WHEN should I seize FSMO roles - disaster recovery

Hi all-
I have two DCs in a single AD forest.  DC1 is at Site A and DC2 is at Site B.  The two sites are interconnected by a 20Mbps leased line.
Simple question here for the purposes of disaster recovery:  Let's assume that the DC1 at Site A is destroyed and I have to failover to DC2 at Site B.  Furthermore, assume that DC1 will be replaced within one month.  Under this scenario, should
I seize the FSMO roles at Site B or leave them alone with the understanding that DC1 at Site A will be back up within a month?
What is a reasonable time cutoff point at which the FSMO roles should be seized?  Assume that DC1 will return to AD within a reasonably short time frame.
Thanks.

You should seize the FSMO role as soon as you know that the role is going to be needed before you're finished recovering the server that owns the role. The time before the role is needed depends on the role. For example, Schema master is only needed when
you update schema, which does not happen that often, but RID Master is used every time a new security principal is created in the domain, so you probably should go ahead and seize it as soon as you realize that the failure is catastrophic and a simple restart
of dc won't fix.
Gleb.

Similar Messages

  • FSMO Roles have moved after migration failure

    Hi All
    We tried to migrate our SBS2008 to SBS2011 last night but it failed due to the account we were using not having the 'Logon as Batch' right.
    We managed to recover the server but now we're getting the following error...
    The FSMO Role Check detected a condition in your environment that is out of compliance with the licensing policy. The Management Server must hold the primary domain controller and domain naming master Active Directory roles. Please move the Active Directory
    roles to the Management Server now.
    How do we rectify this?
    Thanks
    ====
    If I run NETDOM QUERY FSMO it all appears fine for all 5 roles but SBS BPA is reporting...
    Title: The FSMO role does not comply with the license policy
    Source: License Compliance service

    Hello ,
    Try the following steps to seize FSMo roles.
    -Click Start, click Run, type ntdsutil in the Open box, and then click OK.
    -Type roles, and then press ENTER.
    -Type connections, and then press ENTER.
    -Type "connect to server servername ", and then press ENTER, where servername is the name of the domain  controller that you want to assign the FSMO role to.
    -At the server connections prompt, type q, and then press ENTER.
    -Type seize "role" ,
    where "role" is the role that you want to seize. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
    -At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
    -if still facing same issue ,please take dcdiag and paste. and Active Directory events.
    -For dcdiag ,run dcdiag /v >dc.txt
    -paste the output of dc.txt.
    All the best.
    Upanshu Anand

  • Disaster Recovery / HA server role count question

    We are currently working on a disaster recovery plan for our on-premise Exchange 2010 environment.  As of today, have a DR Office 365 site is not an option for us.  Our primary datacenter that houses our Exchange 2010 SP3 servers is setup as follows.
    North America
    4 servers (HUB/CAS)
    1 CAS Array (F5 load balanced)
    4 servers (mailbox)
    1 DAG, public/private networks (2 nics)
    2 servers (UM)
    ====================================
    In our secondary datacenter we currently have built out 4 servers, OS Only.  My question is which roles should I place on these servers so that we don't take down our production environment if the secondary site goes offline.  The secondary site
    may go down from time to time for testing and I don't want our production databases to unmount because of quorum and failed votes.
    I was thinking installing HUB/CAS/MB on all 4 and UM on only 1 of them.  Does this work?  I have read through some technet articles about the (n/2) + 1 rule, but need a little more assurance.  Thanks everyone!
    d

    Thanks yea, I used it.  I says if I have 4 mailbox servers in the primary then I should have 4 mailbox servers in the secondary.  Also, not sure if this matters, but we have an even number of databases.  Basically I don't want our pimrary
    databases to dismount if we lose the WAN connection, temporarily, to the secondary site.   Do I need an odd number of databases/servers or is 4 and 4 could for servers and 12 active/passive in the primary and 12 passive in the secondary good.  Thanks
    again for the information, much appreciated.
    d

  • What is the impact on an Exchange server when moving FSMO role and schema master into another DC?

    What is the impact on an Exchange server when moving FSMO role and schema master into another DC? What do we have to do on exchange after performing a such task?
    I had 1 DC (Windows server 2008 R2), 1 Exchange 2010 SP3. I install a new DC (Windows server 2008 R2). I then move all the FSMO role including the schema master role into the NEW DC. I check to be sure that the new DC is a GC as well.
    I shutdown the old DC and my Exchange server was not working properly and specially Exchange Management Shell. It start working again after I turn up the older DC.
    I am wondering why Exchange did not recognize the new DC, even after moving all the roles on it.
    I am looking to hearing from you guys.
    Thanks a lot

    if you only have 1 DC, you might need to cycle the AD Topology service after shutting the one down.
    Also, take a look in the windows logs, there should be an event where Exchange goes to discover Domain Controllers, make sure both are listed there.  You can probably force that by cycling AD topology (this will take all services down so be careful
    when you do it)
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread

  • DCPROMO fails because of FSMO roles...normal solutions not working

    I am trying to remove a 2008 R2 DC from our domain but receive this error:
    "Directory Service is missing mandatory configuration information...unable to determine ownership of floating single-master operation roles"
    In the even log we have this additional error:
    Error:
    Ownership of the following FSMO role is set to a server which is deleted or does not exist.
    Operations which require contacting a FSMO operation master will fail until this condition is corrected.
    FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=lvcinc,DC=local
    FSMO Server DN: CN=NTDS Settings\0ADEL:464a6261-2c82-4ac1-b2b2-144d2e5e1b74,CN=SDOCS1\0ADEL:27fa192a-1f79-4a62-9557-d14ce99406d9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=lvcinc,DC=local
    User Action:
    1. Determine which server should hold the role in question.
    2. Configuration view may be out of date. If the server in question has been promoted recently, verify that the Configuration partition has replicated from the new server recently. If the server in question has been demoted recently and the role transferred, verify that this server has replicated the partition (containing the latest role ownership) lately.
    3. Determine whether the role is set properly on the FSMO role holder server. If the role is not set, utilize NTDSUTIL.EXE to transfer or seize the role. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.
    4. Verify that replication of the FSMO partition between the FSMO role holder server and this server is occurring successfully.
    Steps to try resolving:
    Investigating the above error - it is referencing a Very old DC from a few years ago "SDOCS1". See bold type above.
    1.  Ran DCDiag /v /q on all servers and the only errors we receive are the ones that are manifested due to NOT having run the RODC switch with ADPREP
    (Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
       Replicating Directory Changes In Filtered Set
    access rights for the naming context:
    DC=ForestDnsZones,DC=lvcinc,DC=local
    Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
       Replicating Directory Changes In Filtered Set
    access rights for the naming context:
    DC=DomainDnsZones,DC=lvcinc,DC=local
    ......................... SVHOST2 failed test NCSecDesc
    2.  Checked the location of the FSMO roles and they are all located on our SDC1 server.  I even transferred the Infrastructure FSMO role to a different server and the DCPROMO to remove the server still failed with the same above error.
    3.  Ran through the "Seizing" of the roles specified by this KB:  http://support.microsoft.com/kb/255504.  The server mentioned in the error (SDOCS1) doesn't hold any of the roles and isn't listed in the list of servers
    3.  Went through this KB about removing the metadata of the defunct server:  http://support.microsoft.com/kb/216498.  The server mentioned doesn't exist in any of the locations.
    I'm at a loss as to how to resolve this.  Somewhere the AD Database has a reference to that old server (SDOCS1).  I have looked in all the obvious places in ADSIEDIT and DNS and have found no reference to it.
    I know I can do a force removal of this server (SVHOST2) - but it seems that I need to fix the greater problem of removing the referencen to SDOCS1.
    Thanks for any help for this perplexing issue!
    -David Miller

    I am having a similar problem with our AD structure. My predecessor replaced a failed DC without performing any cleanup afterwards, and my first Monday on the job, our (newer) main AD server corrupted its SAM due to a failed drive and wouldn't login. This
    forced me to seize all the roles from the failing server to a secondary DC which was then promoted as our GC server. I'm in the process of migrating to a virtualized environment, and have promoted the VM AD server (AD1), but it fails to demote the other AD
    server (Zeus) even though all 5 FSMO roles are now held by AD1. I ran through the suggestions earlier in this thread, and found DCDiag
    /v /q  to be most helpful. Piping the results to a text file, I was able to determine that the first failed AD server still exists to some extent in our AD.
          Starting test: KccEvent
             * The KCC Event log test
             A warning event occurred.  EventID: 0x8000082B
                Time Generated: 12/07/2010   09:30:04
                Event String:
                Ownership of the following FSMO role is set to a server which is deleted or does not exist. 
                Operations which require contacting a FSMO operation master will fail until this condition is corrected. 
                FSMO Role: CN=Infrastructure,DC=DomainDnsZones,DC=icucare,DC=local 
                FSMO Server DN: CN=NTDS Settings\0ADEL:b59defe5-ba6e-4db4-a738-b24ffd8281b2,CN=WIN-WOI3YAPEZMC\0ADEL:b08771ed-4884-47b8-9b0c-4f2304279843,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=icucare,DC=local 
    What steps must I take to remove server WIN-W0U3YAPEZMC from our domain? This server no longer exists and I would NEVER give a server a name that I couldn't easily pronounce when discussing it with management :-) I have attempted a metadata cleanup but this
    old server is still showing up in our AD, preventing me from demoting an existing AD server so it can be replaced with a newer, virtualized version.
    Many thanks for your help.
    - Jeff Sepeta, network admin

  • What is the best practice and Microsoft best recommended procedure of placing "FSMO Roles on Primary Domain Controller (PDC) and Additional Domain Controller (ADC)"??

    Hi,
    I have Windows Server 2008 Enterprise  and have
    2 Domain Controllers in my Company:
    Primary Domain Controller (PDC)
    Additional Domain Controller (ADC)
    My (PDC) was down due to Hardware failure, but somehow I got a chance to get it up and transferred
    (5) FSMO Roles from (PDC) to (ADC).
    Now my (PDC) is rectified and UP with same configurations and settings.  (I did not install new OS or Domain Controller in existing PDC Server).
    Finally I want it to move back the (FSMO Roles) from
    (ADC) to (PDC) to get UP and operational my (PDC) as Primary. 
    (Before Disaster my PDC had 5 FSMO Roles).
    Here I want to know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
    In case if Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
    Example like (FSMO Roles Distribution between both Servers) should be……. ???
    Primary Domain Controller (PDC) Should contains:????
    Schema Master
    Domain Naming Master
    Additional Domain Controller (ADC) Should contains:????
    RID
    PDC Emulator
    Infrastructure Master
    Please let me know the best practice and Microsoft best recommended procedure for the placement of “FSMO Roles.
    I will be waiting for your valuable comments.
    Regards,
    Muhammad Daud

    Here I want to know the best practice
    and Microsoft best recommended procedure for the placement of “FSMO Roles both on (PDC) and (ADC)” ?
    There is a good article I would like to share with you:http://oreilly.com/pub/a/windows/2004/06/15/fsmo.html
    For me, I do not really see a need to have FSMO roles on multiple servers in your case. I would recommend making it simple and have a single DC holding all the FSMO roles.
    In case if
    Primary (DC) fails then automatically other Additional (DC) should take care without any problem in live environment.
    No. This is not true. Each FSMO role is unique and if a DC fails, FSMO roles will not be automatically transferred.
    There is two approaches that can be followed when an FSMO roles holder is down:
    If the DC can be recovered quickly then I would recommend taking no action
    If the DC will be down for a long time or cannot be recovered then I would recommend that you size FSMO roles and do a metadata cleanup
    Attention! For (2) the old FSMO holder should never be up and online again if the FSMO roles were sized. Otherwise, your AD may be facing huge impacts and side effects.
    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Get Active Directory User Last Logon
    Create an Active Directory test domain similar to the production one
    Management of test accounts in an Active Directory production domain - Part I
    Management of test accounts in an Active Directory production domain - Part II
    Management of test accounts in an Active Directory production domain - Part III
    Reset Active Directory user password

  • Disaster Recovery Test

    Hi,
      Can anybody please guide, who'll play the major role in "Disaster Recovery Test"
    like functional / basis / abap etc,,,

    Hello Mahesh
    Everybody has to play a major role , first Basis has to take action then abaper and then for testing Functional people required to put their effort.here is brief excerpt from an article regarding "Disaster recovery for SAP".
    It will give all of us an idea about Disater recovery.
    When you have your SAP system installed, you don't have a disaster recovery solution.
    "SAP has standard methodologies for doing backups and restoring the SAP environment, but there's nothing built into their application that specifically targets disaster recovery,"
    In other words, SAP tells you very explicitly what you need to protect, but you're on your own in figuring out how to make it happen. It is common practice among third-party solution providers to ask about disaster recovery, but if you're doing your own thing it is important to be aware of the need for a disaster recovery solution.
    Outsourcing vs. building a secondary site:
    There are two ways to go about setting up your disaster recovery solution: Outsource or build your own secondary site. Outsourcing may be more convenient and less expensive, especially for smaller companies on a tight budget. Simply approach the outsourcing company with your needs, and they will pretty much take it from there. Graap likens it to an insurance policy, where you pay a premium on an ongoing basis for the security.
    If you decide to outsource, ask colleagues for recommendations and spend some time researching prices, which can vary a lot. But make sure the outsourcer can step up to the plate in the unlikely event that you need their services.
    Building your own secondary site requires a larger investment up front but the leaves you in full control of your contingency plans rather than be at the mercy of an outsourcing company. If your outsourcing provider falls through for some reason -- such as being in the same disaster zone as your main office during an earthquake for example -- you're in trouble. When building your own site, you can prepare for more scenarios and place it far enough away from your main office.
    High availability vs. cost:
    Specialists say one of the most important questions to consider is availability and how quickly you need to get your systems back online. The difference between getting back online in 10 minutes or three days could be millions of dollars, so you want to make sure you get just the right solution for your company.
    Around-the-clock availability will require mirroring content across two sites in real-time. This enables you to do an instant failover with little or no downtime, rather than force you to physically move from the office to a backup site with a stack of tapes.
    Regardless of whether you outsource or set up your own site, a high availability solution is expensive.
    "But if that is what it takes to keep your business from going under, it's worth every penny of it".
    An added benefit of having a high availability solution is that you can avoid maintenance downtime by working on one server while letting the other handle all traffic. In theory, this leaves a window of risk, but most maintenance tasks, such as backups, can be cancelled if need be.
    One consideration for mirroring data is the bandwidth to the secondary site. Replicating data in real-time requires enough capacity to handle it without hitches. Also, a secondary site will require the same disk space as your regular servers. You can probably get away with a smaller and cheaper system, but you still need enough storage space to match your primary servers.
    Whatever the choice for disaster recovery, it is vital that both the technology and the business departments know about the plan ahead of time.
    Testing your solution:
    Ok, so you have a disaster recovery solution in place. Great, you're home free, right? Not quite. It must be tested continuously it to make sure it works in real life. Sometimes management can be reluctant to spend the money for a real test, or perhaps there are pressing deadlines to keep but it should be tested one or two times a year.
    Many people who build good plans let them sit collecting dust for years, at which point half the key people in the plan have left or changed positions.Update the names, phone numbers and other vital information frequently and test them, he said. It is for the same reason you do fire drills: When the real thing strikes, there's no room for error.
    In testing, consider different scenarios and the physical steps needed to get the data center up and running. For example, many disaster recovery solutions require at least parts of a staff to get on a plane and physically move to the secondary location. But September 11 showed how that is not easy when all planes are grounded.
    Costly but vital:
    Disaster recovery is not cheap, and it requires lots of testing to stay current, but it could save your critical data.
    "Any customer who makes an investment in SAP is purchasing an enterprise-class application, and as such really should have this level of protection for their business". "I can't imagine why anybody would not have an interest in disaster recovery."
    Regards
    Yogesh

  • Is anyone doing disaster recovery for a J2EE application?

    We generally use database log shipping to maintain a standby database for our ABAP instances.  We can successfully fail over our production application to our disaster recovery site with no real issues.  With the J2EE instances (EP, ESS/MSS, BI, etc), we have a few concerns:
    hostname cannot change, without going through a system copy procedure, so we would have to keep the hostnames in DR the same. (for example, ref: oss note 757692 - changing hostname is not supported)
    fully qualified domain name - from what I understand, there are potentially issues with changing the fqdn, for example SSO certificates, BSPs, XI has issues, etc.
    we can't keep both hostname and fqdn the same between DR and production, or we could never do a DR test.
    Has anyone implemented disaster recovery for any SAP J2EE application that has run into these concerns and addressed them?  Input would be greatly appreciated regarding how you addressed these issues, or how you architected your disaster recovery implementation.
    Regards,
    David Hull
    The Walt Disney Company

    I haven't done this personally, but I do have some experience with these issues in different HA environments.
    To your first point:  You can change the hostname, note 757692 tells you exactly how to do it.  However like the note says, "Changing the name of a host server in a production system is not automatically supported by SAP."  When it says "supported by SAP" I think it means SAP the company, not SAP's software.  So I would contact SAP to see if this configuration would be covered under your service agreement.  Then you have to think about whether you want to do something that isn't "officially supported" by SAP.  Also I'm sure you'll need some kind of additional licensing for the DR systems as their hardware keys will de different.
    To your second point:  As for SSO certs (SAP Login Tickets), I think they should still work as long as the SID and client number of the issuing system remain the same.  I don't think they are hostname or fqdn dependant.  For BSPs I would think they would still work as long as they use relative paths rather than absolute paths.  And for XI... I have no idea what kind of issues may arise, I'm not an XI guy.
    Again, I haven't done what you're describing myself.  This is just based on my HA experiences.
    Hope this helps a little,
    Glenn

  • SharePoint 2013 Search - Disaster Recovery Restore

    Hello,
    We are setting up a new SharePoint 2013 with a separate Disaster Recovery farm as a hot-standby.  In a DR scenario, we want to restore all content and service app databases to the new farm, then fix any configuration issues that might arise due to changes
    in server names, etc...
    The issue we're running into is the search service components are still pointing to the production servers even though they're in the new farm with completely different server names.  This is expected, so we're preparing a PowerShell script to remove
    then re-create the search components as needed.  The problem is that all the commands used to apply the new search topology won't function because they can't access the administration component (very frustrating).  It appears we're in a chicken &
    egg scenario - we can't change the search topology because we don't have a working admin component, but we can't fix the admin component because we can't change the search topology.
    The scripts below are just some of the things we've tried to fix the issue:
    $sa = Get-SPEnterpriseSearchServiceApplication "Search Service Application";
    $local = Get-SPEnterpriseSearchServiceInstance -Local;
    $topology = New-SPEnterpriseSearchTopology -SearchApplication $sa;
    New-SPEnterpriseSearchAdminComponent -SearchTopology $topology -SearchServiceInstance $local;
    New-SPEnterpriseSearchQueryProcessingComponent -SearchTopology $topology -SearchServiceInstance $local;
    New-SPEnterpriseSearchCrawlComponent -SearchTopology $topology -SearchServiceInstance $local;
    New-SPEnterpriseSearchContentProcessingComponent -SearchTopology $topology -SearchServiceInstance $local;
    New-SPEnterpriseSearchAnalyticsProcessingComponent -SearchTopology $topology -SearchServiceInstance $local;
    New-SPEnterpriseSearchIndexComponent -SearchTopology $topology -SearchServiceInstance $local -IndexPartition 0 -RootDirectory "D:\SP_Index\Index";
    $topology.Activate();
    We get this message:
    Exception calling "Activate" with "0" argument(s): "The search service is not able to connect to the machine that 
    hosts the administration component. Verify that the administration component '764c17a1-4c29-4393-aacc-de01119aba0a' 
    in search application 'Search Service Application' is in a good state and try again."
    At line:11 char:1
    + $topology.Activate();
    + ~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
        + FullyQualifiedErrorId : InvalidOperationException
    Also, same as above with
    $topology.BeginActivate()
    We get no errors but the new topology is never activated.  Attempting to call $topology.Activate() within the next few minutes will result in an error saying that "No modifications to the search topology can be made because previous changes are
    being rolled back due to an error during a previous activation".
    Next I found a few methods in the object model that looked like they might do some good:
    $sa = Get-SPEnterpriseSearchServiceApplication "Search Service Application";
    $topology = Get-SPEnterpriseSearchTopology -SearchApplication $sa -Active;
    $admin = $topology.GetComponents() | ? { $_.Name -like "admin*" }
    $topology.RecoverAdminComponent($admin,"server1");
    This one really looked like it worked.  It took a few seconds to run and came back with no errors.  I can even get the active list of components and it shows that the Admin component is running on the right server:
    Name ServerName
    AdminComponent1 server1
    ContentProcessingComponent1
    QueryProcessingComponent1
    IndexComponent1
    QueryProcessingComponent3
    CrawlComponent0
    QueryProcessingComponent2
    IndexComponent2
    AnalyticsProcessingComponent1
    IndexComponent3
    However, I'm still unable to make further changes to the topology (getting the same error as above when calling $topology.Activate()), and the service application in central administration shows an error saying it can't connect to the admin component:
    The search service is not able to connect to the machine that hosts the administration component. Verify that the administration component '764c17a1-4c29-4393-aacc-de01119aba0a' in search application 'Search Service Application' is in a good state and try again.
    Lastly, I tried to move the admin component directly:
    $sa.AdminComponent.Move($instance, "d:\sp_index")
    But again I get an error:
    Exception calling "Move" with "2" argument(s): "Admin component was moved to another server."
    At line:1 char:1
    + $sa.AdminComponent.Move($instance, "d:\sp_index")
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
        + FullyQualifiedErrorId : OperationCanceledException
    I've checked all the most common issues - the service instance is online, the search host controller service is running on the machine, etc...  but I can't seem to get this database restored to a different farm.
    Any help would be appreciated!

    Thanks for the response Bhavik,
    I did ensure the instance was started:
    Get-SPEnterpriseSearchServiceInstance -Local
    TypeName : SharePoint Server Search
    Description : Index content and serve search queries
    Id : e9fd15e5-839a-40bf-9607-6e1779e4d22c
    Server : SPServer Name=ROYALS
    Service : SearchService Name=OSearch15
    Role : None
    Status : Online
    But after attempting to set the admin component I got the results below.
    Before setting the admin component:
    Get-SPEnterpriseSearchAdministrationComponent -SearchApplication $sa
    IndexLocation : E:\sp_index\Office Server\Applications
    Initialized : True
    ServerName : prodServer1
    Standalone :
    After setting the admin component:
    Get-SPEnterpriseSearchAdministrationComponent -SearchApplication $sa
    IndexLocation :
    Initialized : False
    ServerName :
    Standalone :
    It's shown this status for a few hours now so I don't believe it's still provisioning.  Also, the search service administration is still showing the same error:
    The search service is not able to connect to the machine that hosts the administration component. Verify that the administration
    component '764c17a1-4c29-4393-aacc-de01119aba0a' in search application 'Search Service Application' is in a good state and try again.

  • Is It Possible to Add a Fileserver to a DFS Replication Group Without Connectivity to FSMO Roles Holder DC But Connectivity to Site DC???

    I apologize in advance for the rambling novella, but I tried to include as many details ahead of time as I could.
    I guess like most issues, this one's been evolving for a while, it started out with us trying to add a new member 
    to a replication group that's on a subnet without connectivity to the FSMO roles holder. I'll try to describe the 
    layout as best as I can up front.
    The AD only has one domain & both the forest & domain are at 2008R2 function level. We've got two sites defined in 
    Sites & Services, Site A is an off-site datacenter with one associated subnet & Site B with 6 associated subnets, A-F. 
    The two sites are connected by a WAN link from a cable provider. Subnets E & F at Site B have no connectivity to Site A 
    across that WAN, only what's available through the front side of the datacenter through the public Internet. The network 
    engineering group involved refuses to route that WAN traffic to those two subnets & we've got no recourse against that 
    decision; so I'm trying to find a way to accomplish this without that if possible.
    The FSMO roles holder is located at Site A. I know that I can define a Site C, add Subnets E & F to that site, & then 
    configure an SMTP site link between Sites A & C, but that only handles AD replication, correct? That still wouldn't allow me, for example, 
    to enumerate DFS namespaces from subnets E & F, or to add a fileserver on either of those subnets as a member to an existing
    DFS replication group, right? Also, root scalability is enabled on all the namespace shares.
    Is there a way to accomplish both of these things without transferring the FSMO roles from the original DC at Site A to, say, 
    the bridgehead DC at Site B? 
    When the infrastructure was originally setup by a former analyst, the topology was much more simple & everything was left
    under the Default First Site & no sites/subnets were setup until fairly recently to resolve authentication issues on 
    Subnets E & F... I bring this up just to say, the FSMO roles holder has held them throughout the build out & addition of 
    all sorts of systems & I'm honestly not sure what, if anything, the transfer of those roles will break. 
    I definitely don't claim to be an expert in any of this, I'll be the first to say that I'm a work-in-progress on this AD design stuff, 
    I'm all for R'ing the FM, but frankly I'm dragging bottom at this point in finding the right FM. I've been digging around
    on Google, forums, & TechNet for the past week or so as this has evolved, but no resolution yet. 
    On VMs & machines on subnets E & F when I go to DFS Management -> Namespace -> Add Namespaces to Display..., none show up 
    automatically & when I click Show Namespaces, after a few seconds I get "The namespaces on DOMAIN cannot be enumerated. The 
    specified domain either does not exist or could not be contacted". If I run a dfsutil /pktinfo, nothing shows except \sysvol 
    but I can access the domain-based DFS shares through Windows Explorer with the UNC path \\DOMAIN-FQDN\Share-Name then when 
    I run a dfsutil /pktinfo it shows all the shares that I've accessed so far.
    So either I'm doing something wrong, or, for some random large, multinational company, every sunbet & fileserver one wants 
    to add to a DFS Namespace has to be able to contact the FSMO roles holder? Or, are those ADs broken down with a child domain 
    for each Site & a FSMO roles holder for that child domain is located in each site?

    Hi,
    A DC in siteB should helpful. I still not see any article mentioned that a DFS client have to connect to PDC every time trying to access a DFS domain based namespace.
    Please see following article. I pasted a part of it below:
    http://technet.microsoft.com/en-us/library/cc782417(v=ws.10).aspx
    Domain controllers play numerous roles in DFS:
    Domain controllers store DFS metadata in Active Directory about domain-based namespaces. DFS metadata consists of information about entire namespace, including the root, root targets, links, link targets, and settings. By default,root servers
    that host domain-based namespaces periodically poll the domain controller acting as the primary domain controller (PDC) emulator master to obtain an updated version of the DFS metadata and store this metadata in memory.
    So Other DC needs to connect PDC for an updated metadata.
    Whenever an administrator makes a change to a domain-based namespace, the
    change is made on the domain controller acting as the PDC emulator master and is then replicated (via Active Directory replication) to other domain controllers in the domain.
    Domain Name Referral Cache
    A domain name referral contains the NetBIOS and DNS names of the local domain, all trusted domains in the forest, and domains in trusted forests. A
    DFS client requests a domain name referral from a domain controller to determine the domains in which the clients can access domain-based namespaces.
    Domain Controller Referral Cache
    A domain controller referral contains the NetBIOS and DNS names of the domain controllers for the list of domains it has cached. A DFS client requests a domain controller referral from a domain controller (in the client’s domain)
    to determine which domain controllers can provide a referral for a domain-based namespace.
    Domain-based Root Referral Cache
    The domain-based root referrals in this memory cache do not store targets in any particular order. The targets are sorted according to the target selection method only when requested from the client. Also, these referrals are based on DFS metadata stored
    on the local domain controller, not the PDC emulator master.
    Thus it seems to be acceptable to have a disconnect between sites shortly when cache is still working on siteB.
    If you have any feedback on our support, please send to [email protected].

  • Is it Possible to Promote DC on a Subnet With Connectivity to a Site DC But Not DC with FSMO Roles???

    I apologize in advance for the rambling novella, but I tried to include as many details ahead of time as I could.
    I guess like most issues, this one's been evolving for a while, it started out with us trying to add a new member 
    to a replication group that's on a subnet without connectivity to the FSMO roles holder. I'll try to describe the 
    layout as best as I can up front.
    The AD only has one domain & both the forest & domain are at 2008R2 function level. We've got two sites defined in 
    Sites & Services, Site A is an off-site datacenter with one associated subnet & Site B with 6 associated subnets, A-F. 
    The two sites are connected by a WAN link from a cable provider. Subnets E & F at Site B have no connectivity to Site A 
    across that WAN, only what's available through the front side of the datacenter through the public Internet. The network 
    engineering group involved refuses to route that WAN traffic to those two subnets & we've got no recourse against that 
    decision; so I'm trying to find a way to accomplish this without that if possible.
    The FSMO roles holder is located at Site A. I know that I can define a Site C, add Subnets E & F to that site, & then 
    configure an SMTP site link between Sites A & C, but that only handles AD replication, correct? That still wouldn't allow me, for example, 
    to enumerate DFS namespaces from subnets E & F, or to add a fileserver on either of those subnets as a member to an existing
    DFS replication group, right? Also, root scalability is enabled on all the namespace shares.
    Is there a way to accomplish both of these things without transferring the FSMO roles from the original DC at Site A to, say, 
    the bridgehead DC at Site B? 
    When the infrastructure was originally setup by a former analyst, the topology was much more simple & everything was left
    under the Default First Site & no sites/subnets were setup until fairly recently to resolve authentication issues on 
    Subnets E & F... I bring this up just to say, the FSMO roles holder has held them throughout the build out & addition of 
    all sorts of systems & I'm honestly not sure what, if anything, the transfer of those roles will break. 
    I definitely don't claim to be an expert in any of this, I'll be the first to say that I'm a work-in-progress on this AD design stuff, 
    I'm all for R'ing the FM, but frankly I'm dragging bottom at this point in finding the right FM. I've been digging around
    on Google, forums, & TechNet for the past week or so as this has evolved, but no resolution yet. 
    On VMs & machines on subnets E & F when I go to DFS Management -> Namespace -> Add Namespaces to Display..., none show up 
    automatically & when I click Show Namespaces, after a few seconds I get "The namespaces on DOMAIN cannot be enumerated. The 
    specified domain either does not exist or could not be contacted". If I run a dfsutil /pktinfo, nothing shows except \sysvol 
    but I can access the domain-based DFS shares through Windows Explorer with the UNC path \\DOMAIN-FQDN\Share-Name then when 
    I run a dfsutil /pktinfo it shows all the shares that I've accessed so far.
    So either I'm doing something wrong, or, for some random large, multinational company, every sunbet & fileserver one wants 
    to add to a DFS Namespace has to be able to contact the FSMO roles holder? Or, are those ADs broken down with a child domain 
    for each Site & a FSMO roles holder for that child domain is located in each site?

    Hi Matthew,
    Unfortunately a lot of the intricacies of DFS leave my head as soon as I’m done with a particular design or troubleshooting situation but from memory, having direct connectivity to the PDC emulator for a particular domain is the key to managing domain based
    DFS.
    Have a read of this article for the differences between “Optimize for consistency” vs “Optimize for scalability”:
    http://technet.microsoft.com/en-us/library/cc737400(v=ws.10).aspx
    In brief, I’d say they mean:
    In consistency mode the namespace servers always poll the PDCe for the latest and greatest information on the namespaces they are hosting.
    In scalability mode the namespace servers should poll the closest DC for information on the namespaces they are hosting.
    The key piece of information in that article about scalability mode is: “Updates are still made to the namespace object in Active Directory on the PDC emulator, but namespace servers do not discover those changes until the updated namespace object replicates
    (using Active Directory replication) to the closest domain controller for each namespace server.”
    I read that as saying you can have a server running DFS-N as long as it has connectivity to a DC but if you want to make changes, do them from a box that has direct connectivity to the PDCe. Then let AD replication float those changes out to your other DCs
    where the remote DFS-N server will eventually pick them up. Give it a try and see how you get on.
    That being said, you may want to double check that you have configured the most appropriate FSMO role placement in your environment's AD design:
    http://technet.microsoft.com/en-us/library/cc754889(v=ws.10).aspx
    And a DFS response probably wouldn’t be complete without an AskDS link:
    http://blogs.technet.com/b/askds/archive/2012/07/24/common-dfsn-configuration-mistakes-and-oversights.aspx
    These links may also help:
    http://blogs.technet.com/b/filecab/archive/2012/08/26/dfs-namespace-scalability-considerations.aspx
    http://blogs.technet.com/b/josebda/archive/2009/12/30/windows-server-dfs-namespaces-reference.aspx
    http://blogs.technet.com/b/josebda/archive/2009/06/26/how-many-dfs-n-namespaces-servers-do-you-need.aspx
    I hope this helps,
    Mark

  • Recovering lost data from a very old backup (disaster recovery)

    Hi all,
    I am trying to restore and recover data from an old DAT-72 cassette. All I know is the date when the backup was taken, that is back in November 2006. I do not know the DBID or anything else except for the date.
    To recover this, I bought an internal SCSI HP c7438a DAT-72 tape drive on eBay and installed it on a machine running Windows 2003 Server SP2. I made a fresh Oracle 11g Enterprise Edition installation. HP tape drivers have been installed and Windows sees the tape drive without problem. To act as a Media Manager, I have installed Oracle Secure Backup. Oracle Secure Backup sees the HP tape drive without problems as well.
    I have to admit my information about Oracle is not very in-depth. I read quite a lot of documents, but the more I read the more confused I become. The closest thing I can find to my situation is the following guide about disaster recovery:
    http://download.oracle.com/docs/cd/B10500_01/server.920/a96566/rcmrecov.htm#1007948
    I tried the suggestions in this document without success (details below).
    My questions are:
    1. Is it possible to retrieve data without knowing the DBID?
    2. If not, is it possible to figure out the DBID from the tape? I tried to use dd in cygwin, also booted with Knoppix/Debian and Ubuntu CDs to dump the contents of the tape with dd but all of them failed to see the tape device. If there is any way to dump the raw contents of the tape on Windows, I would also welcome input.
    3. Is there any way at all to recover this data from the tape given all the unknowns?
    Thanks very much in advance,
    C:\Program Files>rman target orcl
    Recovery Manager: Release 11.2.0.1.0 - Production on Sat Mar 19 15:01:28 2011
    Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.
    target database Password:
    connected to target database: ORCL (not mounted)
    RMAN> SET DBID 676549873;
    executing command: SET DBID
    RMAN> STARTUP FORCE NOMOUNT; # rman starts instance with dummy parameter file
    Oracle instance started
    Total System Global Area 778387456 bytes
    Fixed Size 1374808 bytes
    Variable Size 268436904 bytes
    Database Buffers 503316480 bytes
    Redo Buffers 5259264 bytes
    RMAN> RUN
    2> {
    3> ALLOCATE CHANNEL t1 DEVICE TYPE sbt;
    4> RESTORE SPFILE TO 'C:\SPFILE.TMP' FROM AUTOBACKUP MAXDAYS 7 UNTIL TIME 'SYS
    DATE-1575';
    5> }
    using target database control file instead of recovery catalog
    allocated channel: t1
    channel t1: SID=63 device type=SBT_TAPE
    channel t1: Oracle Secure Backup
    Starting restore at 19-MAR-11
    channel t1: looking for AUTOBACKUP on day: 20061125
    channel t1: looking for AUTOBACKUP on day: 20061124
    channel t1: looking for AUTOBACKUP on day: 20061123
    channel t1: looking for AUTOBACKUP on day: 20061122
    channel t1: looking for AUTOBACKUP on day: 20061121
    channel t1: looking for AUTOBACKUP on day: 20061120
    channel t1: looking for AUTOBACKUP on day: 20061119
    channel t1: no AUTOBACKUP in 7 days found
    released channel: t1
    RMAN-00571: ===========================================================
    RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
    RMAN-00571: ===========================================================
    RMAN-03002: failure of restore command at 03/19/2011 15:03:26
    RMAN-06172: no AUTOBACKUP found or specified handle is not a valid copy or piece
    RMAN>
    RMAN> RUN
    2> {
    3> ALLOCATE CHANNEL t1 DEVICE TYPE sbt
    4> PARMS 'SBT_LIBRARY=C:\WINDOWS\SYSTEM32\ORASBT.DLL';
    5> RESTORE SPFILE TO 'C:\SPFILE.TMP' FROM AUTOBACKUP MAXDAYS 7 UNTIL TIME 'SYS
    DATE-1575';
    6> }
    allocated channel: t1
    channel t1: SID=63 device type=SBT_TAPE
    channel t1: Oracle Secure Backup
    Starting restore at 19-MAR-11
    channel t1: looking for AUTOBACKUP on day: 20061125
    channel t1: looking for AUTOBACKUP on day: 20061124
    channel t1: looking for AUTOBACKUP on day: 20061123
    channel t1: looking for AUTOBACKUP on day: 20061122
    channel t1: looking for AUTOBACKUP on day: 20061121
    channel t1: looking for AUTOBACKUP on day: 20061120
    channel t1: looking for AUTOBACKUP on day: 20061119
    channel t1: no AUTOBACKUP in 7 days found
    released channel: t1
    RMAN-00571: ===========================================================
    RMAN-00569: =============== ERROR MESSAGE STACK FOLLOWS ===============
    RMAN-00571: ===========================================================
    RMAN-03002: failure of restore command at 03/19/2011 15:04:56
    RMAN-06172: no AUTOBACKUP found or specified handle is not a valid copy or piece
    RMAN>
    -----------------------------------

    Hi 845725,
    If the backups were created with OSB might be you can query the tape with obtool.
    http://www.stanford.edu/dept/itss/docs/oracle/10gR2/backup.102/b14236/obref_oba.htmTo list pieces you could use <lspiece> within obtool.
    http://www.stanford.edu/dept/itss/docs/oracle/10gR2/backup.102/b14236/obref_oba.htm#BHBBIFFEIf this works you should be able to identify the controlfile autobackup if it has the standard naming < c-dbid-date-xx > and you than know the DBID or you are able to restore a controlfile from a backup piece in the output list.
    Might be you have to install 9i or 10g rdbms software as 11g was released a year later in 2007.
    Anyway goodluck.
    Regards,
    Tycho

  • Welcome to the SQL Server Disaster Recovery and Availability Forum

    (Edited 8/14/2009 to correct links - Paul)
    Hello everyone and welcome to the SQL Server Disaster Recovery and Availability forum. The goal of this Forum is to offer a gathering place for SQL Server users to discuss:
    Using backup and restore
    Using DBCC, including interpreting output from CHECKDB and related commands
    Diagnosing and recovering from hardware issues
    Planning/executing a disaster recovery and/or high-availability strategy, including choosing technologies to use
    The forum will have Microsoft experts in all these areas and so we should be able to answer any question. Hopefully everyone on the forum will contribute not only questions, but opinions and answers as well. I’m looking forward to seeing this becoming a vibrant forum.
    This post has information to help you understand what questions to post here, and where to post questions about other technologies as well as some tips to help you find answers to your questions more quickly and how to ask a good question. See you in the group!
    Paul Randal
    Lead Program Manager, SQL Storage Engine and SQL Express
    Be a good citizen of the Forum
    When an answer resolves your problem, please mark the thread as Answered. This makes it easier for others to find the solution to this problem when they search for it later. If you find a post particularly helpful, click the link indicating that it was helpful
    What to post in this forum
    It seems obvious, but this forum is for discussion and questions around disaster recovery and availability using SQL Server. When you want to discuss something that is specific to those areas, this is the place to be. There are several other forums related to specific technologies you may be interested in, so if your question falls into one of these areas where there is a better batch of experts to answer your question, we’ll just move your post to that Forum so those experts can answer. Any alerts you set up will move with the post, so you’ll still get notification. Here are a few of the other forums that you might find interesting:
    SQL Server Setup & Upgrade – This is where to ask all your setup and upgrade related questions. (http://social.msdn.microsoft.com/Forums/en-US/sqlsetupandupgrade/threads)
    Database Mirroring – This is the best place to ask Database Mirroring how-to questions. (http://social.msdn.microsoft.com/Forums/en-US/sqldatabasemirroring/threads)
    SQL Server Replication – If you’ve already decided to use Replication, check out this forum. (http://social.msdn.microsoft.com/Forums/en-US/sqlreplication/threads)
    SQL Server Database Engine – Great forum for general information about engine issues such as performance, FTS, etc. (http://social.msdn.microsoft.com/Forums/en-US/sqldatabaseengine/threads)
    How to find your answer faster
    There is a wealth of information already available to help you answer your questions. Finding an answer via a few quick searches is much quicker than posting a question and waiting for an answer. Here are some great places to start your research:
    SQL Server 2005 Books Onlinne
    Search it online at http://msdn2.microsoft.com
    Download the full version of the BOL from here
    Microsoft Support Knowledge Base:
    Search it online at http://support.microsoft.com
    Search the SQL Storage Engine PM Team Blog:
    The blog is located at https://blogs.msdn.com/sqlserverstorageengine/default.aspx
    Search other SQL Forums and Web Sites:
    MSN Search: http://www.bing.com/
    Or use your favorite search engine
    How to ask a good question
    Make sure to give all the pertinent information that people will need to answer your question. Questions like “I got an IO error, any ideas?” or “What’s the best technology for me to use?” will likely go unanswered, or at best just result in a request for more information. Here are some ideas of what to include:
    For the “I got an IO error, any ideas?” scenario:
    The exact error message. (The SQL Errorlog and Windows Event Logs can be a rich source of information. See the section on error logs below.)
    What were you doing when you got the error message?
    When did this start happening?
    Any troubleshooting you’ve already done. (e.g. “I’ve already checked all the firmware and it’s up-to-date” or "I've run SQLIOStress and everything looks OK" or "I ran DBCC CHECKDB and the output is <blah>")
    Any unusual occurrences before the error occurred (e.g. someone tripped the power switch, a disk in a RAID5 array died)
    If relevant, the output from ‘DBCC CHECKDB (yourdbname) WITH ALL_ERRORMSGS, NO_INFOMSGS’
    The SQL Server version and service pack level
    For the “What’s the best technology for me to use?” scenario:
    What exactly are you trying to do? Enable local hardware redundancy? Geo-clustering? Instance-level failover? Minimize downtime during recovery from IO errors with a single-system?
    What are the SLAs (Service Level Agreements) you must meet? (e.g. an uptime percentage requirement, a minimum data-loss in the event of a disaster requirement, a maximum downtime in the event of a disaster requirement)
    What hardware restrictions do you have? (e.g. “I’m limited to a single system” or “I have several worldwide mirror sites but the size of the pipe between them is limited to X Mbps”)
    What kind of workload does you application have? (or is it a mixture of applications consolidated on a single server, each with different SLAs) How much transaction log volume is generated?
    What kind of regular maintenance does your workload demand that you perform (e.g. “the update pattern of my main table is such that fragmentation increases in the clustered index, slowing down the most common queries so there’s a need to perform some fragmentation removal regularly”)
    Finding the Logs
    You will often find more information about an error by looking in the Error and Event logs. There are two sets of logs that are interesting:
    SQL Error Log: default location: C:\Program Files\Microsoft SQL Server\MSSQL.#\MSSQL\LOG (Note: The # changes depending on the ID number for the installed Instance. This is 1 for the first installation of SQL Server, but if you have mulitple instances, you will need to determine the ID number you’re working with. See the BOL for more information about Instance ID numbers.)
    Windows Event Log: Go to the Event Viewer in the Administrative Tools section of the Start Menu. The System event log will show details of IO subsystem problems. The Application event log will show details of SQL Server problems.

    hi,I have a question on sql database high availability. I have tried using database mirroring, where I am using sql standard edition, in this database mirroring of synchronous mode is the only option available, and it is giving problem, like sql time out errors on my applicatons since i had put in the database mirroring, as asynchronous is only available on enterprise version, is there any suggestions on this. thanks ---vijay

  • Disaster Recovery For SAP ECC 6.0 On Oracle

    Hi All,
    This is our infrastructure
    Windows 2003 Server
    SAP ECC 6.0
    Oracle 10
    Legato Networker Client / Library
    Actually our Backup Strategy is to do an Online Backup Every Night from monday to saturday. We want to test our backup by doing a Restore. We are assuming a complete loss of the system including hardware.
    What we do:
    1. Install the SAP System on a new host with the same hardware characteristic of the source system.
    2. Install & Configure the legato utility.
    3. Copy the E:\oracle\MIS\sapbackup\ directory from the source system to the test system.
    4. Them we put the database in mount mode.
    5. Execute the command: brrestore -b bdyxwoqv.fnf -m full  (bdyxwoqv.fnf-> Full Online Backup that was executed without problems).
    It gives the following errors:
    BR0386E File 'F:\ORACLE\MIS\SAPDATA2\SR3_10\SR3.DATA10' reported as not found by
    backup utility
    BR0386E File 'F:\ORACLE\MIS\SAPDATA3\SR3700_9\SR3700.DATA9' reported as not foun
    d by backup utility
    BR0280I BRRESTORE time stamp: 2008-10-01 17.45.19
    BR0279E Return code from 'backint -u MIS -f restore -i E:\oracle\MIS\sapbackup\.
    rdyybrzp.lst -t file -p E:\oracle\MIS\102\database\initMIS.utl': 2
    BR0374E 0 of 63 files restored by backup utility
    BR0280I BRRESTORE time stamp: 2008-10-01 17.45.19
    BR0231E Backup utility call failed
    BR0406I End of file restore: rdyybrzp.rsb 2008-10-01 17.45.19
    BR0280I BRRESTORE time stamp: 2008-10-01 17.45.19
    BR0404I BRRESTORE terminated with errors
    Since this is a new SAP system it never will find the SAPDATA files because they where on the source system and this is a new test system.
    We found the following note:
    96848 Disaster recovery for SAP R/3 on Oracle
    But this note is for SAP R/3 no for SAP ECC!
    It explain that you have to install your SAP system with the System Copy Method (is this the only way??).
    2.) Installation of the R/3 System
    The installation of SAP software contains the software installation of the database. The initial SAP database should be created again but the SAP data should not be loaded.
    Install the SAP system with the Oracle-specific system copy method, which is based on backup/restore. This method is described in the system copy guide for your Product/Release. Refer to Note 659509 for products that are based on Web AS.
    3.) Modification of the installation
    Above all, you must take into account the mounted file systems at the time of the loss. If necessary create new SAPDATA directories (mount points). These generally identify a disk or a logical storage area (logical volume).
    Are we working in the right way? maybe there is a formal procedure to do a Restore from an Online backup when you complete loss your system.
    Please some tips.
    Best Regards,
    Erick Ilarraza

    Hi Eric,
    Thanks a lot for your reply, I will follow the Note 96848 Disaster recovery for SAP R/3 on ORACLE point 5.
    5.) Restore profile and log files, as you sayed in case of disaster we will lost our "source" system.
    On the other hand to configure the legato client we take care of the name of the server, we configured the .sap, .cfg and .utl files so in theory the restore will be done on the new test system since we run the brrestore command from that system.
    Officially there is not a documentation from SAP to do a Restore from a Online Backup with SAP ECC, SAP Netweaver (ABAP / ABAP + Java). You only have the 96848 note??? I found the following information:
    http://help.sap.com/saphelp_nw70/helpdata/en/65/cade3bd0c8545ee10000000a114084/frameset.htm
    But there is not a official procedure like a System Copy Guide or Installation Guide.
    Best Regards,
    Erick Ilarraza

  • DC not functioning with FSMO roles

    hello every body,
    I have 0 DC and 01 ADC lets say that DC and ADC. both were replicating AD and working properly. few days ago the motherboard of my DC failed and we replaced with new one. and obviously NIC card was attached with M.Board which also changed. when i boot up
    my DC, i see its not functioning as domain controller as i saw in server manager all FSMO roles are with red cross. i assign the ip address which it hold previous i.e 192.168.0.1. but still FSMO roles are disabled. While my only ADC is working properly with
    following errors and warning in AD DS roles. 
    Warning on ADC:
    The remote server which is the owner of a FSMO role is not responding.  This server has not replicated with the FSMO role owner recently. 
    Error on ADC:
    Log Name:      Directory Service
    Source:        Microsoft-Windows-ActiveDirectory_DomainService
    Date:          12/15/2014 11:18:07 AM
    Event ID:      1863
    Task Category: Replication
    Level:         Error
    Keywords:      Classic
    User:          ANONYMOUS LOGON
    Computer:      KHI-ADC.jehanpakistan.com
    Description:
    This is the replication status for the following directory partition on this directory server. 
    Directory partition:
    DC=ForestDnsZones,DC=jehanpakistan,DC=com 
    This directory server has not received replication information from a number of directory servers within the configured latency interval. 
    Latency Interval (Hours): 
    24 
    Number of directory servers in all sites:

    Number of directory servers in this site:

    The latency interval can be modified with the following registry key. 
    Registry Key: 
    HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours) 
    To identify the directory servers by name, use the dcdiag.exe tool. 
    You can also use the support tool repadmin.exe to display the replication latencies of the directory servers.   The command is "repadmin /showvector /latency <partition-dn>".
    My DC is working properly as a System.
    should i have to do something with my NIC or AD DS roles or i have to transfer FSMOs to ADC. or sieze fsmo roles of DC on ADC.
    please help.

    Is your DC (role holder) a DNS Server as well? I assume it is, if so open the server role properties and ensure the DNS server role shows the IP in the interface if it does not you may need to uninstall/ re-install the DNS server role (assuming it is a 2008
    R2 DC or above... Also did you look at your NIC settings? Did you re-establish the exact same NIC configuration as before?
    When the motherboard gets replaced and new NICS are introduced I normally look at the NIC settings and DNS Server roles... That is the Microsoft side of things. On the LAN/ WAN side of things if your network team has port security enabled on the switches
    the port may be locked down due to the new MAC Address.

Maybe you are looking for