dfsutil /pktinfo, nothing shows except \sysvol
but I can access the domain-based DFS shares through Windows Explorer with the UNC path \\DOMAIN-FQDN\Share-Name then when
I run a dfsutil /pktinfo it shows all the shares that I've accessed so far.
So either I'm doing something wrong, or, for some random large, multinational company, every sunbet & fileserver one wants
to add to a DFS Namespace has to be able to contact the FSMO roles holder? Or, are those ADs broken down with a child domain
for each Site & a FSMO roles holder for that child domain is located in each site?Hi,
A DC in siteB should helpful. I still not see any article mentioned that a DFS client have to connect to PDC every time trying to access a DFS domain based namespace.
Please see following article. I pasted a part of it below:
http://technet.microsoft.com/en-us/library/cc782417(v=ws.10).aspx
Domain controllers play numerous roles in DFS:
Domain controllers store DFS metadata in Active Directory about domain-based namespaces. DFS metadata consists of information about entire namespace, including the root, root targets, links, link targets, and settings. By default,root servers
that host domain-based namespaces periodically poll the domain controller acting as the primary domain controller (PDC) emulator master to obtain an updated version of the DFS metadata and store this metadata in memory.
So Other DC needs to connect PDC for an updated metadata.
Whenever an administrator makes a change to a domain-based namespace, the
change is made on the domain controller acting as the PDC emulator master and is then replicated (via Active Directory replication) to other domain controllers in the domain.
Domain Name Referral Cache
A domain name referral contains the NetBIOS and DNS names of the local domain, all trusted domains in the forest, and domains in trusted forests. A
DFS client requests a domain name referral from a domain controller to determine the domains in which the clients can access domain-based namespaces.
Domain Controller Referral Cache
A domain controller referral contains the NetBIOS and DNS names of the domain controllers for the list of domains it has cached. A DFS client requests a domain controller referral from a domain controller (in the client’s domain)
to determine which domain controllers can provide a referral for a domain-based namespace.
Domain-based Root Referral Cache
The domain-based root referrals in this memory cache do not store targets in any particular order. The targets are sorted according to the target selection method only when requested from the client. Also, these referrals are based on DFS metadata stored
on the local domain controller, not the PDC emulator master.
Thus it seems to be acceptable to have a disconnect between sites shortly when cache is still working on siteB.
If you have any feedback on our support, please send to [email protected]. -
BSOD on Server 2012 running dfs namespace and dfs replication roles with deduplication
Hello,
I have recently setup 2 dfsn & dfsr servers, both 2012 one physical the other virtual.
The idea is to have one server as primary and the other as a failover \ DR.
The primary server is virtual and connects via mpio \ iscsi to a dell san, using the provided dell DSM Drivers.
The secondary server is physical with local disk for storage.
I copy files to a namespace setup to always prefer the primary server, these files are then replicated across to the secondary.
I have also turned on deduplication on both servers to get the most out of the available storage.
This has been working well for 6 months or so, there have however been 2-3 occasions where the primary virtual server has crashed and blue screened causing the DFSR database to undergo a full consistency check.
The bug check errors i have managed to extract from the Memory.dmp and mini dump are as follows:
* Bugcheck Analysis
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: fffffa80379a3070, Object whose reference count is being lowered
Arg3: 0000000000000002, Reserved
Arg4: ffffffffffffffff, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object?s reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: dfsrs.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) amd64fre
LAST_CONTROL_TRANSFER: from fffff800999ee0d7 to fffff8009985a440
STACK_TEXT:
fffff880`0bf3fb48 fffff800`999ee0d7 : 00000000`00000018 00000000`00000000 fffffa80`379a3070 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bf3fb50 fffff800`99c33529 : fffffa80`379a3070 fffff8a0`0244adc0 00000000`000017e4 0000001b`930b60d8 : nt! ?? ::FNODOBFM::`string'+0x38605
fffff880`0bf3fb90 fffff800`99859453 : fffffa80`4063db00 fffffa80`4063db00 fffff880`0bf3fcc0 00000000`00000001 : nt!NtClose+0x239
fffff880`0bf3fc40 000007ff`5e8d2cda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000001b`9069f398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`5e8d2cda
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+38605
fffff800`999ee0d7 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+38605
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 51a966cd
IMAGE_VERSION: 6.2.9200.16628
BUCKET_ID_FUNC_OFFSET: 38605
FAILURE_BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x18_OVER_DEREFERENCE_nt!_??_::FNODOBFM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_over_dereference_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {eaf19261-0688-f327-a17d-6f7960ac4ebd}
Followup: MachineOwner
rax=0000000000000000 rbx=ffffffffffffffff rcx=0000000000000018
rdx=0000000000000000 rsi=fffffa80379a3070 rdi=00000000fffc000c
rip=fffff8009985a440 rsp=fffff8800bf3fb48 rbp=fffffa80379a3040
r8=fffffa80379a3070 r9=0000000000000002 r10=fffffa8030d89190
r11=fffffa804063db00 r12=00000000000017e4 r13=0000000000000000
r14=fffff8a00a548f90 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff800`9985a440 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff880`0bf3fb50=0000000000000018
Child-SP RetAddr : Args to Child
: Call Site
fffff880`0bf3fb48 fffff800`999ee0d7 : 00000000`00000018 00000000`00000000 fffffa80`379a3070 00000000`00000002 : nt!KeBugCheckEx
fffff880`0bf3fb50 fffff800`99c33529 : fffffa80`379a3070 fffff8a0`0244adc0 00000000`000017e4 0000001b`930b60d8 : nt! ?? ::FNODOBFM::`string'+0x38605
fffff880`0bf3fb90 fffff800`99859453 : fffffa80`4063db00 fffffa80`4063db00 fffff880`0bf3fcc0 00000000`00000001 : nt!NtClose+0x239
fffff880`0bf3fc40 000007ff`5e8d2cda : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0bf3fc40)
0000001b`9069f398 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x000007ff`5e8d2cda
start end module name
fffff800`987b1000 fffff800`987ba000 kd kd.dll Thu Jul 26 03:30:34 2012 (5010ABCA)
fffff800`99800000 fffff800`99f4c000 nt ntkrnlmp.exe Sat Jun 01 04:13:17 2013 (51A966CD)
fffff800`99f4c000 fffff800`99fb8000 hal hal.dll Wed Oct 24 04:03:21 2012 (50875A79)
fffff880`00a00000 fffff880`00a34000 ataport ataport.SYS Thu Jul 26 03:29:04 2012 (5010AB70)
fffff880`00a34000 fffff880`00a51000 lsi_sas lsi_sas.sys Fri May 11 20:40:21 2012 (4FAD6B25)
fffff880`00a51000 fffff880`00a5e000 serenum serenum.sys Thu Jul 26 03:30:13 2012 (5010ABB5)
fffff880`00a5e000 fffff880`00a6c000 fdc fdc.sys Thu Jul 26 03:30:15 2012 (5010ABB7)
fffff880`00a7b000 fffff880`00adb000 volmgrx volmgrx.sys Thu Jul 26 03:29:59 2012 (5010ABA7)
fffff880`00adb000 fffff880`00ae4000 intelide intelide.sys Thu Jul 26 03:29:52 2012 (5010ABA0)
fffff880`00ae4000 fffff880`00af3000 PCIIDEX PCIIDEX.SYS Thu Jul 26 03:29:09 2012 (5010AB75)
fffff880`00af3000 fffff880`00b56000 md3dsm md3dsm.sys Wed Aug 22 22:14:46 2012 (50354BC6)
fffff880`00b56000 fffff880`00b87000 msdsm msdsm.sys Sat Oct 05 04:32:09 2013 (524F8839)
fffff880`00b87000 fffff880`00ba0000 vmci vmci.sys Tue May 01 02:14:27 2012 (4F9F38F3)
fffff880`00ba0000 fffff880`00bb5000 vsock vsock.sys Fri Aug 30 20:25:34 2013 (5220F1AE)
fffff880`00bb5000 fffff880`00bcf000 mountmgr mountmgr.sys Thu Jul 26 03:29:33 2012 (5010AB8D)
fffff880`00bcf000 fffff880`00bd9000 atapi atapi.sys Thu Jul 26 03:30:33 2012 (5010ABC9)
fffff880`00bd9000 fffff880`00bf0000 vmxnet3n61x64 vmxnet3n61x64.sys Fri Sep 27 10:40:11 2013 (5245527B)
fffff880`00bf0000 fffff880`00bfa000 pnpmem pnpmem.sys Thu Jul 26 03:30:11 2012 (5010ABB3)
fffff880`00c40000 fffff880`00c9f000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Thu Jul 26 03:30:12 2012 (5010ABB4)
fffff880`00c9f000 fffff880`00cfb000 CLFS CLFS.SYS Thu Jul 26 03:29:39 2012 (5010AB93)
fffff880`00cfb000 fffff880`00d1e000 tm tm.sys Thu Jul 26 03:29:01 2012 (5010AB6D)
fffff880`00d1e000 fffff880`00d33000 PSHED PSHED.dll Thu Jul 26 05:53:53 2012 (5010CD61)
fffff880`00d33000 fffff880`00d3d000 BOOTVID BOOTVID.dll Thu Jul 26 03:30:22 2012 (5010ABBE)
fffff880`00d3d000 fffff880`00dbc000 CI CI.dll Thu Mar 28 03:30:42 2013 (5153B962)
fffff880`00dbc000 fffff880`00de1000 rasl2tp rasl2tp.sys Thu Jul 26 03:23:16 2012 (5010AA14)
fffff880`00e00000 fffff880`00e49000 spaceport spaceport.sys Sat Oct 05 04:32:08 2013 (524F8838)
fffff880`00e49000 fffff880`00e61000 volmgr volmgr.sys Thu Jul 26 03:29:22 2012 (5010AB82)
fffff880`00e61000 fffff880`00ea9000 vm3dmp vm3dmp.sys Wed Oct 09 05:25:53 2013 (5254DAD1)
fffff880`00eb5000 fffff880`00f41000 cng cng.sys Thu Oct 11 06:17:34 2012 (5076566E)
fffff880`00f41000 fffff880`00f5b000 raspppoe raspppoe.sys Thu Jul 26 03:24:55 2012 (5010AA77)
fffff880`00f5c000 fffff880`00f99000 mpio mpio.sys Sat Sep 28 04:37:24 2013 (52464EF4)
fffff880`00f99000 fffff880`00fd3000 md3utm md3utm.sys Wed Aug 22 22:14:56 2012 (50354BD0)
fffff880`00fd3000 fffff880`00fef000 intelppm intelppm.sys Tue Nov 06 03:55:02 2012 (50988A16)
fffff880`01000000 fffff880`0106d000 ACPI ACPI.sys Thu Sep 20 07:09:16 2012 (505AB30C)
fffff880`01075000 fffff880`010d8000 msrpc msrpc.sys Thu Jul 26 03:28:37 2012 (5010AB55)
fffff880`010d8000 fffff880`0119a000 Wdf01000 Wdf01000.sys Sat Jun 22 04:13:05 2013 (51C51641)
fffff880`0119a000 fffff880`011aa000 WDFLDR WDFLDR.SYS Sat Jun 22 04:14:38 2013 (51C5169E)
fffff880`011aa000 fffff880`011c1000 acpiex acpiex.sys Thu Jul 26 03:25:57 2012 (5010AAB5)
fffff880`011c1000 fffff880`011cc000 WppRecorder WppRecorder.sys Thu Jul 26 03:29:07 2012 (5010AB73)
fffff880`011cc000 fffff880`011d6000 WMILIB WMILIB.SYS Thu Jul 26 03:30:04 2012 (5010ABAC)
fffff880`011d6000 fffff880`011f7000 raspptp raspptp.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`01400000 fffff880`0140d000 vdrvroot vdrvroot.sys Thu Jul 26 03:27:29 2012 (5010AB11)
fffff880`0140d000 fffff880`01424000 pdc pdc.sys Fri Mar 01 04:58:34 2013 (5130357A)
fffff880`01424000 fffff880`0143e000 partmgr partmgr.sys Wed Jan 09 04:01:42 2013 (50ECEBA6)
fffff880`01444000 fffff880`0153f000 NDIS NDIS.SYS Sat Jun 15 06:11:35 2013 (51BBF787)
fffff880`0153f000 fffff880`015ae000 NETIO NETIO.SYS Thu Oct 11 06:16:20 2012 (50765624)
fffff880`015ae000 fffff880`015b8000 msisadrv msisadrv.sys Thu Jul 26 03:28:02 2012 (5010AB32)
fffff880`015b8000 fffff880`015f5000 pci pci.sys Thu Jul 26 03:27:43 2012 (5010AB1F)
fffff880`01800000 fffff880`01816000 datascrn datascrn.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`01816000 fffff880`01824000 cbafilt cbafilt.sys Thu Jul 26 03:29:05 2012 (5010AB71)
fffff880`01824000 fffff880`0186c000 msiscsi msiscsi.sys Mon Feb 03 16:23:09 2014 (52EFC26D)
fffff880`0186c000 fffff880`01877000 kdnic kdnic.sys Thu Jul 26 03:27:41 2012 (5010AB1D)
fffff880`01877000 fffff880`01889000 umbus umbus.sys Thu Jul 26 03:27:39 2012 (5010AB1B)
fffff880`01889000 fffff880`018a9000 i8042prt i8042prt.sys Thu Jul 26 03:28:50 2012 (5010AB62)
fffff880`018a9000 fffff880`018b8000 kbdclass kbdclass.sys Thu Jul 26 03:28:47 2012 (5010AB5F)
fffff880`018b8000 fffff880`018c7000 mouclass mouclass.sys Thu Jul 26 03:28:47 2012 (5010AB5F)
fffff880`018c7000 fffff880`018e5000 parport parport.sys Thu Jul 26 03:29:53 2012 (5010ABA1)
fffff880`018e5000 fffff880`018fd000 serial serial.sys Thu Jul 26 03:30:01 2012 (5010ABA9)
fffff880`018fd000 fffff880`01952000 storport storport.sys Mon Feb 03 16:23:24 2014 (52EFC27C)
fffff880`01952000 fffff880`019b2000 fltmgr fltmgr.sys Thu Jul 26 03:30:09 2012 (5010ABB1)
fffff880`019b2000 fffff880`019e0000 quota quota.sys Thu Jul 26 03:29:14 2012 (5010AB7A)
fffff880`019e0000 fffff880`019f4000 dfsrro dfsrro.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`019f4000 fffff880`01a00000 BATTC BATTC.SYS Thu Oct 11 06:19:58 2012 (507656FE)
fffff880`01a00000 fffff880`01a2c000 tunnel tunnel.sys Thu Jul 26 03:23:04 2012 (5010AA08)
fffff880`01a2c000 fffff880`01a3b000 CompositeBus CompositeBus.sys Thu Jul 26 03:28:03 2012 (5010AB33)
fffff880`01a3b000 fffff880`01a45000 vmgencounter vmgencounter.sys Thu Jul 26 03:27:58 2012 (5010AB2E)
fffff880`01a45000 fffff880`01c2a000 Ntfs Ntfs.sys Sun Jan 26 23:28:35 2014 (52E59A23)
fffff880`01c2a000 fffff880`01c45000 ksecdd ksecdd.sys Thu Sep 20 07:09:16 2012 (505AB30C)
fffff880`01c45000 fffff880`01c56000 pcw pcw.sys Thu Jul 26 03:28:44 2012 (5010AB5C)
fffff880`01c56000 fffff880`01c60000 Fs_Rec Fs_Rec.sys Thu Jul 26 03:30:08 2012 (5010ABB0)
fffff880`01c60000 fffff880`01c8f000 ksecpkg ksecpkg.sys Thu Oct 11 06:16:46 2012 (5076563E)
fffff880`01c8f000 fffff880`01cc0000 cdrom cdrom.sys Thu Jul 26 03:26:36 2012 (5010AADC)
fffff880`01cc0000 fffff880`01d2b000 dedup dedup.sys Sat Oct 05 04:31:38 2013 (524F881A)
fffff880`01d2b000 fffff880`01d3a000 vmrawdsk vmrawdsk.sys Sun Dec 15 03:36:38 2013 (52AD23C6)
fffff880`01d3a000 fffff880`01d47000 BasicRender BasicRender.sys Thu Jul 26 03:28:51 2012 (5010AB63)
fffff880`01d47000 fffff880`01d53000 mssmbios mssmbios.sys Thu Jul 26 03:29:19 2012 (5010AB7F)
fffff880`01d53000 fffff880`01d64000 discache discache.sys Thu Jul 26 03:28:23 2012 (5010AB47)
fffff880`01d64000 fffff880`01d85000 dfsc dfsc.sys Wed Jan 15 23:42:58 2014 (52D71D02)
fffff880`01d85000 fffff880`01d91000 ndistapi ndistapi.sys Thu Sep 20 07:09:19 2012 (505AB30F)
fffff880`01d91000 fffff880`01dc0000 ndiswan ndiswan.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`01dc0000 fffff880`01dde000 rassstp rassstp.sys Thu Jul 26 03:23:59 2012 (5010AA3F)
fffff880`01dde000 fffff880`01df6000 AgileVpn AgileVpn.sys Thu Jul 26 03:23:11 2012 (5010AA0F)
fffff880`01df6000 fffff880`01dfc400 CmBatt CmBatt.sys Thu Jul 26 03:29:20 2012 (5010AB80)
fffff880`01e00000 fffff880`01e54000 CLASSPNP CLASSPNP.SYS Sat Jun 29 04:07:45 2013 (51CE4F81)
fffff880`01e54000 fffff880`01e68000 crashdmp crashdmp.sys Fri Aug 30 04:11:28 2013 (52200D60)
fffff880`01e75000 fffff880`01e7e000 Null Null.SYS Thu Jul 26 03:30:16 2012 (5010ABB8)
fffff880`01e81000 fffff880`020ba000 tcpip tcpip.sys Wed Jan 22 04:28:22 2014 (52DF48E6)
fffff880`020ba000 fffff880`02122000 fwpkclnt fwpkclnt.sys Fri Mar 01 04:55:54 2013 (513034DA)
fffff880`02122000 fffff880`0213d000 wfplwfs wfplwfs.sys Thu Oct 10 04:32:19 2013 (52561FC3)
fffff880`0213d000 fffff880`02191000 volsnap volsnap.sys Sat Jun 01 04:10:22 2013 (51A9661E)
fffff880`02191000 fffff880`021a8000 mup mup.sys Thu Jul 26 03:30:00 2012 (5010ABA8)
fffff880`021a8000 fffff880`021b4000 npsvctrig npsvctrig.sys Thu Jul 26 03:27:33 2012 (5010AB15)
fffff880`021b4000 fffff880`021d0000 disk disk.sys Sat Oct 12 07:31:15 2013 (5258ECB3)
fffff880`021ed000 fffff880`021ff000 dfs dfs.sys Thu Jul 26 03:28:21 2012 (5010AB45)
fffff880`03800000 fffff880`03863000 mrxsmb mrxsmb.sys Tue Feb 05 22:29:08 2013 (511187B4)
fffff880`0389c000 fffff880`038eb000 ks ks.sys Sat Feb 02 07:25:50 2013 (510CBF7E)
fffff880`038eb000 fffff880`038f6000 rdpbus rdpbus.sys Thu Jul 26 03:28:19 2012 (5010AB43)
fffff880`038f6000 fffff880`0390a000 NDProxy NDProxy.SYS Tue Apr 09 03:33:41 2013 (51637E05)
fffff880`0390a000 fffff880`03915000 flpydisk flpydisk.sys Thu Jul 26 03:30:15 2012 (5010ABB7)
fffff880`03915000 fffff880`03922000 dump_diskdump dump_diskdump.sys Thu Jul 26 03:29:58 2012 (5010ABA6)
fffff880`03922000 fffff880`0393f000 dump_LSI_SAS dump_LSI_SAS.sys Fri May 11 20:40:21 2012 (4FAD6B25)
fffff880`0393f000 fffff880`03947000 HIDPARSE HIDPARSE.SYS Sat Jun 29 04:08:18 2013 (51CE4FA2)
fffff880`03947000 fffff880`03955000 monitor monitor.sys Fri Mar 01 04:56:18 2013 (513034F2)
fffff880`03955000 fffff880`0397d000 luafv luafv.sys Thu Jul 26 03:29:13 2012 (5010AB79)
fffff880`0397d000 fffff880`03991000 lltdio lltdio.sys Thu Jul 26 03:24:02 2012 (5010AA42)
fffff880`03991000 fffff880`039a9000 rspndr rspndr.sys Thu Jul 26 03:24:06 2012 (5010AA46)
fffff880`039a9000 fffff880`039c9000 bowser bowser.sys Thu Jul 26 03:28:01 2012 (5010AB31)
fffff880`039c9000 fffff880`039e0000 mpsdrv mpsdrv.sys Thu Oct 31 03:42:19 2013 (5271D19B)
fffff880`03c00000 fffff880`03c73000 rdbss rdbss.sys Sat May 04 05:47:00 2013 (518492C4)
fffff880`03c73000 fffff880`03c8d000 wanarp wanarp.sys Tue Apr 09 03:31:00 2013 (51637D64)
fffff880`03c8d000 fffff880`03c9b000 nsiproxy nsiproxy.sys Thu Jul 26 03:25:00 2012 (5010AA7C)
fffff880`03c9b000 fffff880`03ca3000 vmmouse vmmouse.sys Mon Jun 04 10:34:25 2012 (4FCC8121)
fffff880`03ca3000 fffff880`03e0c000 dxgkrnl dxgkrnl.sys Thu Sep 19 04:16:23 2013 (523A6C87)
fffff880`03e0c000 fffff880`03e1d000 watchdog watchdog.sys Thu Jul 26 03:29:05 2012 (5010AB71)
fffff880`03e1d000 fffff880`03e6b000 dxgmms1 dxgmms1.sys Wed Jan 09 03:58:58 2013 (50ECEB02)
fffff880`03e6b000 fffff880`03e7c000 BasicDisplay BasicDisplay.sys Thu Jul 26 03:29:08 2012 (5010AB74)
fffff880`03e7c000 fffff880`03e8e000 Npfs Npfs.SYS Thu Jul 26 03:30:26 2012 (5010ABC2)
fffff880`03e8e000 fffff880`03e9a000 Msfs Msfs.SYS Thu Jul 26 03:30:24 2012 (5010ABC0)
fffff880`03e9a000 fffff880`03ebc000 tdx tdx.sys Thu Jul 26 03:24:58 2012 (5010AA7A)
fffff880`03ebc000 fffff880`03eca000 TDI TDI.SYS Thu Jul 26 03:27:59 2012 (5010AB2F)
fffff880`03eca000 fffff880`03ed6000 ws2ifsl ws2ifsl.sys Thu Sep 20 07:09:50 2012 (505AB32E)
fffff880`03ed6000 fffff880`03f2e000 netbt netbt.sys Thu Jul 26 03:24:26 2012 (5010AA5A)
fffff880`03f2e000 fffff880`03fc4000 afd afd.sys Wed Sep 04 04:11:20 2013 (5226A4D8)
fffff880`03fc4000 fffff880`03fee000 pacer pacer.sys Thu Jul 26 03:23:05 2012 (5010AA09)
fffff880`03fee000 fffff880`03ffe000 netbios netbios.sys Thu Jul 26 03:28:19 2012 (5010AB43)
fffff880`03ffe000 fffff880`03fff480 swenum swenum.sys Thu Jul 26 03:28:53 2012 (5010AB65)
fffff880`0ac00000 fffff880`0acdf000 HTTP HTTP.sys Fri Mar 15 00:17:15 2013 (5142688B)
fffff880`0acdf000 fffff880`0ace7000 vmmemctl vmmemctl.sys Sun Dec 15 03:36:24 2013 (52AD23B8)
fffff880`0acf8000 fffff880`0ad43000 mrxsmb10 mrxsmb10.sys Thu Jul 26 03:23:06 2012 (5010AA0A)
fffff880`0ad43000 fffff880`0ad7e000 mrxsmb20 mrxsmb20.sys Tue Feb 05 22:28:36 2013 (51118794)
fffff880`0b200000 fffff880`0b20d000 condrv condrv.sys Thu Jul 26 03:30:08 2012 (5010ABB0)
fffff880`0b20d000 fffff880`0b2ae000 srv2 srv2.sys Tue Apr 09 03:33:02 2013 (51637DDE)
fffff880`0b2cd000 fffff880`0b399000 peauth peauth.sys Tue Apr 09 03:32:01 2013 (51637DA1)
fffff880`0b399000 fffff880`0b3a4000 secdrv secdrv.SYS Wed Sep 13 14:18:38 2006 (4508052E)
fffff880`0b3a4000 fffff880`0b3e8000 srvnet srvnet.sys Tue Apr 09 03:31:13 2013 (51637D71)
fffff880`0b3e8000 fffff880`0b3fa000 tcpipreg tcpipreg.sys Thu Jul 26 03:23:13 2012 (5010AA11)
fffff880`0b4e3000 fffff880`0b570000 srv srv.sys Thu Jul 26 03:25:28 2012 (5010AA98)
fffff880`0b570000 fffff880`0b57b000 rdpvideominiport rdpvideominiport.sys Fri Oct 12 06:48:28 2012 (5077AF2C)
fffff880`0b57b000 fffff880`0b5ac000 rdpdr rdpdr.sys Thu Jul 26 03:25:18 2012 (5010AA8E)
fffff880`0b5ac000 fffff880`0b5b9000 terminpt terminpt.sys Thu Jul 26 03:28:53 2012 (5010AB65)
fffff960`00118000 fffff960`00508000 win32k win32k.sys Sat Feb 08 04:34:05 2014 (52F5B3BD)
fffff960`006cb000 fffff960`006d4000 TSDDD TSDDD.dll Thu Jul 26 03:30:25 2012 (5010ABC1)
fffff960`00879000 fffff960`008af000 cdd cdd.dll Thu Jul 26 05:49:37 2012 (5010CC61)
fffff960`00a21000 fffff960`00a60000 RDPUDD RDPUDD.dll Fri Oct 12 06:50:01 2012 (5077AF89)
Unloaded modules:
fffff880`01e68000 fffff880`01e75000 dump_storport.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
fffff880`021d0000 fffff880`021ed000 dump_LSI_SAS.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001D000
fffff880`021a8000 fffff880`021b4000 hwpolicy.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff880`00f41000 fffff880`00f5c000 sacdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001B000
fffff880`00c33000 fffff880`00c40000 ApiSetSchema.dll
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
I have searched for others having a similar problem but have not managed to find much.
The memory dump at the time of the crash does seem to hint at a problem with DFSR.exe.
The setup seems to be running fine again now and is going through its consistency checks, it is just a major inconvenience and will only get worse as the DFS becomes busier and approaches capacity.
The plan was to put this setup into production however with the unpredictability of blue screen reboots I cannot see this happening until I can find a fix or work around.
I have yet to see this problem occur on the other (physical) server, this is pretty much identical in configuration apart from its storage access.
My thoughts are a possible bug in the DFSR component or a bug in the DSM Drivers used for the iSCSI SAN connection or maybe a combination of the two.
Any help, thoughts or suggestions greatly appreciated
ThanksHi,
Please install the current version of Dfssvc.exe Dfsc.sys Dfsrs.exe for Windows Server 2012.
List of currently available hotfixes for Distributed File System (DFS) technologies in Windows Server 2012 and Windows Server 2012 R2
http://support.microsoft.com/kb/2951262
The issue may be due to the DFSRoot folder has lost NTFS permission. Some reasons why DFS root lose ACLs Links are listed in the article below:
How to implement Windows Server 2003 Access-based Enumeration in a DFS environment
http://support.microsoft.com/kb/907458/en-us
You could use dfsutil to set NTFS permission: dfsutil property ACL \\DFS-namespace
Using the Windows Server 2008 DFSUTIL.EXE command line to manage DFS-Namespaces
http://blogs.technet.com/b/josebda/archive/2009/05/01/using-the-windows-server-2008-dfsutil-exe-command-line-to-manage-dfs-namespaces.aspx
To narrow down the issue, you could remove the DFS role to check if the issue related to the dfs namespace and dfs replication roles.
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
DFS Replication failed to contact Domain Controller.....
I have seen this error since the inception of this stand alone AD PDC instance of Windows server 2012 R2 Essentials. I understand that Essentials does not support other Domain Controllers ; Member servers ; or trust between Domains of any kind. I also
understand that DSF Replication is a service that replicates files between other servers and other domain servers that Essentials dose not want to talk to.
So my question is why am I seeing this DFSR error 1202 in my event log, if Essentials does not support communication to other servers and domain servers? Maybe a better question is why does Essentials even try to implement this
service? Do I even need to try to resolve this issue or should I just disable it and move on?
Contents of Error:
Log Name: DFS Replication
Source: DFSR
Date: 2/6/2014 1:57:57 PM
Event ID: 1202
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Hxxx2.xxxxxxxxxxxxx.local
Description:
The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused
by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.
Additional Information:
Error: 160 (One or more arguments are not correct.)
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="DFSR" />
<EventID Qualifiers="49152">1202</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2014-02-06T19:57:57.000000000Z" />
<EventRecordID>194</EventRecordID>
<Channel>DFS Replication</Channel>
<Computer>Hxxx2.Hxxxxxxxxxxxxx.local</Computer>
<Security />
</System>
<EventData>
<Data>
</Data>
<Data>60</Data>
<Data>160</Data>
<Data>One or more arguments are not correct.</Data>
</EventData>
</Event>Hi,
Did you mean that you did not configure a DFS server in the new DC but you get the DFSR error 1202 in your event log? Then the issue is not related to the existing SBS domain.
Please try to turn off the Windows Firewall to check if it causes the issue. You could also refer to the articles below to troubleshoot the issue:
Newly Promoted Win2K8 DC is not advertising as Domain Controller.
http://blogs.technet.com/b/niraj_kumar/archive/2009/04/23/newly-promoted-win2k8-dc-is-not-advertising-as-domain-controller.aspx
Restrictions for Unauthenticated RPC Clients: The group policy that punches your domain in the face
https://blogs.technet.com/b/askds/archive/2011/04/08/restrictions-for-unauthenticated-rpc-clients-the-group-policy-that-punches-your-domain-in-the-face.aspx
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
I'm replicating between two servers in two sites (Server A - Server 2012 R2 STD, Server B - Server 2008 R2) over a VPN (Sonicwall Firewall). Though the initial replication seems to be
happening it is very slow (the folder in question is less than 3GB). I'm seeing these in the event viewer every few minutes:
The DFS Replication service is stopping communication with partner PPIFTC for replication group FTC due to an error. The service will retry the connection periodically.
Additional Information:
Error: 1726 (The remote procedure call failed.)
and then....
The DFS Replication service successfully established an inbound connection with partner PPIFTC for replication group FTC.
Here are all my troubleshooting steps (keep in mind that our VPN is going through a SonicWall <--I increased the TCP timeout to 24 hours):
-Increased TCP Timeout to 24 hours
-Added the following values on both sending and receiving members and rebooted server
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Value =DisableTaskOffload
Type = DWORD
Data = 1
Value =EnableTCPChimney
Type = DWORD
Data = 0
Value =EnableTCPA
Type = DWORD
Data = 0
Value =EnableRSS
Type = DWORD
Data = 0
---------------------------------more troubleshooting--------------------------
-Disabled AntiVirus on both members
-Made sure DFSR TCP ports 135 & 5722 are open
-Installed all hotfixes for 2008 R2 (http://support.microsoft.com/kb/968429) and rebooted
-Ran NETSTAT –ANOBP TCP and the DFS executable results are listed below:
Sending Member:
[DFSRs.exe]
TCP 10.x.x.x:53 0.0.0.0:0
LISTENING 1692
[DFSRs.exe]
TCP 10.x.x.x:54669
10.x.x.x:5722 TIME_WAIT 0
TCP 10.x.x.x:54673
10.x.x.x:5722 ESTABLISHED 1656
[DFSRs.exe]
TCP 10.x.x.x:64773
10.x.x.x:389 ESTABLISHED 1692
[DFSRs.exe]
TCP 10.x.x.x:64787
10.x.x.x:389 ESTABLISHED 1656
[DFSRs.exe]
TCP 10.x.x.x:64795
10.x.x.x:389 ESTABLISHED 2104
Receiving Member:
[DFSRs.exe]
TCP 10.x.x.x:56683
10.x.x.x:389 ESTABLISHED 7472
[DFSRs.exe]
TCP 10.x.x.x:57625
10.x.x.x:54886 ESTABLISHED 2808
[DFSRs.exe]
TCP 10.x.x.x:61759
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61760
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61763
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61764
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61770
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61771
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61774
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61775
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61776
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61777
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61778
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61779
10.x.x.x:57625 TIME_WAIT 0
TCP 10.x.x.x:61784
10.x.x.x:52757 ESTABLISHED 7472
[DFSRs.exe]
TCP 10.x.x.x:63661
10.x.x.x:63781 ESTABLISHED 4880
------------------------------more troubleshooting--------------------------
-Increased Staging to 32GB
-Opened the ADSIedit.msc console to verify the "Authenticated Users" is set with the default READ permission on the following object:
a. The computer object of the DFS server
b. The DFSR-LocalSettings object under the DFS server computer object
-Ran
ping <var>10.x.x.x</var> -f -l 1472 and got replies back from both servers
-AD replication is successful on all partners
-Nslookup is working so DNS is working
-Updated NIC drivers on both servers
- I ran the following to set the Primary Member:
dfsradmin Membership Set /RGName:<replication group name> /RFName:<replicated folder name> /MemName:<primary member> /IsPrimary:True
Then Dfsrdiag Pollad /Member:<member name>
I'm seeing these errors in the dfsr logs:
20141014 19:28:17.746 9116 SRTR 957 [WARN] SERVER_EstablishSession Failed to establish a replicated folder session. connId:{45C8C309-4EDD-459A-A0BB-4C5FACD97D44} csId:{7AC7917F-F96F-411B-A4D8-6BB303B3C813}
Error:
+ [Error:9051(0x235b) UpstreamTransport::EstablishSession upstreamtransport.cpp:808 9116 C The content set is not ready]
+ [Error:9051(0x235b) OutConnection::EstablishSession outconnection.cpp:532 9116 C The content set is not ready]
+ [Error:9051(0x235b) OutConnection::EstablishSession outconnection.cpp:471 9116 C The content set is not ready]
---------------------------------------more troubleshooting-----------------------------
I've done a lot of research on the Internet and most of it is pointing to the same stuff I've tried. Does anyone have any other suggestions? Maybe I need to look somewhere
else on the server side or firewall side?
I tried replicating from a 2012 R2 server to another 2012 server and am getting the same events in the event log so maybe it's not a server issue.
Some other things I'm wondering:
-Could it be the speed of the NICs? Server A is a 2012 Server that has Hyper-V installed. NIC teaming was initially setup and since Hyper-V is installed the NIC is a "vEthernet
(Microsoft Network Adapter Multiplexor Driver Virtual Switch) running at a speed of 10.0Gbps whereas Server B is running a single NIC at 1.0Gbps
-Could occasional ping timeout's cause the issue? From time to time I get a timeout but it's not as often as the events I'm seeing. I'm getting 53ms pings. The folder
is only 3 GB so it shouldn't take that long to replicate but it's been days. The schedule I have set for replication is mostly all day except for our backup times which start at 11pm-5am. Throughout the rest of the time I have it set anywhere from
4Mbps to 64 Kbps. Server A is on a 5mb circuit and Server B is on a 10mb circuit.I'm seeing the same errors, all servers are running 2008 R2 x64. Across multiple sites, VPN is steady and reliably.
185 events from 12:28:21 to 12:49:25
Events are for all five servers (one per office, five total offices, no two in the same city, across three states).
Events are not limited to one replication group. I have quite a few replication groups, so I don't know for sure but I'm running under the reasonable assumption that none are spared.
Reminder from original post (and also, yes, same for me), the error is: Error: 1726 (The remote procedure call failed.)
Some way to figure out what code triggers an Event ID 5014, and what code therein specifies an Error 1726, would extremely helpful. Trying random command line/registry changes on live servers is exceptionally unappealing.
Side note, 1726 is referenced here:
https://support.microsoft.com/kb/976442?wa=wsignin1.0
But it says, "This RPC connection problem may be caused by an unstable WAN connection." I don't believe this is the case for my system.
It also says...
For most RPC connection problems, the DFS Replication service will try to obtain the files again without logging a warning or an error in the DFS Replication log. You can capture the network trace to determine whether the cause of the problem is at the network
layer. To examine the TCP ports that the DFS Replication service is using on replication partners, run the following command in a
Command Prompt window:
NETSTAT –ANOBP TCP
This returns all open TCP connections. The connections in question are "DFSRs.exe", which the command won't let you filter for.
Instead, I used the NETSTAT command as advertised, dumping output to info.txt:
NETSTAT -ANOBP TCP >> X:\info.txt
Then I opened Excel and manually opened the .TXT for the open wizard. I chose fixed-width fields based on the first row for each result, and then added a column:
=IF(A3="Can not", "Can not obtain ownership information", IF(LEFT(A3,1) = "[", A3&B3&C3, ""))
Dragging this down through the entire file let me see that row (Row F) as the file name. Some anomalies were present but none impacted DFSrs.exe results.
Finally, you can sort/filter (I sorted because I like being able to see everything, should I choose to) to get just the results you need, with the partial rows removed from the result set, or bumped to the end.
My server had 125 connections open.
That is a staggering number of connections to review, and I feel like I'm looking for a needle in a haystack.
I'll see if I can find anything useful out, but a better solution would be most wonderful. -
Volumes disappeared from DFS replication
Hi all,
Recently I set up DFS replication on Windows 2012 Std Server. Few days ago I tried to connect the 3rd server to this replication and found out that all volumes except C:\ drive are disappeared from DFS replication on the main server, so it can't do initial
replication.
When I go to DFS snap-in and create Diagnostic report for the replication - it shows me available volumes on every server - C:\ drive only for the main one and all volumes for other servers. Shares on the main server are up and running without any problems.
So the question is how to add the volumes back to DFS replication, any ideas?
Kind regards,
Artem.Hi,
It seems that DFS replication can't sync between the main server and the second server. I suggest you recreate the replication group to resolve the issue. If there is any error message in the diagnostic report or event log? If so, please provide the error message
to troubleshoot the issue.
Please also refer to the thread below to see if it helps:
DFSR Replication Broken
http://social.technet.microsoft.com/Forums/windowsserver/en-US/b73aea9e-3a0e-4139-b02d-d3f205e0ab19/dfsr-replication-broken?forum=winserverfiles
Regards,
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
Hi,
hummmm...
The client had 1 Server with AD and All Apps, IIS, Terminal Servers (30 device Cal), File Server, SQL2008R2 on it
Task: Install new AD server promote it to DC, bring in 2nd server, Replicate the File Server (DFSR) on these 2 servers, and demote it to standard server.
1) Old AD with name "Server" with OS-2008R2 SP1 and is a DC.
2) Brought in a new server "PrimaryAD", Installed 2008R2, done DC Promo, and added it as Additional Domain controller
3) Transferred roles from old server "Server" to "PrimaryAD"
4) Brought in a new File Server replicating server "Backup-Server"
5) Copied all the data from Server to Backup-server as DFS initial file sync with robocopy
6) here the problem started, after the copy finished, next morning the "Server" server crashed.....
7) thank god the data was backed up on Backup-server. but we didnt get the time to Demote the server "Server" and remove AD from it.
8) Since AD was replicated so "PrimaryAD" was are DC, brought 2nd Server "SecondaryDC" as additional domain controller.
9) we cleaned up the metadata and used ASIEDIT to clean the remaining stuff.
10) the "Server" server was formatted and renamed as "Primary-Server" and OS2008R2 SP1 was installed with rest of required apps
11) so now the PrimaryAD the DC, SecondaryAD the Additional Domain controller, Primary-Server the mail server and File server, the Backup-server, the replicated server.
Now configured DFS Replication from Primary-Server to Backup-server and receive following Event ID 1202
If i Configure DFS Replication as follows
PrimaryAD <<>> SecondaryAD -= Works... no errors...
PrimaryAD <<>> Backup-Server = Creates but Dosent works Event ID 5012, error The DFS Replication service failed to communicate with partner BACKUP-SERVER, Additional Information: Error: 9026 (The connection is invalid)
PrimaryAD <<>> Primary-Server = Dosent creates replication job just hangs,
on primaryad continious Eveni ID 10009, DCOM was unable to communicate with the computer "SERVER" using any of the configured protocols
......something on PrimaryAD is still trying to connect to old corrupt AD server "Server"
No errors with AD replication, SYSVOL & Netlogon shares also working fine and accessible.
DFS Diagnose report says
DNS name: backup-server.mydomain.com
Domain name: mydomain.COM
Reference domain controller: -- (HERE there is NO DOMAIN CONTROLLER mentioned)
IP address: 192.168.1.248,192.168.1.251,::1
Site: Default-First-Site-Name
Forgot to mention, gave full rights with ADSIEDIT to DFSR-LocalSettings for all server to Administrator and read permissions to "Authenticated Users"
DFSRDIAG POLLAD throws following error
c:\Dfsrdiag pollad /verbose
[INFO] Computer Name: BACKUP-SERVER
[INFO] Computer DNS: Backup-Server.mydomain.COM
[INFO] Domain Name: mydomain
[INFO] Domain DNS: mydomain.COM
[INFO] Site Name: Default-First-Site-Name
[INFO] Connected to WMI services on computer: Backup-Server.mydomain.COM
[INFO] Invoke PollDsNow() method on Backup-Server.mydomain.COM
[ERROR] PollDsNow method executed unsuccessfully. ReturnValue: 12 (0xc)
[ERROR] Failed to execute PollAD command Err: -2147217407 (0x80041001)
Can anyone point me to any direction which can lead to resolution of this ERROR and make DFS_R work..
Thanks
bikramHi,
It seems that DCPROMO did its work without complaints, still the DFSR references remained in AD. You could refer to the article below to clean up the DFS Replication object.
How to remove data in Active Directory after an unsuccessful domain controller demotion
http://support.microsoft.com/kb/216498
In additional, please refer to the following thread to troubleshoot the issue:
DFS is not working anymore.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/953be9ef-e9e3-4885-a5c4-47fc475ba562/dfs-is-not-working-anymore?forum=winserverfiles
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
I've had 2 DFSR servers replicating for about 12 months now with no issue, with in the last week one server has stopped replicating some files, ie will have a directory with 30 jpg files on server a, server b will only receive 15 of the files.
in the DFSR log i just see this log repeated over and over again for all the different files it wont replicate
20140705 18:03:16.674 4072 SRTR 2344 [WARN] InitializeFileTransferAsyncState::ProcessIoCompletion Failed connId:{20AEF2C3-92EC-41B2-A161-D26B164F2A73} rdc:1 uid:{75E65307-2678-4C2B-B808-0C321E8D4383}-v7123
gsvn:{75E65307-2678-4C2B-B808-0C321E8D4383}-v7127 Error:[Error:170(0xaa) InitializeFileTransferAsyncState::ProcessIoCompletion servertransport.cpp:2235 4072 W The requested resource is in use.] completion:0 ptr:000000000D411160
i've tried everything i can think from disabling the AV to completely deleting this folder from the namespace, copying all the files to a new hard disk and starting again with a new folder in the namespace,
but i still receive the same error.
All other folders replicating from this server are still working and replicating correctlyHi,
Please create a Diagnostic Report for DFS Replication to see if there is any error message.
http://technet.microsoft.com/en-us/library/cc754227.aspx
Install latest DFSR hot fixes and adjust the DFSR tuning settings to improve the replication performance and improve the network connection condition to check the result.
Regards,
Mandy
If you have any feedback on our support, please click
here .
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
DFS Replication for one group only not working
I have 2 DFS Replication groups and each group contains the same 2 member servers.
One group is set to replicate one drive pair between these members, and the other group is set to replicate another drive pair between the same member servers.
Replication works perfectly for one group / folder, but it does not even start on the other group.
This proves that there is no problem with the connectivity between the members, or to the AD.
The DFS Replication Health Report for the group that does not replicate shows no error, just 2 Warnings:
WARNINGS (2 servers with warnings)(Show All)
BOG-RODC (1 warning)
Reference member returned no replicated folders.
MTL-HV-FS01 (1 warning)
This member is waiting for initial replication for replicated folder BOG-RODC_D_Drive.
This is very weird, I don't see why it does not replicate, I'm pooling my hair out. Please help
Titusfollow up on the above issue: Yes I did delete the group, and DFSRPrivate folder and recreated the group again, but this did not help.
Problem has been fixed by Microsoft, I had to open a case with them. Apparently the Jet database that's hidden in the "System Volume Information" was corrupted, so not only he deleted the group, but did the following, changed permissions/ownership
to access the System Volume Information, then:
D:\>cd "System Volume Information"
D:\System Volume Information>cd DFSR
D:\System Volume Information\DFSR>dir
Volume in drive D is Data
Volume Serial Number is F4CD-B05B
Directory of D:\System Volume Information\DFSR
10/10/2014 11:09 AM <DIR> .
10/10/2014 11:09 AM <DIR> ..
10/02/2014 12:01 PM 0 $db_normal$
02/04/2015 10:14 AM <DIR> Config
10/10/2014 10:49 AM <DIR> database_E6F4_CDDD_F4CD_B05B
10/02/2014 12:01 PM <DIR> Private
1 File(s) 0 bytes
5 Dir(s) 1,558,208,782,336 bytes free
D:\System Volume Information\DFSR>rd database_E6F4_CDDD_F4CD_B05B /s /q
D:\System Volume Information\DFSR>dir
Volume in drive D is Data
Volume Serial Number is F4CD-B05B
Directory of D:\System Volume Information\DFSR
02/04/2015 10:20 AM <DIR> .
02/04/2015 10:20 AM <DIR> ..
10/02/2014 12:01 PM 0 $db_normal$
02/04/2015 10:19 AM <DIR> Config
10/02/2014 12:01 PM <DIR> Private
1 File(s) 0 bytes
4 Dir(s) 1,558,344,138,752 bytes free
Then as usually recreated the replication group. I haven't seen this information anywhere on the web or in the Microsoft site.
Hope this will help other people having the same problem as myself. Proceed with care. -
User Profile Disks and DFS replication
We're looking to replace a single, heavily used 2003 TS server--for performance, feature, and capacity reasons. Our users frequently have small amounts of data on their desktops/settings that we'd to persist between sessions, and they tend to have
long-running sessions (disconnecting and reconnecting while traveling, but not logging off--keeping open apps in the meantime).
The servers were originally purchased intending for 2008R2 SP1 remote desktops services, with lots of fast internal (RAID 5, 12x300GB 15K) storage. We're considering the option of using 2012 (virtual sessions, not virtual desktops) so that we can scale
out as we grow--and use the User Profile Disks.
Ideally, we'd like to maximize the usefulness of the purchased servers (and their internal storage), and not have to purchase additional hardware for shared storage--(iSCSI/External array that can be clustered). We're wondering if it's possible to pair
the User Profile Disks (UPD) with DFS replication (possibly over a dedicated NIC). Then, a user could log in to server X, connect to her local UPD (with the changes replicating to server Y's copy). If she disconnected/reconnected, the RD connection broker
would connect her to back to her existing session, and if she logs off and back on, she could connect to either server X or Y and it would all work. For maintenance, we'd be able to drainstop one server via the connection broker, perform the maintenance,
let DFS catch up, and then do the same on the second server.
Would something like this be possible? Or is it just asking for major problems?Hi,
Thank you for your question.
I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.
Thank you for your understanding and support.
If you have any feedback on our support, please click
here
Cataleya Li
TechNet Community Support -
DFSR Event 5014 - DFS Replication service is stopping communication
Hi,
I seem to be having issues with the DFSR warnings in the event log. I receive the below warning every 5 minutes:
"The DFS Replication service is stopping communication with partner 'Servername' for replication group Domain System Volume due to an error. The service will retry the connection periodically.
Additional Information:
Error: 1726 (the remote procedure call failed.)"
The errors are immediately followed by an information entry (5004) stating that a connection was successfully established but then the warning repeats after 5 minutes again. Replication does actually seem to be working fine and the SYSVOL shares on both
domain controllers are identical.
I have run diagnostic reports from the DFS Management snapin and the only error reported is that
"The DFS Replication service is restarting frequently".
I have disabled TCP Offloading on the server as per other suggestions which doesn;t seem to have made a difference.
For reference, the domain controllers are in separate sites connected via site-to-site VPN. The AD sites are configured with the correct subnets and the WAN/VPN connection seems stable as I am getting consistent 87ms ping responses.
Any assistance would be greatly appreciated.
Thanks,
Charlie.Although I haven't specifically run into this, doing a Bing search I have seen a common theme that if there is a firewall between the two it drops the connection after a set period of inactivity. You might want to investigate that possibility.
http://faultbucket.ca/2011/02/dfsr-event-5014-the-remote-procedure-call-failed/
http://social.technet.microsoft.com/Forums/windowsserver/en-US/68c4f402-6c77-4388-9701-51a4fc112964/error-1726-the-remote-procedure-call-failed-every-7-minutes-dfsr-backlogs?forum=winserverDS
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs
http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup. This posting is provided "AS IS" with no warranties, and confers no rights. -
How to check DFS replication status in windows 2008 r2 file server
Hi,
I have created File server DFS namespace between 2 windows 2008 R2 server. namespace mode is 2008. I have copied 3 TB data on file server 1. now it is getting replicated from file server 1 to file server 2. till now the data is not fully replicated.
My question is how can I check the status of DFS replication? how will I come to know that the initial replication is completed.Scorpio. Yes you are right. Microsoft officially says it will not work. My apologies. Thanks for the correction.
Do Ultrasound and Sonar work with DFS Replication?
No. DFS Replication has its own set of monitoring and diagnostics tools. Ultrasound and Sonar are only capable of monitoring FRS.
Is there a way to know the state of replication?
Yes. There are a number of ways to monitor replication:
DFS Replication has a management pack for System Center Operations Manager 2007 that provides proactive monitoring.
DFS Replication has an in-box diagnostic report for the replication backlog, replication efficiency, and the number of files and folders in a given replication group.
Dfsrdiag.exe is a command-line tool that can generate a backlog count or trigger a propagation test. Both show the state of replication. Propagation shows you if files are being replicated to all nodes. Backlog shows you how many files still need to replicate
before two computers are in sync. The backlog count is the number of updates that a replication group member has not processed. On computers running Windows Server 2008 R2, Dfsrdiag.exe can also display the updates that DFS Replication is currently
replicating.
Scripts can use WMI to collect backlog information—manually or through MOM.
Miguel Fra /
Falcon IT Services
Computer & Network Support, Miami, FL
Visit our Knowledgebase and Support Sharepoint Site
Maybe you are looking for
-
How do you save a GarageBand project with an iLife Preview?
I have save with iLife preview checked in GarageBand General settings. The only way I know how is to open iMovie, select the song and press the spacebar, and have it open GarageBand to save it there. the problem with this is that I've edited my songs
-
Uploading of large amount of data
Hi all, i really hope you can help me. I have to upload quite large amount of data from flat files to ODS (via PSA of course). But the process takes very long time. I used method of loadin to PSA and then packet by packet into ODS. Loading of cca 1.3
-
3D graph plot properties - cannot be changed
Hi all, I still cannot change the plot properties of the 3D graph. I open the Plot Properties tab up and it gets stuck on the first page. This means that I cannot release any VIs which use the 3D graph - a big problem. Has anyone else experience thi
-
Error when creating frame 2035 (error -1) - Exporting Issue!
I've just been working on an English assignment for the weekend using Final Cut Pro X, and when it's exporting it gets this error: "The operation could not be completed because an error occurred when creating frame 1796 (error -1)." I then cannot ope
-
IP4500 DVD Top Printing - Colours WRONG - Driver Issue or what?
OS10.5.5 QT 7.5.5 I have a Canon IP4500, it worked well for some time printing DVD TOPS. I used Verbatim inkjet printble matte, (& sometimes gloss), white tops, the results have always been excellent. I use DISCUS to design and print my tops. The pri