1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Help with a replication problem

Discussion in 'Active Directory Exams' started by lifeisshortmove, Jul 16, 2011.

  1. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    Hello,
    I have a problem with replication between 2 domain controllers in a forest. IP configuration for those domain controllers is as follows

    DC1 (Forest Root Domain)
    IP: 192.168.1.2
    SM: 255.255.255.0
    Preferred DNS server: 192.168.1.2


    DC2 (Domain controller for another domain tree in the same forest)
    IP: 192.168.1.3
    SM: 255.255.255.0
    Preferred DNS server: 192.168.1.3
    Secondary DNS server: 192.168.1.2

    When I try to force replication using replmon command line tool I get the following messages:

    pic1.jpg pic2.jpg

    I know 99.9% it's a DNS problem. But why this happens. Both have an AD integrated zone that's replicated to all DNS servers in the entire forest.
     
  2. ChrisH1979

    ChrisH1979 Byte Poster

    225
    9
    37
    Have you tried running dcdiag? I have also used sonar or ultrasound from MS in the past as well.
     
    Last edited: Jul 16, 2011
    Certifications: MCITP:SA, MCSA, MCTS:Win 7, Application Infrastructure
    WIP: MCITP:EA
  3. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    Ok, I have used domain controller diagnostic tool and as I guessed it's a DNS problem (**** DNS ). I still have no idea how to fix it.
    pic1.jpg pic2.jpg

    No problems on DC1 but DC2 cannot locate DC1.
     
  4. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Can DC2 ping DC1 by FQDN?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  5. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    No, DC2 cannot ping DC1 by FQDN.
     
  6. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Well thats a problem :)

    Add the FQDN in the host file (messy but worth a try) and then reboot the DC. Check replication after that.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  7. dales

    dales Gigabyte Poster

    1,997
    46
    97
    Does DC2 have a secondary or stub zone or forwarder in DNS pointing to the DC1 domain
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  8. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    First of all, from DC2
    c:\> ping 192.168.1.2 (IP address of DC1)
    This works fine and that means that connectivity between DCs are fine
    c:\> ping DC1.testlab.com
    This does not work
    So obviously it's a DNS problem. I don't know why would I configure a secondary or stub zone on DC2. It's DNS configuration is as follows:
    Preferred DNS server: 192.168.1.3
    Secondary DNS server: 192.168.1.2

    So if the first DNS server (itself) is failed to resolve the name, it'll try to contact the other DNS server which is authoritative for that zone. Anyway, I tried to make a secondary zone on DC2. On DC1, allow zone transfers to the IP address of DC2. But it did not work. I tried to reload the secondary zone, force zone transfer, restart DC2 but all this did not work.

     
  9. dales

    dales Gigabyte Poster

    1,997
    46
    97
    Ok so from DC2 can you open a command prompt and do the following:

    nslookup {ENTER}
    server 192.168.1.2 {ENTER}
    DC1.testlab.com {ENTER}

    What happens when you do that, does it resolve the name correctly or do you get an error?
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  10. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    Ok, that's what I have got

    > server 192.168.1.2
    DNS request timed out.
    timeout was 2 seconds
    Default server: [192.168.1.2]
    Address: 192.168.1.2

    > dc1.testlab.com
    server: [192.168.1.2]
    Address: 192.168.1.2

    DNS request timed out.
    timeout was 2 seconds

    Name: dc1.testlab.com
    Address: 192.168.1.2

    Obviously, it did not work too. :(

    One important thing I noticed about nslookup. When I try to run nslookup on DC1.
    nslookup [Enter]
    DNS request timed out.
    timeout was 2 seconds

    ***cannot find server name for address 192.168.1.2: Timed out
    Default Server: Unknown
    Address: 192.168.1.2

    I tried to re-register SRV records for that DC by restarting the Netlogon services but it did not work

    on DC2 it works fine
    nslookup [Enter]
    Default server: localhost
    Address: 127.0.0.1
     
    Last edited: Jul 18, 2011
  11. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Try putting the FQDN in the host file mate....
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  12. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    I did and ping with FQDN worked (of course it'll work after adding it by hand :) ). I restarted DC2 but replication doesn't work too. The difference is that now in replication monitor I can connect to DC1 (which was impossible before). Here is what I get when I try to force replication

    pic.jpg
     
  13. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Something weird is going on as you shouldnt really need to force replication as the DCs are in the same site.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  14. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    What is the FQDN of DC2?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  15. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    DC1 is the forest root domain, DC2 is the tree root for a domain called newtree.com
    Fully Qualified Domain Name for DC2 is dc2.newtree.com
    Fully Qualified Domain Name for DC1 is dc1.testlab.com
     
  16. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Ahh, I see.

    So did you dcpromo the second domain and then configure a trust?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  17. lifeisshortmove

    lifeisshortmove Bit Poster

    42
    0
    19
    Yes, but no need to configure a trust manually. It's a trust between to tree domains in the same forest. A transative automatic trust. Anyway, I checked it. But again there is a problem contacting testlab.com domain. Because there is a DNS problem. Replication and trusts depend on DNS.

    Adding a record for DC1 to the hosts file won't help a lot because DC1 registers its DNS records which are used in replicatioin...etc
     
  18. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    This might help mate...

    How Domain and Forest Trusts Work: Domain and Forest Trusts

    Its been a while but from what I remember you need to add a child domain to get the automatic trust relationship between the two domains.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010

Share This Page

Loading...