In circumstances in which the time has been out of sync for so long that the
DC's own Kerberos tickets have expired, you must disable the Key Distribution
Center (KDC) on the DC and reboot. (To disable the KDC, stop it in the Control
Panel Services applet and set the startup to Disabled.) Taking this step clears
out the Kerberos tickets and forces the DC to get new tickets from one of the
remaining functional DCs.
Other Tips
First, be patient. Replication in an enterprise takes a while to complete, as
well as to correct itself when something goes wrong. For example, when a DC
doesn't respond, the Knowledge Consistency Checker (KCC) waits 90 minutes to
recalculate connection objects around the DC.
In this era of greater security, consider the possibility that firewall configuration
changes might block replication. Look for servers that won't respond to pings
even though they're perfectly healthy, or for servers that respond to some protocols
but not others. For details about DC port requirements for firewalls, see the
Microsoft article "Active Directory Replication over Firewalls" (http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx).
For a list of port requirements for various Windows Server products, see the
Microsoft article "Service overview and network port requirements for the Windows
Server system" (http:// support.microsoft.com/kb/832017).
If you don't think you're getting enough detail from the directory log, go
to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ntds\Diagnostics
subkey and enable NTDS logging. Which key value to increase logging on depends
on the area you're investigating (e.g., Knowledge Consistency Checker, Name
Resolution, Replication Events). The default value is 0, with a maximum value
of 5. A value of 3 is typically the highest you'd need. Monitor the effect that
increased logging has on your directory log, and disable the logging when you
no longer need it.
Trust the KCC. Resist the temptation to outguess the KCC when it doesn't seem
to be creating the topology you planned. If the KCC isn't doing what you expect,
something in your site topology probably isn't configured like you think it
is. For example, you need to ensure that the DC's IP address corresponds to
subnets associated with the site the DC belongs to.
And finally, if you receive errors that indicate the DC hasn't replicated for
a period longer than the tombstone lifetime, you can stop trying to troubleshoot.
You must rebuild the DC, remove its metadata from AD, and repromote the DC.
As an MVP colleague once said, "DCs are like little tin soldiers; you can knock
one down and put another just like it in its place."
Put Down Your Wand
Replication is a key function of AD, but troubleshooting replication is often
regarded as a black art. To remove the mystical aspect of replication, first
use a logical approach to verify that the basics are working; then, verify that
the DC's OS is working correctly, check its directory service, check its DNS
configuration, check inter-DC communications, check Kerberos and its dependencies
(e.g., the Windows Time Service), and check firewall configurations. Following
the tips I present in this article will transform AD replication troubleshooting
from voodoo into tried-and-true.
End of Article
)
)
)
)
noneofyourbusiness499 June 12, 2007 (Article Rating: