Issues on Domain

[HutchinsonJC]

The Back Drop:
SERVERold is a 2003 server operating system

SERVERnew is a 2012 r2 operating system and was added to the domain prior to me taking over this network. I think it was assumed SERVERnew was able to handle DNS because all machines on the network pointed to both SERVERold and SERVERnew for DNS.

SERVERold and SERVERnew handled different things on the domain for the users at the time of me taking over, but the intention, even before I took over, was to totally transition from SERVERold to SERVERnew. It's a relatively small domain with just under 30 machines.

Share drives along with basically *every* program users were relying on were moved to SERVERnew since ball park March of this year with the exception of a few misc odds and ends on a share drive on the SERVERold machine, which is the only reason the SERVERold was still on the network aside from the fact that I had to still DCPromo/demote. I had tried a few times to do that, but it always gave troubles in doing so.

I was able to transfer all 5 FSMO roles from SERVERold to SERVERnew before these issues arose. I was working toward retiring the old 2003 server, anyway.

netdom query fsmo (Run from SERVERnew)
Schema master SERVERnew.DOMAINrenamed.local
Domain naming master SERVERnew.DOMAINrenamed.local
PDC SERVERnew.DOMAINrenamed.local
RID pool manager SERVERnew.DOMAINrenamed.local
Infrastructure master SERVERnew.DOMAINrenamed.local
The command completed successfully.

In late April we had some kind of failure on the SERVERold and we lost all internet connectivity. This is where I learned that SERVERnew was in fact not able to handle DNS, so I remedied that.

SERVERold has not been physically plugged in since late April when these problems arose, save for one time I think in May, I was messing around trying to figure these issues out. SERVERold I feel like is pretty much on its last leg, however, it does turn on, boot up, and run.

Anyway, there seems to be a whole slew of problems as can be seen in this dcdiag and I'm hoping for some help in resolving this. The bulk of my issues seem to revolve around netlogin share and sysvol?

Tips tricks pointers? Commands you want run? Questions? Halp!

dcdiag:

Directory Server Diagnosis

Performing initial setup:
Trying to find home server...
Home Server = SERVERnew

* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site\SERVERnew
Starting test: Connectivity
......................... SERVERnew passed test Connectivity

Doing primary tests

Testing server: Default-First-Site\SERVERnew
Starting test: Advertising
......................... SERVERnew passed test Advertising

Starting test: FrsEvent
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
......................... SERVERnew passed test FrsEvent

Starting test: DFSREvent
......................... SERVERnew passed test DFSREvent

Starting test: SysVolCheck
......................... SERVERnew passed test SysVolCheck

Starting test: KccEvent
......................... SERVERnew passed test KccEvent

Starting test: KnowsOfRoleHolders
......................... SERVERnew passed test KnowsOfRoleHolders

Starting test: MachineAccount
......................... SERVERnew passed test MachineAccount

Starting test: NCSecDesc
......................... SERVERnew passed test NCSecDesc

Starting test: NetLogons
Unable to connect to the NETLOGON share! (\\SERVERnew\netlogon)
[SERVERnew] An net use or LsaPolicy operation failed with error 67,
The network name cannot be found..
......................... SERVERnew failed test NetLogons

Starting test: ObjectsReplicated
......................... SERVERnew passed test ObjectsReplicated
Starting test: Replications
[Replications Check,SERVERnew] A recent replication attempt failed:
From SERVERold to SERVERnew
Naming Context: DC=ForestDnsZones,DC=DOMAINrenamed,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.

The failure occurred at 2017-06-23 14:51:25.
The last success occurred at 2017-05-20 20:55:16.
811 failures have occurred since the last success.

[SERVERold] DsBindWithSpnEx() failed with error 1722,

The RPC server is unavailable..
[Replications Check,SERVERnew] A recent replication attempt failed:

From SERVERold to SERVERnew
Naming Context: DC=DomainDnsZones,DC=DOMAINrenamed,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.

The failure occurred at 2017-06-23 14:51:25.
The last success occurred at 2017-05-20 20:55:16.
811 failures have occurred since the last success.

[Replications Check,SERVERnew] A recent replication attempt failed:
From SERVERold to SERVERnew
Naming Context: CN=Schema,CN=Configuration,DC=DOMAINrenamed,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-06-23 14:52:49.
The last success occurred at 2017-05-20 20:55:15.
811 failures have occurred since the last success.

The source remains down. Please check the machine.

[Replications Check,SERVERnew] A recent replication attempt failed:
From SERVERold to SERVERnew
Naming Context: CN=Configuration,DC=DOMAINrenamed,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-06-23 14:52:07.
The last success occurred at 2017-05-20 20:55:15.
811 failures have occurred since the last success.
The source remains down. Please check the machine.

[Replications Check,SERVERnew] A recent replication attempt failed:
From SERVERold to SERVERnew
Naming Context: DC=DOMAINrenamed,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-06-23 14:51:25.
The last success occurred at 2017-05-20 20:55:15.
811 failures have occurred since the last success.
The source remains down. Please check the machine.
......................... SERVERnew failed test Replications

Starting test: RidManager
......................... SERVERnew passed test RidManager

Starting test: Services
......................... SERVERnew passed test Services

Starting test: SystemLog
An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:32:31
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:37:31
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:42:31
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x0000271A
Time Generated: 06/23/2017 14:46:30
Event String:
The server {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} did not register with DCOM within the required timeout.
An error event occurred. EventID: 0x0000271A
Time Generated: 06/23/2017 14:47:00
Event String:
The server {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} did not register with DCOM within the required timeout.

An error event occurred. EventID: 0x0000271A
Time Generated: 06/23/2017 14:47:31
Event String:
The server {73E709EA-5D93-4B2E-BBB0-99B7938DA9E4} did not register with DCOM within the required timeout.

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:47:31
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:52:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 14:57:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:02:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:07:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:12:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:17:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:22:32
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

An error event occurred. EventID: 0x00000422
Time Generated: 06/23/2017 15:27:33
Event String:
The processing of Group Policy failed. Windows attempted to read the file \\DOMAINrenamed.local\SysVol\DOMAINrenamed.local\Policies\{C54660F4-2E33-44C4-B95B-9913CBB94919}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
......................... SERVERnew failed test SystemLog

Starting test: VerifyReferences
......................... SERVERnew passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation

Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation

Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation

Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation

Running partition tests on : DOMAINrenamed
Starting test: CheckSDRefDom
......................... DOMAINrenamed passed test CheckSDRefDom

Starting test: CrossRefValidation
......................... DOMAINrenamed passed test CrossRefValidation


Running enterprise tests on : DOMAINrenamed.local
Starting test: LocatorCheck
......................... DOMAINrenamed.local passed test LocatorCheck

Starting test: Intersite
......................... DOMAINrenamed.local passed test Intersite

 

[XavierMace]

Most of those errors are replication failures which are too be expected since the other server is turned off. That said, the fact that you were having issues dcpromo'ing the new server is generally a warning sign to stop. I'd review this and make sure you've completed all the steps: https://blogs.technet.microsoft.com...indows-server-2003-to-windows-server-2012-r2/.

 

[HutchinsonJC]

I'll try to clarify some details.

When I first started having problems, the tell tale sign that was obvious, is the internet went down (DNS and/or other issues on the old server). This is where I learned that the guy before me didn't have DNS setup right on the new server because it didn't take over that chore even though all the machines were setup to be pointed at both the old and new server for DNS. I fixed that issue on the new server and got the internet back up for everyone.

The replication issues were happening at this time, the same date and time that our internet went down. I unplugged the old server/shut it down some couple of days later ( after restarts, logs, research, couldn't figure out how to bring full functionality back to the old server). The replication issues were not a result of disconnecting the old server, but rather the issues came up first (DNS stopped working and replication issues) and being an old 2003 server (not supported/updated) I just disconnected it.

I had known the old server was on its last leg, and really wanted to transition everything fast-like to the new server. I had already transitioned the FSMO roles to the new server before this strangeness happened and moved most of the programs/share drives, etc.

The dcpromo I mentioned wasn't being done on the new server. I was making an attempt to retire the old server: to decommission the old 2003 server. I was doing dcpromo command on the old server to retire it. It would always fail, iirc, after typing in the new admin account to be used as a local admin account.

Right now, I want to fix the netlogin sysvol issues I have on our domain. Even if I have to manually do something almost as if the 2003 server was full stop dead/unusable.

I've read a lot of stuff on the net these last two months toward resolving this. Things like folks who had one of their domain controllers die and they had to seize the FSMO roles.

I just haven't been able to find a clear answer how to resolve this netlogin / sysvol issue I've got.

 

[PliotronX]

I struggled with this decommissioning an SBS2008 over an evening. A D4 authoritative restoration and adding the hostname corresponding static addresses into the hosts file of both servers allowed replication to occur. You want to try to remove ADDS from 2003 because if something is not kosher, it will flash a warning as it did for SBS 2008 for me. If the old server has already been scrapped or whatever, you may have to create a new SYSVOL & NETLOGON config. There are guides for this and the D4 everywhere. Good luck and may the force be with you.

 

[HutchinsonJC]

I've got a few D2/D4 guides printed out that I've looked over already, but the state of this old machine is pretty wonky; I'll look into just recreating them as that may be the easiest solution. Didn't know I could do that haha

 

[HutchinsonJC]

Ok, I'm past tombstone.

D2 NonAuthoritative Restore - kinda need a known good member, and you set the nongood members to D2 to resolve their problems
Problem: I don't have a known good member

D4 Authoritative Restore - makes current replica set authoritative for all members
Problem: I don't have a current set? And I may as well be down to one member (one domain controller)

I've seen countless guides of D2/D4 and they involve multiple domain controllers. I'm basically at one dc, which does have all the FSMO roles.

I found a guide called, "Import the Sysvol folder structure" and then it goes on to say "in this procedure, you copy an existing sysvol folder structure on a healthy, online domain controller." Problem: I wouldn't call the Server 2003 OS machine healthy, and it's past tombstone date to boot. (**Edit: how bad would it be to copy it anyway? End Edit**)

you may have to create a new SYSVOL & NETLOGON config

Where's the guides for this? I'm seeing nothing about this.

 

[HutchinsonJC]

I think I've got this issue resolved. Here's my fix:

Copy sysvol folder from SERVERold (or some kind of a backup) to a USB stick.
Plug USB stick into SERVERnew
Stop FRS (File Replication Service)
Copy the Sysvol from USB stick to C:/Windows/Sysvol ------ Merging any folders

When you copy sysvol to USB, the copy on the USB will almost certainly lose all the correct security properties (file permissions). You need to create this .inf which will be used to restore those security permissions after you copy from the USB drive to your SERVERnew.
Make a Sysvol.inf with the following inside and put on C Drive root of the SERVERnew

[Unicode]
Unicode=yes
[Version]
signature="$CHICAGO$"
Revision=1
[Profile Description]
Description=default perms for sysvol
[File Security]

;"%SystemRoot%\SYSVOL",0,"D:AR(A;OICI;FA;;;BA)"

"%Sysvol%",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)"

"%Sysvol%\domain\policies",2,"D:P(A;CIOI;GRGX;;;AU)(A;CIOI;GRGX;;;SO)(A;CIOI;GA;;;BA)(A;CIOI;GA;;;SY)(A;CIOI;GA;;;CO)(A;CIOI;GRGWGXSD;;;PA)"

Make a Sysvol (run as admin).bat with the following inside and put on C Drive root of the SERVERnew

secedit /configure /cfg C:\sysvol.inf /db C:\Windows\sysvol.db /overwrite
​

Execute the Sysvol (run as admin).bat and choose yes on the prompt

Start FRS

Maybe optional, but I rebooted SERVERnew

No more issues propagating policies on the domain. I still have replication issues between SERVERold and SERVERnew so I still need to remove SERVERold from various Active Directory entries and DNS so that it stops trying, but at least I have a sysvol on this domain again.