Replication issues after ungraceful DC restore/restore from backup

Alex McFarland 21 Reputation points
2020-08-06T18:45:23.933+00:00

Hi,

I had a major issue with one of my domain controllers where it could not be gracefully demoted and had to be restored from backup. I know this is a no no but there was no other option at the time. Unfortunately I went back too far, 1 month to be precise, and since then my domain has had some big replication issues. I have been using dcdiag to try and diagnose the issues and I am receiving this error when I attempt to replicate to any of the other DCs from my FSMO master:

TEST: Authentication (Auth)
Error: Authentication failed with specified credentials
[Error details: 1326 (Type: Win32 - Description: The user name or password is incorrect.) - Add connection failed] 

           TEST: Basic (Basc)  
              Error: No LDAP connectivity  
              Error: No WMI connectivity  
              [Error details: 0x80070005 (Type: HRESULT - Facility: Win32, Description: Access is denied.) - Connection to WMI server failed]  
              No host records (A or AAAA) were found for this DC

I do see host records for all of the DCs in ADS&S so I don't understand that error message. At first I believed that this had to do with KDC/Kerberos more than anything because the secure channel between my failed DC & the rest of the domain was broken. Trying to fix the secure channel has been a headache, not really sure where to go from here.

I did find this article useful and I think it pertains to me: https://support.microsoft.com/en-us/help/2002013/active-directory-replication-error-5-access-is-denied

These are the resources/guides that I have tried using:

Any leads would be appreciated as I'm really trying everything to repair this. Once I figure out one error, it leads to another, and so on... Thank you

Also, I did try posting this in TechNet and it keeps redirecting me to here... please let me know if this is incorrect.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,524 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,154 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,034 questions
0 comments

9 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.4K Reputation points MVP
    2020-08-14T20:19:02.59+00:00

    Please run;

    • Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
    • repadmin /showrepl >C:\repl.txt
    • ipconfig /all > C:\dc1.txt
    • ipconfig /all > C:\dc2.txt
    • (etc. as other DC's exist)

    then put unzipped text files up on OneDrive and share a link.

  2. Dave Patrick 426.4K Reputation points MVP
    2020-08-14T21:04:01.933+00:00

    Ok, sounds like you have successfully seized roles
    https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control

    then perform cleanup.
    https://video2.skills-academy.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup

    after cleanup put up the files I requested.

    • Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
    • repadmin /showrepl >C:\repl.txt
    • ipconfig /all > C:\dc1.txt
    • ipconfig /all > C:\dc2.txt
    • (etc. as other DC's exist)

    then put unzipped text files up on OneDrive and share a link.

  3. Dave Patrick 426.4K Reputation points MVP
    2020-08-14T21:21:11.673+00:00

    Please put up the files I requested.

    • Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
    • repadmin /showrepl >C:\repl.txt
    • ipconfig /all > C:\dc1.txt
    • ipconfig /all > C:\dc2.txt
    • (etc. as other DC's exist)

    then put unzipped text files up on OneDrive and share a link.

    0 comments
  4. Hannah Xiong 6,256 Reputation points
    2020-08-17T05:58:13.647+00:00

    Hello Alex,

    Thank you so much for your reply.

    May I know the current situation of our issue? Hope our issue could be resolved soon.

    According to the screenshot of the AD replication, FSMOOld DC is UnHealthyDC1? Have we got any other error messages when checking the AD replication? From the provided screenshot of replication, the replication seems to work properly for other healthy DCs. But as per the UnhealthyDC1, may I know more information about this DC, such as dcdiag, repadmin /showrepl?

    Besides, we also mentioned that the healthy DCs failed some tests, such as Advertising, KCC, DFSRevent and Systemlog. All the healthy DCs have these error messages? More information will be needed to judge these error messages.

    As Dave mentioned, we could help to collect the requested files. Thanks so much for your time and support.

    Best regards,
    Hannah Xiong

    0 comments