Synchronization of redundant Domain Controller

Hello everyone,
I have a question about synchronization of a redundant Domain Controller.
We have a pair of DC and they are placed in different buildings. The question is, what happens if the network connection between the buildings gets disconnected for a longer time, e.g. because of construction work.
How long can they be isolated before they are not able to synchronize again, when the connections gets back?
Thanks in advance!

Is this the right setup?
Yes it is correct. I would go with 127.0.0.1 for 'Alternate DNS server'.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Similar Messages

Redundant domain controller DNS settings

Hi guys,
We have two domain controllers, both DNS and GC. I am curious as to what the recommended IP DNS settings should be for both DCs? I think it is like this...
DC1
DNS1 - DC2
DNS2 - DC1
DC2
DNS1 - DC1
DNS2 - DC2
Is this the right setup?
Thanks
Aaron

Is this the right setup?
Yes it is correct. I would go with 127.0.0.1 for 'Alternate DNS server'.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Script for synchronizing the clock with Domain Controller

Hi Everyone,
In our environment, we have Mac machines which are joined to window's domain. Once in while machine will not log on to domain because the OS clock had a different time than the domain controller and sooner you fix the clock, machine will start communicating with domain controller.
I was wondering if there is an easier way to do this using script which can run every few hours to force the OS clock to synchronize with the domain controller.
Thanks,

You don't need an Applescript to do that.
Enable the NTP server on the Windows Domain Controller (perhaps start here: http://technet.microsoft.com/en-us/library/cc773013.aspx).
Then setup the Macs to use NTP (Network Time) to sync to the domain controller.

Windows 2008 R2 Domain Controller (PDC) - NTP server - time showing local CMOS clock

I'm having issues setting an external source on a Windows 2008 R2 domain controller (PDC emulator role for the domain)
Here is the output showing its source is the Local CMOS clock.
C:\Windows\System32>w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 1 (primary reference - syncd by radio clock)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0000000s
Root Dispersion: 10.0000000s
ReferenceId: 0x4C4F434C (source name: "LOCL")
Last Successful Sync Time: 06/11/2014 15:44:15
Source: Local CMOS Clock
Poll Interval: 6 (64s)
1) I have performed the following on the DC with the PDC role:
net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org"
w32tm /config /reliable:yes
net start w32time
w32tm /query /configuration
[Configuration]
EventLogFlags: 2 (Local)
AnnounceFlags: 5 (Local)
TimeJumpAuditOffset: 28800 (Local)
MinPollInterval: 6 (Local)
MaxPollInterval: 10 (Local)
MaxNegPhaseCorrection: 172800 (Local)
MaxPosPhaseCorrection: 172800 (Local)
MaxAllowedPhaseOffset: 300 (Local)
FrequencyCorrectRate: 4 (Local)
PollAdjustFactor: 5 (Local)
LargePhaseOffset: 50000000 (Local)
SpikeWatchPeriod: 900 (Local)
LocalClockDispersion: 10 (Local)
HoldPeriod: 5 (Local)
PhaseCorrectRate: 7 (Local)
UpdateInterval: 100 (Local)
[TimeProviders]
NtpClient (Local)
DllName: C:\Windows\System32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
AllowNonstandardModeCombinations: 1 (Local)
ResolvePeerBackoffMinutes: 15 (Local)
ResolvePeerBackoffMaxTimes: 7 (Local)
CompatibilityFlags: 2147483648 (Local)
EventLogFlags: 1 (Local)
LargeSampleSkew: 3 (Local)
SpecialPollInterval: 3600 (Local)
Type: NTP (Local)
NtpServer: 0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org (Local)
NtpServer (Local)
DllName: C:\Windows\System32\w32time.DLL (Local)
Enabled: 1 (Local)
InputProvider: 0 (Local)
AllowNonstandardModeCombinations: 1 (Local)
VMICTimeProvider (Local)
DllName: C:\Windows\System32\vmictimeprovider.dll (Local)
Enabled: 1 (Local)
InputProvider: 1 (Local)
But still showing the output:
C:\Windows\System32>w32tm /query /status
Leap Indicator: 0(no warning)
Stratum: 1 (primary reference - syncd by radio clock)
Precision: -6 (15.625ms per tick)
Root Delay: 0.0000000s
Root Dispersion: 10.0000000s
ReferenceId: 0x4C4F434C (source name: "LOCL")
Last Successful Sync Time: 06/11/2014 15:58:45
Source: Local CMOS Clock
Poll Interval: 6 (64s)
2. If I resync and rediscover the following error appears:
w32tm /resync /rediscover
Sending resync command to local computer
The computer did not resync because no time data was available.
3. I've also clearing the current time config, by
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
But no change, it still shows the Local CMOS clock.
4. This event is showing
Log Name: System
Source: Microsoft-Windows-Time-Service
Date: 06/11/2014 15:43:30
Event ID: 12
Task Category: None
Level: Warning
Keywords:
User: LOCAL SERVICE
Computer: domaincontroller1
Description:
Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the AD PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source.
It is recommended that you either configure a reliable time service in the root domain, or manually configure the AD PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy.
If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Time-Service" Guid="{06EDCFEB-0FD0-4E53-ACCA-A6F8BBF81BCB}" />
<EventID>12</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2014-11-06T15:43:30.465619200Z" />
<EventRecordID>77295</EventRecordID>
<Correlation />
<Execution ProcessID="256" ThreadID="2056" />
<Channel>System</Channel>
<Computer>domaincontroller1</Computer>
<Security UserID="SID" />
</System>
<EventData Name="TMP_EVENT_DOMAIN_HIERARCHY_ROOT">
</EventData>
</Event>
5. If I perform the below it appears DC2 is having problems but I'm not sure if related.
C:\w32tm /monitor
DC1.domain.local *** PDC ***[192.168.1.1:123]:
ICMP: 0ms delay
NTP: +0.0000000s offset from DC1.domain.local
RefID: 'LOCL' [0x4C434F4C]
Stratum: 1
DC2.domain.local[192.168.1.2:123]:
ICMP: 0ms delay
NTP: -110.4925481s offset from DC1.domain.local
RefID: (unspecified / unsynchronized) [0x00000000]
Stratum: 0
DC3.domain.local[192.168.2.1:123]:
ICMP: 0ms delay
NTP: -0.0256084s offset from DC1.domain.local
RefID: DC1.domain.local [192.168.1.1]
Stratum: 2
DC4.domain.local[192.168.2.4:123]:
ICMP: 0ms delay
NTP: -0.0011524s offset from DC1.domain.local
RefID: 80.84.77.86.rev.sfr.net [86.77.84.80]
Stratum: 2
Warning:
Reverse name resolution is best effort. It may not be
correct since RefID field in time packets differs across
NTP implementations and may not be using IP addresses.
Any help would be much appreciated. Thanks.
Craig Brand

I suspected some issue with AV so uninstalled.
To resolve the Access Denied I followed these steps:
stop w32time
w32tm /unregister
reboot
regsvr32 /u w32time.dll
w32tm /register
sc query w32time -- you should see that the service is set to
shared mode -- this is presumably how it should be -- if you try to start right now, you'll get the expected 1290 SID-related error
reboot
w32time should now automatically start at boot up and be running -- that was my result -- it's running as shared, started on its own, and I can do the w32tm /query commands successfully
After rebooting the time service started.
I then repeated the steps:
net stop w32time
w32tm /config /syncfromflags:manual /manualpeerlist:"0.pool.ntp.org, 1.pool.ntp.org, 2.pool.ntp.org"
w32tm /config /reliable:yes
net start w32time
w32tm /query /configuration
And all worked. I'll wait a short while to see if this fixes the issue. I also have am SA case with MS so will confirm fix when resolved.
Craig Brand

Secondary domain controller not able to connect from work stations.

We are using primary and secondary domain controllers. In which the secondary domain controller act as a replication server. actually the problem occurs while accessing the secondary domain controller from work stations I get the following error:
"The trust relationship between this workstation and the primary domain failed".
Any one please give as a solution.
Thank you.

Hi,
Most simple resolution would be unjoin/disjoin the computer from the domain and rejoin the computer account back to the domain.
There might be multiple reasons for this kind of behavior.
Here are a few of them:
Single SID has been assigned to multiple computers.
If the Secure Channel is Broken between Domain controller and workstations
If there are no SPN or DNS Host Name mentioned in the computer account attributes
Outdated NIC Drivers.
According your description, the second one may be the cause of your problem.
When a Computer account is joined to the domain, Secure Channel password is stored with computer account in domain controller. By default this password will change every 30 days (This is an automatic process, no manual intervention is required).
Upon starting the computer, Netlogon attempts to discover a DC for the domain in which its machine account exists. After locating the appropriate DC, the machine account password from the workstation is authenticated against the password on the DC.
If there are problems with system time, DNS configuration or other settings, secure channel’s password between Workstation and DCs may not synchronize with each other.
A common cause of broken secure channel [machine account password] is that the secure channel password held by the domain member does not match that held by the AD. Often, this is caused by performing a Windows System Restore (or reverting
to previous backup or snapshot) on the member machine, causing an old (previous) machine account password to be presented to the AD.
Follow below link which explains typical symptoms when Secure channel broken,
Typical Symptoms when secure channel is broken
http://blogs.technet.com/b/asiasupp/archive/2007/01/18/typical-symptoms-when-secure-channel-is-broken.aspx
For detailed information, please refer to the link below,
Troubleshooting AD: Trust Relationship between Workstation and Primary Domain failed
http://social.technet.microsoft.com/wiki/contents/articles/9157.troubleshooting-ad-trust-relationship-between-workstation-and-primary-domain-failed.aspx
Hope this helps.
Steven Lee
TechNet Community Support

[Forum FAQ] How to sync time with a Domain Controller for a standalone server

As we all known, if a computer belongs to an Active Directory domain, it will sync the time automatically by using the Windows Time service that is available on Domain Controllers.
While a standalone server will synchronize with its local hardware time and Windows time server. (Figure 1)
Figure 1.
Under some circumstances, a standalone server is necessary in a product environment. We can sync the time of this standalone server with the Domain Controller using
the steps below:
1. Modified the value of the AnnounceFlags:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config
Under this entry we can see the default value of AnnounceFlags is 10 (Decimal), we configure the value as 5 (Decimal). (Figure 2)
Figure 2.
2. Confirm the value of the registry key below is set to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer
Figure 3.
3. Configure the standalone server to synchronize with a specific time source (Domain Controller).
In our test, we configured our Domain Controller (192.168.10.200) as the time source. Used the following commands:
w32tm /config /syncfromflags:manual /manualpeerlist:192.168.10.200
4. Sync the time with the Domain Controller using the command below:
w32tm /config /update
From the figure below (Figure 4), you can see the after we did all the steps above, the time on the standalone server was synced with the Domain Controller.
Figure 4.
(Note: Peerlist is a separated list of DNS servers, or IP Addresses for the time servers)
More information:
Windows Time Service Tools and Settings
http://technet.microsoft.com/en-us/library/cc773263(WS.10).aspx#w2k3tr_times_tools_dyax
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Thank you for the instruction! I am sure it is one of the scenarios that majority of administrators will run into. So I suggest to write a wiki about it and publish it for this month's TechNet Guru in Windows Server section. This month's TechNet Guru can
be found here:
Calling All Wise Men! Windows
Server Gurus Needed! Apply Within! No One Turned Away!
Thanks for your informative post. :)
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Version number for GPO's not in sync with the version number for GPO's on the Baseline domain controller

Hi
I accidentally removed one of our domain controller's hyper-v image (DC-02) from the hyper-v manager and to bring it back online launched a new virtual machine using the same virtual hard drive. This brought back the domain controller machine and I set the
original IP address to the same assuming that everything would just working fine.
Sadly, that wasn't the case as when I tried to open the group policy manager on that machine I started getting "Access is denied" error. I was then presented with an option to open the group policy manager with the first available DC which I did
and was able to open it with showing the same machine as the baseline domain controller under the status tab (DC-01 is actually the baseline DC). I then clicked Detect now and noticed it was showing 1 DC under replication in progress with problems in GPO version.
I then did the same thing on the primary DC (DC-01) and even there it was showing this only (images attached).
So I started exploring over the internet going through various articles but couldn't find a solution which I could apply without worrying about corrupting something somewhere. I also went to the SYSVOL folder on both the DC's to check the version number
in GPT.ini files which are mentioned below:
\\CC-DC01\sysvol\cloudchowk.lab\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
[General]
Version=3
\\CC-DC01\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
[General]
Version=5439513
\\cc-dc02\SYSVOL\cloudchowk.lab\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
[General]
Version=3
\\cc-dc02\SYSVOL\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
[General]
Version=5308439
Could anyone please help me sort this out? I am no system admin and whatever knowledge I have of setting up DC, AD etc is from following one article or the other over the internet.
Regards
Sajat Jain

Hi
Apologies for responding late. I followed through all the points mentioned by Frank and even did a non-authoritative restore synchronization but still no luck.
I am attaching the output from the dcdiag /q and the from the event viewer after doing to non-authoritative restore synchronization.
DCDIAG /Q
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
......................... CC-DC03 failed test DFSREvent
Unable to connect to the NETLOGON share! (\\CC-DC03\netlogon)
[CC-DC03] An net use or LsaPolicy operation failed with error 67,
The network name cannot be found..
......................... CC-DC03 failed test NetLogons
An error event occurred. EventID: 0x0000164A
Time Generated: 01/18/2015 17:52:17
Event String:
The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
An error event occurred. EventID: 0x0000164A
Time Generated: 01/18/2015 17:54:12
Event String:
The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 17:54:41
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 17:55:42
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 17:59:41
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 18:04:42
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x0000164A
Time Generated: 01/18/2015 18:05:10
Event String:
The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\cloudchowk.lab\SCRIPTS. The following error occurred:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 18:09:42
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 18:14:42
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 18:19:43
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
An error event occurred. EventID: 0x00000422
Time Generated: 01/18/2015 18:24:43
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\cloudchowk.lab\sysvol\cloudchowk.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
......................... CC-DC03 failed test SystemLog
EVENT VIEWER LOGS
The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and is waiting to perform initial replication. The replicated folder will remain in the initial synchronization state until it has replicated with its partner CC-DC01.cloudchowk.lab. If the server was in the process of being promoted to a domain controller, the domain controller will not advertize and function as a domain controller until this issue is resolved. This can occur if the specified partner is also in the initial synchronization state, or if sharing violations are encountered on this server or the synchronization partner. If this event occurred during the migration of SYSVOL from File Replication service (FRS) to DFS Replication, changes will not replicate out until this issue is resolved. This can cause the SYSVOL folder on this server to become out of sync with other domain controllers.
Additional Information:
Replicated Folder Name: SYSVOL Share
Replicated Folder ID: 4689406D-D6D8-49E0-8079-2B1D4AE61BC6
Replication Group Name: Domain System Volume
Replication Group ID: 6B162096-2EFA-4D4C-BF13-62CC5B112B97
Member ID: 566943F9-D2FB-4304-823D-10DC972F831A
Read-Only: 0
Should I just start over again by removing DC03 and setting up another DC?
Regards
Sajat Jain

W32tm always on "Local CMOS clock" on virtual domain controller - cannot change to NTP server

The domain controller (Server 2012R2) is hosted on Hyper-V (Server 2012R2). It is a PDC.
- firewall disabled
- cleaned up w32tm:
net stop w32time
w32tm /unregister
w32tm /register
net start w32time
- applied ifixit from http://support.microsoft.com/kb/816042 to enable external ntp server de.pool.ntp.org
- disabled
VMICTimeProvider in registry
(HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\VMICTimeProvider\Enabled = 0)
I can manually query the ntp server de.pool.ntp.org:
w32tm /stripchart /computer:de.pool.ntp.org /samples:5 /dataonly
de.pool.ntp.org wird verfolgt [131.188.3.221:123].
5 Proben werden gesammelt.
Es ist 24.04.2014 10:07:36.
10:07:36, +00.0115379s
10:07:38, -00.0025048s
10:07:40, -00.0008595s
10:07:42, -00.0010477s
10:07:44, -00.0014516s
But still, w32tm does NOT query the ntp server:
PS C:\Windows\system32> w32tm /query /source
Local CMOS clock
rosch

Hi rosch,
Based on your description, please check if disable the "Time synchronization" Integration service. Please refer
to the following operation.
In Hyper-V Manager, right click the DC and select “Settings…”.
In the left panel of Settings, navigate to Integration Services and click it.
Then in the right panel, please uncheck Time synchronization.
By the way, please check if can connect to the time server and UDP port was opened for NTP.
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu

Weblogic on Unix, authenticating users/groups from NT domain controller

Hi!
Our weblogic 6.1 server will eventually run on a non-windows platform, but
needs to authenticate users from a Windows NT 4.0 domain controller. What's
the best solution to this?
- What (inexpensive) LDAP-servers supports synchronization with a Windows
domain controller?
- Or am I missing out on other ways of doing this?
jan henrik

Yes. Other instrinsic jobs are failed too. Does this related to Job Dispatcher service? Thank you for your help.

Charm: No Domain Controller for SB5

Hi,
I configured Charm in solution Manager 4.0, created a satellite system SB5 in smsy and run the batch to get the info to charm. now i have it in /tmwflow/cmsconf but when i synchronize the project in solar_admin_project we get the error No Domain Controller for SB5.
The STMS is configured correctly in SB5
The RFC dests are OK also from SMSY i can see the dommain controller without any problem and distribution routes also.
Any advise
Thanks
Ahmed

Thanks Pascal,
I was able to fix the problen but adding a domain link between solution manager and satellite systems.
Ahmed

PrepareDomain should it modify the Domain Controller Policy?

I have Exchange 2010 installed with two servers in a DAG. I recently ran into a problem were two of the domain controllers were down and had to reboot both Exchange servers. Exchange would not come back online because of the missing SACL right
on the other domain controllers.
http://blogs.technet.com/b/richardroddy/archive/2010/06/16/msexchange-adaccess-dsaccess-errors-and-the-manage-auditing-and-security-right.aspx
I went ahead and ran exchange "setup /preparedomain" and I was able to get my DAG running again but when I check the "Default Domain Controllers Policy" it is not modified to allow the "Exchange Servers" group manage auditing
and security log like I would expect it to. There are no errors but it only modified the local domain controller policy. So I would have to run this on every domain controller.

Hi,
According to your description, it seems like DC replication issue.
I recommend you refer to the follwoing article to force sync manually:
Force Replication Between Domain Controllers
You can use this procedure to force Active Directory replication to occur between two domain controllers on a one-time basis when you want changes to be replicated from the server that received the changes to a server in another site sooner than the
site link schedule allows. As an alternative, you can synchronize replication with all replication partners.
Thanks.
Niko Cheng
TechNet Community Support

Better to virtualize domain controller?

I don't pretend to know much about this other than a very basic understanding, so please bear with me.
We've purchased a new server that we'll be using exclusively for hosting RDP for two clients. Each client will have their own virtual server. We're struggling a bit though trying to decide where to put the domain controller.
There are two things we're considering:
1. The physical server runs ONLY a Hyper V role doing nothing else and we load up a 3rd virtual server that will act as the domain controller for the other 2 virtuals.
or
2. The physical server runs runs the Hyper V AND acts as the domain controller.
The guy loading up the box is suggesting the first option. It seems to me, however, that we're adding another level of "stuff" with the domain controller being a virtual rather. My thinking is that everything has to eventually go out through the
operating system on the physical machine. Making the domain controller another virtual rather than the operating system on the physical box, adds another step where things have to go through the virtual DC THEN out to the physical box.
One of the arguments for the 1st scenario is that we can allocate resources to it more easily if the domain controller is virtual. I also like the fact that if the domain controller goes to crap, its just one file that needs to be restored and we're up again.
He also brought up the fact that the virtual DC could be restarted (after updates, for instance) without having to shut down the other 2 virtuals. Whereas if the DC is loaded on the physical box then the other two viruals would have to be shut down before
a restart of the DC could occur. However, I'm not sure that stuff outweighs any performance loss that might occur going through (what I'm perceiving as) the extra step of a virtual DC.
Any insights would be GREATLY appreciated.
Thank you,
Ken

Gosh Chris, thanks for all the information and insight.
I want to configure virtual domain controllers and a file server. Based on your discussion, here's my plan--
Host 1:
1 disk (not connected to RAID controller) for host / management OS
running Hyper-V Server core (free) or Server 2012 core
remaining disks configured into RAID array for virtual machines
Virtual Disk 1 - Server 2012 OS Domain Controller - root of forest
Virtual Disk 2 - shared files
Host 2:
Host / management OS is either Hyper-V Server or Server 2012
Virtual domain controller - replicating with Host 1 domain controller through Active Directory
Software requirements:
2 licenses of Server 2012
1 license of Windows 8 (for management workststation)
Hardware requirements:
2 servers
1 management workstation
Desired outcome for redundancy:
In the event Host 1 went off-line either because of Bad Things happening or hardware upgrades, Host 2 could step in and serve as domain controller. Further, I could reattach the virtual disk from Host 1 to Host 2. If Host 1
virtual disks are not available, I could restore the shared files virtual disk file from a backup of Host 1 / Virtual Disk 2 to Host 2.
Concerns:
1) Whether to put the hosts in the domain.
Excellent article at from the Virtual PC Guy blog at blogs.msdn.com on the "The Domain Controller Dilemma. With one administrator and a small network, it seems easy enough to create a workgroup for Host 1 and Host 2, and create local administrator accounts
for each hosts.
2) Windows 8 Client Hyper-V for management.
I would use another workstation running Windows 8 with Client Hyper-V. Would I have access to Host 1, Host 2, and their associated virtual machines? If I had access to Host 1 / Virtual Disk 2 (the shares on the file server), could I attach it to Host 2's
virtual machine?
Any holes or gotchas?
Thanks.

Upgrading windows server 2003 domain controller to windows server 2008

Hello friedns :
We have a company with about 2000 users , and two windows server 2003 domain controllers , one of them acts as a primary domain controller , and the other acts as secondary domain controller , all the FSMO s are on the primary DC ,we have decided to upgrade all of our servers from windows server 2003 to windows server 2008 , the first step is to upgrade the domain controllers to windows server 2008 , our domain controllers are so sensitive and has to be active 24 hours a day , i have stress upgrading it to windows server 2008 , what is the best solution to upgrade it with no risk ?
( i have an opinion but i am not sure and i dont have any guide about it , i want to install a windows server 2008 and promote it as an additional domain controller to the windows server 2003 DC and the transfer all the FSMOs to it , and then promote the first domain controller !!! is that possible ? if yes , is there any guide about it? )
If there is a guide available for it please let me know . (Specially if there is a tip & trick)
thank you guys.
Network is my LOVE

Hi,
This TechNet online article might be helpful for you.
How to Upgrade Domain Controllers to Windows Server 2008 or Windows Server 2008 R2
http://technet.microsoft.com/en-us/library/ee522994(WS.10).aspx
For your convenience, I have list some general steps for your reference.
Since the following operation have potential damage to Active Directory database, it is highly suggested that you'd better perform a full backup of Active Directory (System State) firstly. Also it is better to test the following procedure in a similar lab environment first.
General Steps:
=============
1. Verify the new server's TCP/IP configuration has been pointed to the current DNS server.
2. Make the new server become a member server of the current Windows Server 2003 domain first.
3. Upgrade the Windows Server 2003 forest schema to Windows Server 2008 schema with the "adprep /forestprep" command on old server.
Please run the "adprep.exe /forestprep" command from the Windows Server 2008 installation disk on the schema master. To do this, insert the Windows Server 2008 installation disk, and then type the following command:
Drive:\sources\ADPREP\adprep.exe /forestprep
4. Upgrade the Windows 2003 domain schema with the "adprep /domainprep" command on old server.
Please run the "adprep.exe /domainprep" command from the Windows Server 2008 installation disk on the infrastructure master. To do this, insert the Windows Server 2008 installation disk, and then type the following command:
Drive:\sources\ADPREP \adprep.exe /domainprep
5. Insert Windows Server 2008 Installation Disc in the new server.
6. Run "dcpromo" on new server to promote it as an additional domain controller in existing Windows 2003 domain, afterwards you may verify the installation of Active Directory.
Please refer to:
How to Verify an Active Directory Installation in Windows Server 2003
http://support.microsoft.com/kb/816106
7. Verify the new server's TCP/IP configuration has been pointed to current DNS server.
8. Enable Global Catalog on new server and manually Check Replication Topology and afterwards manually trigger replication (Replicate Now) to synchronize Active Directory database between 2 replicas.
Please note: It will some time to replicate GC between DC, please wait some time with patience.
9. Disable Global Catalog on the old DC.
10. Transfer all the FSMO roles from the old DC to the new DC.
Please refer to:
How to view and transfer FSMO roles in Windows Server 2003
http://support.microsoft.com/kb/324801
11. Verify that the old DNS Server Zone type is Active Directory-Integrated. If not, please refer to:
How To: Convert DNS Primary Server to Active Directory Integrated
http://support.microsoft.com/kb/816101
Note: Active Directory Integrated-Zone is available only if DNS server is a domain controller.
12. Install DNS component on new server and configure it as a new DNS Server (Active Directory Integrated-Zone is preferred). All the DNS configuration should be replicated to the new DNS server with Active Directory Replication.
13. Make all the clients change TCP/IP configuration to point to new server as DNS.
14. You may configure TCP/IP on all the clients, or adjust DHCP scope settings to make them use the new DNS server.
Please note: It is a good practice to make the old DC offline for several days and check whether everything works normally with the new server online. If so, you may let the old DC online and run DCPROMO to demote it.
Hope it helps.
Regards,
Wilson Jia
This posting is provided "AS IS" with no warranties, and confers no rights.

Running domain controller as VMs on a hyper-v 2012 cluster

Hi gurus
I have a question. I want to run two VMs on a Hyper-v cluster. I want to make these VMs as domain controller and leverage the cluster. Can I do this? I have not been able find any information on this. The hyper-v is running on windows 2012, but it can be
upgraded to R2 if there are any benefits associated with this.
Any help will be appreciated.
Regards

Hi,
Additional, you can deploy your DC on failover cluster, but we recommend that your clustered servers be member servers. If they are, you need an additional server that acts
as the domain controller in the domain that contains your failover cluster.
And same time, you should attempt to avoid creating potential single points of failure when you plan your virtual domain controller deployment. You can avoid introducing potential
single points of failure by implementing system redundancy. For example, consider the following recommendations while keeping in mind the potential for increases in the cost of administration:
1. Run at least two virtualized domain controllers per domain on different virtualization hosts, which reduces the risk of losing all domain controllers if a single virtualization
host fails.
2. As recommended for other technologies, diversify the hardware (using different CPUs, motherboards, network adapters, or other hardware) on which the domain controllers
are running. Hardware diversification limits the damage that might be caused by a malfunction that is specific to a vendor configuration, a driver, or a single piece or type of hardware.
3. If possible, domain controllers should be running on hardware that is located in different regions of the world. This helps to reduce the impact of a disaster or failure
that affects a site at which the domain controllers are hosted.
4. Maintain physical domain controllers in each of your domains. This mitigates the risk of a virtualization platform malfunction that affects all host systems that use that
platform.
The related KB:
Hyper-V: Using Hyper-V and Failover Clustering
http://technet.microsoft.com/es-es/library/cc732181(v=ws.10).aspx
Running Domain Controllers in Hyper-V
http://technet.microsoft.com/en-us/library/d2cae85b-41ac-497f-8cd1-5fbaa6740ffe(v=ws.10)#usn_and_usn_rollback
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Server 2012 Domain Controller Logging event 2004, with error "crc check"...

Pretty new domain, and domain controller, running server 2012 as a Hyper-V VM.
Getting this error when it reboots. I have done a chkdsk, thinking maybe the vhdx file is corrupt in some way. Have also checked the system log for events talking about file corruption. Nothing.
The disk in question has 10+ GB free, so disk space is not an issue. I ran dcdiag /q /a & it told me that DFSR has logged events in the last 24 hours, but nothing else. AD seems to think everything is cool.
Not sure what to look at next... Thanks for any pointers/help.
The DFS Replication service stopped replication on volume C:. This failure can occur because the disk is full, the disk is failing, or a quota limit has been reached. This can also occur if the DFS Replication service encountered errors while attempting to
stage files for a replicated folder on this volume.
Additional Information:
Error: 23 (Data error (cyclic redundancy check).)
Volume: 0F55C346-589F-11E2-93EB-806E6F6E6963

I have a series of the following Events logged, and then the 2nd event. The 2nd event is being logged every 8 hours.
Log Name:      DFS Replication
Source:        DFSR
Date:          2/15/2013 7:36:49 AM
Event ID:      2212
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      MyDC.Domain.lan
Description:
The DFS Replication service has detected an unexpected shutdown on volume C:. This can occur if the service terminated abnormally (due to a power loss, for example) or an error occurred on the volume. The service has automatically initiated a recovery process.
The service will rebuild the database if it determines it cannot reliably recover. No user action is required.
Additional Information:
Volume: C:
GUID: 0F55C346-589F-11E2-93EB-806E6F6E6963
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="DFSR" />
    <EventID Qualifiers="32768">2212</EventID>
    <Level>3</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-14T23:36:49.000000000Z" />
    <EventRecordID>196</EventRecordID>
    <Channel>DFS Replication</Channel>
    <Computer>MyDC.domain.lan</Computer>
    <Security />
</System>
<EventData>
    <Data>0F55C346-589F-11E2-93EB-806E6F6E6963</Data>
    <Data>C:</Data>
</EventData>
</Event>
Log Name:      DFS Replication
Source:        DFSR
Date:          2/15/2013 7:36:49 AM
Event ID:      2004
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      MyDC.Domain.lan
Description:
The DFS Replication service stopped replication on volume C:. This failure can occur because the disk is full, the disk is failing, or a quota limit has been reached. This can also occur if the DFS Replication service encountered errors while attempting to
stage files for a replicated folder on this volume.
Additional Information:
Error: 23 (Data error (cyclic redundancy check).)
Volume: 0F55C346-589F-11E2-93EB-806E6F6E6963
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="DFSR" />
    <EventID Qualifiers="49152">2004</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-02-14T23:36:49.000000000Z" />
    <EventRecordID>197</EventRecordID>
    <Channel>DFS Replication</Channel>
    <Computer>MyDC.Domain.lan</Computer>
    <Security />
</System>
<EventData>
    <Data>0F55C346-589F-11E2-93EB-806E6F6E6963</Data>
    <Data>C:</Data>
    <Data>23</Data>
    <Data>Data error (cyclic redundancy check).</Data>
</EventData>
</Event>

Synchronization of redundant Domain Controller

Similar Messages

Maybe you are looking for