Active Directory Catalog Replication Not Complete (Network Steve Forum)

Active Directory Catalog Replication Not Complete

Hi There,

I tried dc promo new server to be primary domain controller before replication completed from old domain controller. How to resolve this issue. Thanks.

Here is the DCDiag log from the new server. If you are not able to access through this link( https://drive.google.com/file/d/0B_kVgtolSFXGNHVtbjczdWJuaWNZdW51d3lnc2paTG5zSmJv/view?usp=sharing ):

Directory Server Diagnosis

Performing initial setup:

Trying to find home server...

* Verifying that the local machine INTSRV, is a Directory Server.
Home Server = INTSRV

* Connecting to directory service on server INTSRV.

   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.

   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=integricity,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
   Getting ISTG and options for the site
   * Identifying all servers.

   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=integricity,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.

* Found 1 DC(s). Testing 1 of them.

Done gathering initial info.

Doing initial required tests

Testing server: HQ\INTSRV

Starting test: Connectivity

         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         * Active Directory RPC Services Check
         ......................... INTSRV passed test Connectivity

Doing primary tests

Testing server: HQ\INTSRV

Starting test: Advertising

         The DC INTSRV is advertising itself as a DC and having a DS.
         The DC INTSRV is advertising as an LDAP server
         The DC INTSRV is advertising as having a writeable directory
         The DC INTSRV is advertising as a Key Distribution Center
         The DC INTSRV is advertising as a time server
         Warning: INTSRV has not finished promoting to be a GC.

Check the event log for domains that cannot be replicated.

Warning: INTSRV is not advertising as a global catalog.

Check that server finished GC promotion.

Check the event log on server that enough source replicas for the GC

are available.

......................... INTSRV failed test Advertising

Starting test: CheckSecurityError

         * Dr Auth: Beginning security errors check!
         Found KDC INTSRV for domain integricity.com in site HQ
         Checking machine account for DC INTSRV on DC INTSRV.
         * SPN found :LDAP/INTSRV.integricity.com/integricity.com
         * SPN found :LDAP/INTSRV.integricity.com
         * SPN found :LDAP/INTSRV
         * SPN found :LDAP/INTSRV.integricity.com/INTEGRICITY
         * SPN found :LDAP/5c4b560f-8cca-4edd-adc2-64584b032eab._msdcs.integricity.com
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5c4b560f-8cca-4edd-adc2-64584b032eab/integricity.com
         * SPN found :HOST/INTSRV.integricity.com/integricity.com
         * SPN found :HOST/INTSRV.integricity.com
         * SPN found :HOST/INTSRV
         * SPN found :HOST/INTSRV.integricity.com/INTEGRICITY
         * SPN found :GC/INTSRV.integricity.com/integricity.com
         [INTSRV] No security related replication errors were found on this DC!

To target the connection to a specific source DC use

/ReplSource:<DC>.

......................... INTSRV passed test CheckSecurityError

Starting test: CutoffServers

         * Configuration Topology Aliveness Check
         * Analyzing the alive system replication topology for DC=ForestDnsZones,DC=integricity,DC=com.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for DC=DomainDnsZones,DC=integricity,DC=com.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for CN=Schema,CN=Configuration,DC=integricity,DC=com.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for CN=Configuration,DC=integricity,DC=com.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         * Analyzing the alive system replication topology for DC=integricity,DC=com.
         * Performing upstream (of target) analysis.
         * Performing downstream (of target) analysis.
         ......................... INTSRV passed test CutoffServers

Starting test: FrsEvent

* The File Replication Service Event log test
Skip the test because the server is running DFSR.

......................... INTSRV passed test FrsEvent

Starting test: DFSREvent

The DFS Replication Event Log.
There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
A warning event occurred. EventID: 0x80001396

Time Generated: 05/25/2015 03:00:59

Event String:

The DFS Replication service is stopping communication with partner TEC-SERV-001 for replication group Domain System Volume due to an error. The service will retry the connection periodically.

Additional Information:

Error: 9036 (Paused for backup or restore)

Connection ID: A8B31CBD-C5AD-46C9-B0CD-7FDF960CBC7E

Replication Group ID: 0FF19654-A1A0-495E-8324-F62AB20CD4FB

A warning event occurred. EventID: 0x80001396

Time Generated: 05/25/2015 09:30:22

Event String:

The DFS Replication service is stopping communication with partner TEC-SERV-001 for replication group Domain System Volume due to an error. The service will retry the connection periodically.

Additional Information:

Error: 1723 (The RPC server is too busy to complete this operation.)

Connection ID: A8B31CBD-C5AD-46C9-B0CD-7FDF960CBC7E

Replication Group ID: 0FF19654-A1A0-495E-8324-F62AB20CD4FB

An error event occurred. EventID: 0xC000138A

Time Generated: 05/25/2015 09:30:36

Event String:

The DFS Replication service encountered an error communicating with partner TEC-SERV-001 for replication group Domain System Volume.

Partner DNS address: TEC-SERV-001.integricity.com

Optional data if available:

Partner WINS Address: TEC-SERV-001

Partner IP Address: 192.168.48.20

The service will retry the connection periodically.

Additional Information:

Error: 1753 (There are no more endpoints available from the endpoint mapper.)

Connection ID: A8B31CBD-C5AD-46C9-B0CD-7FDF960CBC7E

Replication Group ID: 0FF19654-A1A0-495E-8324-F62AB20CD4FB

......................... INTSRV failed test DFSREvent

Starting test: SysVolCheck

         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... INTSRV passed test SysVolCheck

Starting test: FrsSysVol

         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... INTSRV passed test FrsSysVol

Starting test: KccEvent

* The KCC Event log test
An event occurred. EventID: 0x40000617

Time Generated: 05/25/2015 14:17:41

Event String:

The local domain controller has been selected to be a global catalog. However, the domain controller does not host a read-only replica of the following directory partition.

Directory partition:

DC=technology,DC=integricity,DC=com

A precondition to becoming a global catalog is that a domain controller must host a read-only replica of all directory partitions in the forest. This event might have occurred because a Knowledge Consistency Checker (KCC) task has not completed or because the domain controller is unable to add a replica of the directory partition due to unavailable source domain controllers.

An attempt to add the replica will be tried again at the next KCC interval.

An event occurred. EventID: 0x4000062A

Time Generated: 05/25/2015 14:17:41

Event String:

Promotion of the local domain controller to a global catalog has been delayed because the directory partition occupancy requirements have not been met. The occupancy requirement level and current domain controller level are as follows.

Occupancy requirement level:

Domain controller level:

The following registry key value defines the directory partition occupancy requirement level.

Registry key value:

HKeyLocalMachine\System\ CurrentControlSet\Services\NTDS\Parameters\Global Catalog Partition Occupancy

Higher occupancy requirement levels include the lower levels. The levels are defined as follows:

(0) Indicates no occupancy requirement.

(1) Indicates at least one read-only directory partition in the site has been added by the Knowledge Consistency Checker (KCC).

(2) Indicates at least one directory partition in the site has been fully synchronized.

(3) Indicates all read-only directory partitions in the site have been added by the KCC (at least one has been synchronized).

(4) Indicates all directory partitions in the site have been fully synchronized.

(5) Indicates all read-only directory partitions in the forest have been added by the KCC (at least one has been synchronized).

(6) Indicates all directory partitions in the forest have been fully synchronized.

An event occurred. EventID: 0x40000456

Time Generated: 05/25/2015 14:17:41

Event String:

Promotion of this domain controller to a global catalog will be delayed for the following interval.

Interval (minutes):

This delay is necessary so that the required directory partitions can be prepared before the global catalog is advertised. In the registry, you can specify the number of seconds that the directory system agent will wait before promoting the local domain controller to a global catalog. For more information about the Global Catalog Delay Advertisement registry value, see the Resource Kit Distributed Systems Guide.

An error event occurred. EventID: 0xC0000466

Time Generated: 05/25/2015 14:18:30

Event String:

Active Directory Domain Services was unable to establish a connection with the global catalog.

Additional Data

Error value:

1355 The specified domain either does not exist or could not be contacted.

Internal ID:

32013c0

User Action:

Make sure a global catalog is available in the forest, and is reachable from this domain controller. You may use the nltest utility to diagnose this problem.

......................... INTSRV failed test KccEvent

Starting test: KnowsOfRoleHolders

         Role Schema Owner = CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
         Role Domain Owner = CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
         Role PDC Owner = CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
         Role Rid Owner = CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com
         ......................... INTSRV passed test KnowsOfRoleHolders

Starting test: MachineAccount

         Checking machine account for DC INTSRV on DC INTSRV.
         * SPN found :LDAP/INTSRV.integricity.com/integricity.com
         * SPN found :LDAP/INTSRV.integricity.com
         * SPN found :LDAP/INTSRV
         * SPN found :LDAP/INTSRV.integricity.com/INTEGRICITY
         * SPN found :LDAP/5c4b560f-8cca-4edd-adc2-64584b032eab._msdcs.integricity.com
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5c4b560f-8cca-4edd-adc2-64584b032eab/integricity.com
         * SPN found :HOST/INTSRV.integricity.com/integricity.com
         * SPN found :HOST/INTSRV.integricity.com
         * SPN found :HOST/INTSRV
         * SPN found :HOST/INTSRV.integricity.com/INTEGRICITY
         * SPN found :GC/INTSRV.integricity.com/integricity.com
         ......................... INTSRV passed test MachineAccount

Starting test: NCSecDesc

* Security Permissions check for all NC's on DC INTSRV.
* Security Permissions Check for

           DC=ForestDnsZones,DC=integricity,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for

           DC=DomainDnsZones,DC=integricity,DC=com
            (NDNC,Version 3)
         * Security Permissions Check for

           CN=Schema,CN=Configuration,DC=integricity,DC=com
            (Schema,Version 3)
         * Security Permissions Check for

           CN=Configuration,DC=integricity,DC=com
            (Configuration,Version 3)
         * Security Permissions Check for

           DC=integricity,DC=com
            (Domain,Version 3)
         ......................... INTSRV passed test NCSecDesc

Starting test: NetLogons

         * Network Logons Privileges Check
         Verified share \\INTSRV\netlogon
         Verified share \\INTSRV\sysvol
         ......................... INTSRV passed test NetLogons

Starting test: ObjectsReplicated

         INTSRV is in domain DC=integricity,DC=com
         Checking for CN=INTSRV,OU=Domain Controllers,DC=integricity,DC=com in domain DC=integricity,DC=com on 1 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=INTSRV,CN=Servers,CN=HQ,CN=Sites,CN=Configuration,DC=integricity,DC=com in domain CN=Configuration,DC=integricity,DC=com on 1 servers
            Object is up-to-date on all servers.
         ......................... INTSRV passed test ObjectsReplicated

Starting test: OutboundSecureChannels

* The Outbound Secure Channels test
** Did not run Outbound Secure Channels test because /testdomain: was

not entered

......................... INTSRV passed test OutboundSecureChannels

Starting test: Replications

         * Replications Check
         * Replication Latency Check
            DC=ForestDnsZones,DC=integricity,DC=com
               Latency information for 3 entries in the vector were ignored.
                  3 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
            DC=DomainDnsZones,DC=integricity,DC=com
               Latency information for 2 entries in the vector were ignored.
                  2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
            CN=Schema,CN=Configuration,DC=integricity,DC=com
               Latency information for 3 entries in the vector were ignored.
                  3 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
            CN=Configuration,DC=integricity,DC=com
               Latency information for 3 entries in the vector were ignored.
                  3 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
            DC=integricity,DC=com
               Latency information for 2 entries in the vector were ignored.
                  2 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency information (Win2K DC).
         ......................... INTSRV passed test Replications

Starting test: RidManager

         * Available RID Pool for the Domain is 2600 to 1073741823
         * INTSRV.integricity.com is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 2100 to 2599
         * rIDPreviousAllocationPool is 2100 to 2599
         * rIDNextRID: 2100
         ......................... INTSRV passed test RidManager

Starting test: Services

         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: DFSR
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... INTSRV passed test Services

Starting test: SystemLog

* The System Event log test
An error event occurred. EventID: 0x0000272C

Time Generated: 05/25/2015 14:13:23

Event String:

DCOM was unable to communicate with the computer 203.115.225.25 using any of the configured protocols; requested by PID 13ac (C:\Windows\system32\dcdiag.exe).