Questions[file-replication-services](server)

I have a problem with DFS Replication. I've had replication at our main site working between two member servers for a while, but when I recently added a new site with a server, I ran into a lot of problems with disconnected topologies and syncing the configuration in AD. I finally got all that sorted, and both sites show that replication is active, have the correct targets, and verify topology successfully. All the connections are showing established.

However, none of the replication is happening between sites. The replication continues to operate normally at the main site. There are no recent DFSR errors in the Event Viewer on the servers involved in cross-site replication.

My current topology is that one of the servers at the primary site is functioning as a hub, and has two-way connections to each of the other servers (1 local, one over VPN). The VPN connection is a site-to-site link between two Sonicwall TZ600s.

Any guidance on what to check or look for? Without any errors or failure messages I'm at a loss for next steps.

I have two domain controllers on my network, win2k8dc1 and win2k8dc2.

I am running into event log errors that DFS replication is not able to communicate with the replication partner. This event is logged on DC2:

The DFS Replication service failed to communicate with partner WIN2K8DC1 for replication group Domain System Volume. The partner did not recognize the connection or the replication group configuration.
Partner DNS Address: WIN2K8DC1.JEWELS.LOCAL Optional data if available: Partner WINS Address: WIN2K8DC1 Partner IP Address: 192.168.1.254 The service will retry the connection periodically. Additional Information: Error: 9026 (The connection is invalid) Connection ID: F26BEC3F-1EB7-4002-BE66-6204485CDC8C Replication Group ID: E0260157-9085-41F7-8912-F1A02026A0A5

These errors are not being generated on DC1. Both machines are able to ping by ip, fqdn, and a records.

Active directory seems to replicate perfectly fine. If an object or ou is created on one server it is replicated to the second. DNS replication seems to be fine as well.

Running DCDIAG I received the following errors:

Starting test: DFSREvent

The DFS Replication Event Log. 
There are warning or error events within the last 24 hours after the

SYSVOL has been shared.  Failing SYSVOL replication problems may cause

Group Policy problems. 
An error event occurred.  EventID: 0xC0001394

Time Generated: 01/04/2012   17:00:45
Event String:

The DFS Replication service failed to communicate with partner WIN2K8DC2 for replication group Domain System Volume. The partner did not recognize the connection or the replication group configuration. 

Partner DNS Address: WIN2K8DC2.JEWELS.LOCAL

Optional data if available: 
Partner WINS Address: WIN2K8DC2 
Partner IP Address: 192.168.1.253 

The service will retry the connection periodically. 

Additional Information: 
Error: 9026 (The connection is invalid) 
Connection ID: 04854E9E-07E3-4A3E-BA6C-F3FBAB67B21F 
Replication Group ID: E0260157-9085-41F7-8912-F1A02026A0A5
An error event occurred.  EventID: 0xC0001394
Time Generated: 01/05/2012   03:00:42
......................... WIN2K8DC1 failed test DFSREvent

I checked the attributes for domain controller: msDFSR-ComputerReferenceBL. Each DC has a value where the CN equals itself. The msDFSR-MemberReferenceBL value is null. I can not manually edit either of these two values.

Another error in the DCDIAG output is the NCSecDesc test, which when researched said to ignore if I do not use RODC. Both servers fail this test.

Both servers have a DCOM error reporting that DCOM was unable to communicate with the computer using any configured protocols. I can ping the IPs of out forwarders however..

All DNS test results PASSED with dcdiag.

The dcdiag attributes that I ran are: dcdiag /v /c /d /e /s:win2k8dc1 > c:\dcdiag.txt and the same on win2k8dc2.

FRSDiag utility returned the following error on DC1:

Checking for errors in debug logs ...
    ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain:                     3580:   904: S0: 12:33:01> :SR: Cmd 00388bb0, CxtG f26bec3f, WS ERROR_ACCESS_DENIED, To   WIN2K8DC1.JEWELS.LOCAL Len:  (544) [SndFail - Send Penalty]
    ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain:                      260:   877: S0: 12:33:01> :SR: Cmd 00388130, CxtG 04854e9e, WS ERROR_ACCESS_DENIED, To   WIN2K8DC1.JEWELS.LOCAL Len:  (376) [SndFail - rpc call]
    ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain:                      260:   904: S0: 12:33:01> :SR: Cmd 00388130, CxtG 04854e9e, WS ERROR_ACCESS_DENIED, To   WIN2K8DC1.JEWELS.LOCAL Len:  (376) [SndFail - Send Penalty]

    Found 8 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above

 ......... failed with 8 error entries

When trying to run FRSDiag from DC1 against DC2 I get the following error:

   Processing ntfrsutl ds....NTFRSUTL ERROR - Cannot RPC to computer, win2k8dc2; 000006d9 (1753)... Make sure you are logged on as a Domain Admin! Skipping!

I am starting to getting stumped, as this is getting over my head. Wanted to check here before I proceed with the next step and contact the MS AD tech support..

Additions: UAC is off. No firewall is on either server. The functionality level is windows server 2008.

dfsrdiag dumpadcfg output:

LDAP Bind   : WIN2K8DC1.JEWELS.LOCAL
SitesDn     : cn=sites,cn=configuration,dc=jewels,dc=local
ServicesDn  : cn=services,cn=configuration,dc=jewels,dc=local
SystemDn    : cn=system,DC=JEWELS,DC=LOCAL
DefaultNcDn : DC=JEWELS,DC=LOCAL
ComputersDn : cn=computers,DC=JEWELS,DC=LOCAL
DomainCtlDn : ou=domain controllers,DC=JEWELS,DC=LOCAL
SchemaDn    : CN=Schema,CN=Configuration,DC=JEWELS,DC=LOCAL

COMPUTER: WIN2K8DC1
  DN            : cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
  GUID          : 53A64969-227C-40AA-BD93-3C46782765DA
  DNS           : win2k8dc1.jewels.local
  Server BL     : cn=win2k8dc1,cn=servers,cn=default-first-site-name,cn=sites,cn
=configuration,dc=jewels,dc=local
  Server Ref    : (null)
  USN Changed   : 5682458
  When Created  : Tuesday, August 10, 2010 3:02:33 PM
  When Changed  : Wednesday, January 04, 2012 6:30:57 PM

  LOCAL SETTINGS: DFSR-LOCALSETTINGS
    DN            : cn=dfsr-localsettings,cn=win2k8dc1,ou=domain controllers,dc=
jewels,dc=local
    GUID          : 6EE6D3C7-09C4-4A9E-BFCF-A4D5CE129320
    Version       : 1.0.0.0
    USN Changed   : 5685331
    When Created  : Wednesday, January 04, 2012 8:58:32 PM
    When Changed  : Wednesday, January 04, 2012 9:00:49 PM

    SUBSCRIBER: DOMAIN SYSTEM VOLUME
      DN            : cn=domain system volume,cn=dfsr-localsettings,cn=win2k8dc1
,ou=domain controllers,dc=jewels,dc=local
      GUID          : 2C9380BE-39BE-49C9-87CA-82AA8483A5C8
      Member Ref    : cn=win2k8dc1,cn=topology,cn=domain system volume,cn=dfsr-g
lobalsettings,cn=system,dc=jewels,dc=local
      USN Changed   : 5685297
      When Created  : Wednesday, January 04, 2012 8:58:33 PM
      When Changed  : Wednesday, January 04, 2012 8:58:33 PM

      SUBSCRIPTION: SYSVOL SUBSCRIPTION
        DN            : cn=sysvol subscription,cn=domain system volume,cn=dfsr-l
ocalsettings,cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
        GUID          : 3A9F879D-CB16-4484-8F22-703B8ACF3B11
        ContentSetGuid: 0E31CFFA-FCD2-4A5D-8739-9277B0EF8478
        Root Path     : c:\windows\sysvol_dfsr\domain
        Root Size     : (null) (MB)
        Staging Path  : (null)
        Staging Size  : (null) (MB)
        Conflict Path : (null)
        Conflict Size : (null) (MB)
        USN Changed   : 5685489
        When Created  : Wednesday, January 04, 2012 8:58:33 PM
        When Changed  : Wednesday, January 04, 2012 9:05:34 PM

GLOBAL SETTINGS: DFSR-GLOBALSETTINGS
  DN            : cn=dfsr-globalsettings,cn=system,dc=jewels,dc=local
  GUID          : 30E9760E-6020-4DFD-A975-134F2C809A4D
  USN Changed   : 5685310
  When Created  : Wednesday, January 04, 2012 8:57:53 PM
  When Changed  : Wednesday, January 04, 2012 8:59:39 PM

  REPLICATION GROUP: DOMAIN SYSTEM VOLUME
    DN            : cn=domain system volume,cn=dfsr-globalsettings,cn=system,dc=
jewels,dc=local
    GUID          : E0260157-9085-41F7-8912-F1A02026A0A5
    Type          : 1 (SYSVOL)
    USN Changed   : 5685278
    When Created  : Wednesday, January 04, 2012 8:57:53 PM
    When Changed  : Wednesday, January 04, 2012 8:57:53 PM

    CONTENT: CONTENT
      DN            : cn=content,cn=domain system volume,cn=dfsr-globalsettings,
cn=system,dc=jewels,dc=local
      GUID          : 776B3EE9-6FF6-4929-A0B5-DC1256C330FE
      USN Changed   : 5685279
      When Created  : Wednesday, January 04, 2012 8:57:53 PM
      When Changed  : Wednesday, January 04, 2012 8:57:53 PM

      CONTENT SET: SYSVOL SHARE
        DN            : cn=sysvol share,cn=content,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
        GUID          : 0E31CFFA-FCD2-4A5D-8739-9277B0EF8478
        File Filter   : (null)
        Compression Excl : (null)
        Dir Filter    : DO_NOT_REMOVE_NtFrs_PreInstall_Directory,NtFrs_PreExisti
ng___See_EventLog
        USN Changed   : 5685280
        When Created  : Wednesday, January 04, 2012 8:57:53 PM
        When Changed  : Wednesday, January 04, 2012 8:57:53 PM

    TOPOLOGY: TOPOLOGY
      DN            : cn=topology,cn=domain system volume,cn=dfsr-globalsettings
,cn=system,dc=jewels,dc=local
      GUID          : DB1E6BF2-9745-4B04-AD15-19E559502D4B
      USN Changed   : 5685281
      When Created  : Wednesday, January 04, 2012 8:57:53 PM
      When Changed  : Wednesday, January 04, 2012 8:57:53 PM

      MEMBER: WIN2K8DC1
        DN            : cn=win2k8dc1,cn=topology,cn=domain system volume,cn=dfsr
-globalsettings,cn=system,dc=jewels,dc=local
        GUID          : BCAFE60C-2DFF-4BC0-85A4-22F66C96B043
        Server Ref    : cn=ntds settings,cn=win2k8dc1,cn=servers,cn=default-firs
t-site-name,cn=sites,cn=configuration,dc=jewels,dc=local
        Computer Ref  : cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
        Keywords      : (null)
        Computer DNS  : win2k8dc1.jewels.local
        USN Changed   : 5685293
        When Created  : Wednesday, January 04, 2012 8:58:32 PM
        When Changed  : Wednesday, January 04, 2012 8:58:32 PM

        CXTION: D0736C4D-B39D-4521-B4AF-5D8B7E627280
          DN            : cn=d0736c4d-b39d-4521-b4af-5d8b7e627280,cn=ntds settin
gs,cn=win2k8dc1,cn=servers,cn=default-first-site-name,cn=sites,cn=configuration,
dc=jewels,dc=local
          GUID          : 04854E9E-07E3-4A3E-BA6C-F3FBAB67B21F
          Inbound       : true
          Partner DN    : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
          USN Changed   : 2830713
          When Created  : Wednesday, April 13, 2011 8:12:57 PM
          When Changed  : Friday, August 19, 2011 1:02:17 PM

        CXTION: C21C575F-EEB2-44E9-A464-85E4833963B5
          DN            : cn=c21c575f-eeb2-44e9-a464-85e4833963b5,cn=ntds settin
gs,cn=win2k8dc2,cn=servers,cn=default-first-site-name,cn=sites,cn=configuration,
dc=jewels,dc=local
          GUID          : F26BEC3F-1EB7-4002-BE66-6204485CDC8C
          Inbound       : false
          Partner DN    : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
          USN Changed   : 4927588
          When Created  : Wednesday, April 13, 2011 8:12:40 PM
          When Changed  : Tuesday, December 13, 2011 9:41:33 PM

      MEMBER: WIN2K8DC2
        DN            : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=dfsr
-globalsettings,cn=system,dc=jewels,dc=local
        GUID          : 1AF9DFAD-9793-4B3D-BE1B-5A497857C4E6
        Server Ref    : cn=ntds settings,cn=win2k8dc2,cn=servers,cn=default-firs
t-site-name,cn=sites,cn=configuration,dc=jewels,dc=local
        Computer Ref  : cn=win2k8dc2,ou=domain controllers,dc=jewels,dc=local
        Keywords      : (null)
        Computer DNS  : win2k8dc2.jewels.local
        USN Changed   : 5685434
        When Created  : Wednesday, January 04, 2012 9:01:29 PM
        When Changed  : Wednesday, January 04, 2012 9:01:45 PM

Operation Succeeded

I noticed a problem when setting up GPOs that some settings were copied to the local computer's registry, while some didn't. Although they are in the very same GPO. So I checked the EventViewer and noticed this error. Also, I checked the sysvol folders on both Domain Controllers and noticed that the files are not the same at all. The version number on the policies are also not the same.

It's a bit similar to Windows Server 2003 SP2 - JRNL_WRAP_ERROR (Sysvol)

But we have two domain controllers that are set up to replicate each other. So I restarted the replication service on both domain controllers and this EventID: 13568 was added to the event viewer almost immediatly. So where should I start to troubleshoot this?

Edit: After reading this link http://blogs.technet.com/b/instan/archive/2009/07/14/what-happens-in-a-journal-wrap.aspx I see that the approach d2 might be the one I should go for. But how do I know which one of the domain controllers is the "newest" one? Should I just compare files from the sysvol folder? Also, what's the worst thing that could happen if I go for approach d2?

Edit2: I just did the approach D2 about half an hour ago. I stopped the file replication service. Reset the registry setting to D2 and restartet the file replication service. Noticed immediatly that the D2 was reset to 0. Then I went ahead and checked the sysvol folder on the server. There's a folder there now called "NtFrs_PreExisting___See_EventLog", but there's no other content there. In the event viewer, I see a 13565 informing me that the replication is starting. But two minutes after, there's a 13508 error. This alone doesn't have to be a bad thing according to the KB article, but in 4 hours, a 13509 should be present. If 13509 isn't present in that time, these are the other possibilities, according to the description in error 13508:

1. FRS can not correctly resolve the DNS name dc2.mydomain.com from this computer.
2. FRS is not running on dc2.mydomain.com

3. The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

4. From the problem server, I tried to run ping dc2 and run nslookup and everything checks out just fine from what I can tell. Neither of the domain controllers have Windows Firewall activated. And NTFRSUTL VERSION works just fine on both. Also, Replication Service is active and running on both DCs.

I am trying to setup a fileserver in different geographical locations on a centos based linux server. Currently I am planning to have two such servers now and will be extending that to other areas in the near future. The file servers should be mirroring itself when a file is added in any of the location(I am yet to arrive at a deletion strategy, but just thinking should allow deletion of files when it is deleted from the primary server). Currently I am thinking I will have apache "directory listing" and rsync to do this work. I just want to know if there are any better tools to do the above. Also I would like to hear some suggestions on a better directory listing script(php/python based). It would be good if this tools has some search capabilities, options to upload files, etc(Am I asking too much ? ;) ).

Note: The current server also hosts a subversion replication. I also thought about committing all files into subversion and get it checked out in the secondary location. But I feel space would be a constraint as I would have keep removing some unwanted files so that I will have diskspace under control, this will not be possible as svn's version history will hold the data

Thanks in advance.

I have 3 Domain Controllers. We will call them DC1, DC2 and DC3. DC3 and DC2 show Event ID 13508 in their FRS logs with no follow-up event(13509 I think) to say the error had been fixed. DC1's FRS log no matter what you do never shows any events besides FRS service stopped and started.

DC1 holds the SYSVOL that needs to be replicated to the other DC's. The other DC's sysvol folders are empty.

I have tried the burflag method of fixing this but I haven't had any luck. My procedure for that was to stop all FRS services on all DC's. Then set the burflag on DC1 to D4 and the other two DCs burflag to D2. Started FRS on DC1 and the only event's I see in DC1's FRS event logs are service stopped and service started messages. This fact is leading me to believe that something is wrong on FRS for DC1. I believe there should be events 13553 and 13516 in the FRS event logs after an authoritative sysvol restore.

The other two DC's do not have anything in their SYSVOL, otherwise I would have made one of them the authoritative sysvol.

DC1 is MS Server 2003 Enterprise Edition SP2 DC2 is MS Server 2003 Standard Edition SP1 DC3 is MS Server 2003 R2 Standard Edition SP2

I did not setup this domain originally but I am now the administrator of it, so I don't have a lot of background on why certain things may have been done in the past.

My main goal is to try and fix these issues to get myself better prepared to decommision DC1 and add a DC running Server 2008 to my domain.

Thanks.