Urgent Advice --- Active Directory Replication Issues across Sites

Scott D 1 Reputation point
2020-12-13T21:20:42.75+00:00

We apparently appear to be having some replication issues across several sites in our network. We have 5 total sites with the Site-1 being the main site and where the FSMO holder is housed. Changes appear to be moving across the other sites in AD since I can see changes at all locations, but if I do a repmadin /replsum, at Site-1, we get almost everything looking good, except for the status of one location. It just doesn't show up in the Source DSA or Dest DSA? This is Site-3. Not sure why that doesn't show up in there?

Now if I go to either Site 2,3,4 or 5, I see errors for each of the other 3 sites. I don't get an error for Site-1, just the others,

For example, If I do a repadmin /replsum at Site-2, I'll get:

Source DSA largest delta fails/total %% error
server1/Site1 22m:49s 0 / 10 0
server2/Site1 58m:35s 0 / 15 0
server3/Site1 22m:34s 0 / 10 0
Server/Site-4 08m:08s 0 / 5 0
Server/Site-2 14m:01s 0 / 5 0

Destination DSA largest delta fails/total %% error
server2/Site-1 08m:27s 0 / 15 0
server3/Site-1 23m:09s 0 / 15 0
server4/Site-1 59m:20s 0 / 10 0
Server/Site-2 03m:31s 0 / 5 0

Experienced the following operational errors trying to retrieve replication info
rmation:
58 - Server/Site-3
58 - Server/Site-4
58 - Server/Site-5

If I go to Site-3 -- I'll see pretty close to the same thing, with errors at sites 2, 4 and 5 at the bottom with the Error 58.
Only at Site-3 do I not also see it in the "Destination DSA" section like I do for all of the other sites. Maybe that's a separate issue for that server/site.

My question is are those sites just not supposed to talk to the other sites? I see some other sites getting the information to one or two others sites, but not all of them?

Also, is all of this setup in the Sites and Services -- Site -- Server -- NTDS Settings? Or is that for something else?

sorry -- I've never totally 100% understood these settings and information. I feel like I know most of it, but am just not understanding what's happening and what's it's showing. I'm also seeing some errors in repadmin /showrepl on Sites 2,3,4 and 5. Site-1, the main site seems ok, other than it's missing Server1/Site-3.

ource DSA largest delta fails/total %% error
server1/Site1 22m:49s 0 / 10 0
server2/Site1 58m:35s 0 / 15 0
server3/Site1 22m:34s 0 / 10 0
Server/Site-4 08m:08s 0 / 5 0
Server/Site-2 14m:01s 0 / 5 0

Destination DSA largest delta fails/total %% error
server2/Site-1 08m:27s 0 / 15 0
server3/Site-1 23m:09s 0 / 15 0
server4/Site-1 59m:20s 0 / 10 0
server/Site-4 11m:24s 0 / 5 0
server/Site-5 12m:38s 0 / 5 0
Server/Site-2 03m:31s 0 / 5 0

No Site-3 on that repadmin /replsum from the main Site-1 server.

Based on all of this, what do you think it's causing these issues?

dcdaig also shows some issues:

The attempt to establish a replication link for the following writable directory partition failed.
A warning event occurred. EventID: 0x80000785

As well as:

REPLICATION-RECEIVED LATENCY WARNING
Server/Site-4: Current time is 2020-12-13 16:11:41.
DC=ForestDnsZones,DC=Domain,DC=local
Last replication received from server/site-3 at
2020-09-16 23:41:20
WARNING: This latency is over the Tombstone Lifetime of 60
days!
Last replication received from server/site-5 at
2020-11-01 13:35:13
DC=DomainDnsZones,DC=Domain,DC=local
Last replication received from server/site-3 at
2020-09-16 23:41:20
WARNING: This latency is over the Tombstone Lifetime of 60
days!
Last replication received from server/site-5 at
2020-11-01 13:35:13
CN=Schema,CN=Configuration,DC=Domain,DC=local
Last replication received from server/site-3 at
2020-09-16 23:41:20
WARNING: This latency is over the Tombstone Lifetime of 60
days!
Last replication received from server/site-5 at
2020-11-01 13:35:13
CN=Configuration,DC=Domain,DC=local
Last replication received from server/site-3 at
2020-09-16 23:41:20
WARNING: This latency is over the Tombstone Lifetime of 60
days!
Last replication received from server/site-5 at
2020-11-01 13:35:13
DC=Domain,DC=local
Last replication received from server/site-3 at
2020-09-16 23:41:20
WARNING: This latency is over the Tombstone Lifetime of 60
days!
Last replication received from server/site-5 at
2020-11-01 13:35:12

Sorry -- I know this was a lot, but I think it's all inter-related?
Thanks a TON for any help on figuring this out!!

Appreciate it!

Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,599 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,644 questions
Windows Server Infrastructure
Windows Server Infrastructure
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Infrastructure: A Microsoft solution area focused on providing organizations with a cloud solution that supports their real-world needs and meets evolving regulatory requirements.
552 questions
{count} votes

7 answers

Sort by: Most helpful
  1. Scott D 1 Reputation point
    2020-12-14T12:59:08.017+00:00

    after doing some more digging, I have seen that the site-to-site VPNs can only get back to the main site. So sites 2,3,4 and 5 cannot see each other. We did that for some more protection so one site could not potentially hurt the others.

    Based on this, should we possibly implement read-only DCs at the other sites? I'm not as concerned about the sites not seeing each other in AD, just would not like to see the errors on a repadmin /replsum. Also, based on this and Site-1 being the main site in a hub and spoke configuration, how would I need to setup the remote sites in AD? In sites and services?

    Thanks all!

    0 comments No comments

  2. Anonymous
    2020-12-14T13:36:28.8+00:00

    The discussion here seems have moved away from fixing what's broken to site design. I'd suggest working through this one for specifics on site design.
    https://video2.skills-academy.com/en-us/windows-server/identity/ad-ds/plan/designing-the-site-topology

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.