NTDS replication failed on restored DC - Windows server 2008 R2 Enterprise

Y Joe 61 Reputation points
2020-07-29T14:43:41.467+00:00

We have 2 DCs (Windows server 2008 R2 Enterprise) in our exchange domain in hyper-V environment,, as one of them (not the GC) failed to startup properly after applying patch, we have restored it with the backup a day before.

The DC was restored with non-authoritative mode with the procedure in the link below, and boot into DSRM on the first boot,
https://www.veeam.com/blog/how-to-recover-a-domain-controller-best-practices-for-ad-protection.html

After restoring, the NTDS replication between servers failed with the error “The target principal name is incorrect”.

we found a solution in the link below

https://support.microsoft.com/en-us/help/2090913/active-directory-replication-error-2146893022-the-target-principal-nam

In the first normal boot of the restored DC,- DNS on the restored DC can be launched

  • Repadmin /replicate successful from GC to DC
  • REPADMIN /SHOWREPS all passed
  • REPADMIN /SHOWREPL all passed
  • REPADMIN /replsummary with “The target principal name is incorrect” error- REPADMIN /SYNCALL with “The target principal name is incorrect” and exited with fatal Win32 error: 8440 (0x20f8)

After the above test and rebooting the restored DC, DNS failed to launch with access denied error. Some connectivity test failed as well.

As the top resolution in the above link doesn’t resolve the issue, it is suggested changing the password on the PDC Emulator operations master role holder with netdom resetpwd.

https://support.microsoft.com/en-sg/help/288167/error-message-target-principal-name-is-incorrect-when-manually-replica
which means we have to make amendment on GC ( currently the only workable DC) in production site. We hope to know is there any alternative in stead of making amendment on the GC.

Any one has idea on how to solve the replication error with “The target principal name is incorrect”? Thank you.

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,154 questions
0 comments
Accepted answer
  1. Dave Patrick 426.4K Reputation points MVP
    2020-07-29T14:50:37.213+00:00

    The normal procedure for a failed domain controller is to seize roles to a healthy one.
    https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control

    then perform cleanup.
    https://video2.skills-academy.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup

    then after repairs rebuild the failed one from clean installation media.

    0 comments

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Y Joe 61 Reputation points
    2020-07-29T14:55:58.54+00:00

    DSPatrick, thanks for replying.

    Do you mean it's better for us to remove the DC? is there any method to solve the NTDS replication issue? Thanks.

  2. Dave Patrick 426.4K Reputation points MVP
    2020-08-03T13:22:56.203+00:00

    Yes, the cleaner much safer method for a failed domain controller would have been to seize roles to a healthy one.
    https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control

    then perform cleanup.
    https://video2.skills-academy.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup

    then after repairs rebuild the failed one from clean installation media.

    as to current errors the event logs may provide some clues and this one might help.
    https://support.microsoft.com/en-us/help/2090913/active-directory-replication-error-2146893022-the-target-principal-nam

    --please don't forget to Accept as answer if the reply is helpful--

  3. Y Joe 61 Reputation points
    2020-08-24T00:50:30.393+00:00

    Thanks all, finally I have gone for DSPatrick's suggestion.

    power off the failed DC for days, check if everything works normal, then remove the failed one manually on the functional DC, installed a new one.

    Thank you.

    0 comments
  4. Dave Patrick 426.4K Reputation points MVP
    2020-08-24T01:49:54.767+00:00

    Sounds good, you're welcome.

    0 comments