Eu tenho dois controladores de domínio na minha rede, win2k8dc1 e win2k8dc2.
Estou correndo em erros de log de eventos que a replicação DFS não é capaz de se comunicar com o parceiro de replicação. Este evento está registrado no DC2:
The DFS Replication service failed to communicate with partner WIN2K8DC1 for replication group Domain System Volume. The partner did not recognize the connection or the replication group configuration.
Partner DNS Address: WIN2K8DC1.JEWELS.LOCAL Optional data if available: Partner WINS Address: WIN2K8DC1 Partner IP Address: 192.168.1.254 The service will retry the connection periodically. Additional Information: Error: 9026 (The connection is invalid) Connection ID: F26BEC3F-1EB7-4002-BE66-6204485CDC8C Replication Group ID: E0260157-9085-41F7-8912-F1A02026A0A5
Esses erros não estão sendo gerados no DC1. Ambas as máquinas são capazes de pingar por ip, fqdn e registros.
O diretório ativo parece replicar perfeitamente bem. Se um objeto ou ou é criado em um servidor, ele é replicado para o segundo. A replicação de DNS parece estar bem também.
Executando o DCDIAG recebi os seguintes erros:
Starting test: DFSREvent
The DFS Replication Event Log.
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
An error event occurred. EventID: 0xC0001394
Time Generated: 01/04/2012 17:00:45
Event String:
The DFS Replication service failed to communicate with partner WIN2K8DC2 for replication group Domain System Volume. The partner did not recognize the connection or the replication group configuration.
Partner DNS Address: WIN2K8DC2.JEWELS.LOCAL
Optional data if available:
Partner WINS Address: WIN2K8DC2
Partner IP Address: 192.168.1.253
The service will retry the connection periodically.
Additional Information:
Error: 9026 (The connection is invalid)
Connection ID: 04854E9E-07E3-4A3E-BA6C-F3FBAB67B21F
Replication Group ID: E0260157-9085-41F7-8912-F1A02026A0A5
An error event occurred. EventID: 0xC0001394
Time Generated: 01/05/2012 03:00:42
......................... WIN2K8DC1 failed test DFSREvent
Eu verifiquei os atributos do controlador de domínio: msDFSR-ComputerReferenceBL. Cada CD tem um valor onde o CN é igual a ele. O valor msDFSR-MemberReferenceBL é nulo. Eu não posso editar manualmente nenhum desses dois valores.
Outro erro na saída do DCDIAG é o teste NCSecDesc, que, quando pesquisado, diz ignorar se eu não usar o RODC. Ambos os servidores falham neste teste.
Ambos os servidores têm um erro DCOM relatando que o DCOM não pôde se comunicar com o computador usando qualquer protocolo configurado. Eu posso pingar os IPs de forwarders no entanto ...
Todos os resultados do teste de DNS PASSARAM com dcdiag.
Os atributos dcdiag que eu corri são: dcdiag / v / c / d / e / s: win2k8dc1 > c: \ dcdiag.txt e o mesmo em win2k8dc2.
O utilitário FRSDiag retornou o seguinte erro no DC1:
Checking for errors in debug logs ...
ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 3580: 904: S0: 12:33:01> :SR: Cmd 00388bb0, CxtG f26bec3f, WS ERROR_ACCESS_DENIED, To WIN2K8DC1.JEWELS.LOCAL Len: (544) [SndFail - Send Penalty]
ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 260: 877: S0: 12:33:01> :SR: Cmd 00388130, CxtG 04854e9e, WS ERROR_ACCESS_DENIED, To WIN2K8DC1.JEWELS.LOCAL Len: (376) [SndFail - rpc call]
ERROR on NtFrs_0004.log : "ERROR_ACCESS_DENIED" : <SndCsMain: 260: 904: S0: 12:33:01> :SR: Cmd 00388130, CxtG 04854e9e, WS ERROR_ACCESS_DENIED, To WIN2K8DC1.JEWELS.LOCAL Len: (376) [SndFail - Send Penalty]
Found 8 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
......... failed with 8 error entries
Ao tentar executar o FRSDiag do DC1 contra o DC2, recebo o seguinte erro:
Processing ntfrsutl ds....NTFRSUTL ERROR - Cannot RPC to computer, win2k8dc2; 000006d9 (1753)... Make sure you are logged on as a Domain Admin! Skipping!
Estou começando a ficar perplexo, já que isso está superando minha cabeça. Queria verificar aqui antes de prosseguir com o próximo passo e entrar em contato com o suporte técnico do MS AD.
Adições: O UAC está desativado. Nenhum firewall está em nenhum dos servidores. O nível de funcionalidade é o Windows Server 2008.
saída dfsrdiag dumpadcfg:
LDAP Bind : WIN2K8DC1.JEWELS.LOCAL
SitesDn : cn=sites,cn=configuration,dc=jewels,dc=local
ServicesDn : cn=services,cn=configuration,dc=jewels,dc=local
SystemDn : cn=system,DC=JEWELS,DC=LOCAL
DefaultNcDn : DC=JEWELS,DC=LOCAL
ComputersDn : cn=computers,DC=JEWELS,DC=LOCAL
DomainCtlDn : ou=domain controllers,DC=JEWELS,DC=LOCAL
SchemaDn : CN=Schema,CN=Configuration,DC=JEWELS,DC=LOCAL
COMPUTER: WIN2K8DC1
DN : cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
GUID : 53A64969-227C-40AA-BD93-3C46782765DA
DNS : win2k8dc1.jewels.local
Server BL : cn=win2k8dc1,cn=servers,cn=default-first-site-name,cn=sites,cn
=configuration,dc=jewels,dc=local
Server Ref : (null)
USN Changed : 5682458
When Created : Tuesday, August 10, 2010 3:02:33 PM
When Changed : Wednesday, January 04, 2012 6:30:57 PM
LOCAL SETTINGS: DFSR-LOCALSETTINGS
DN : cn=dfsr-localsettings,cn=win2k8dc1,ou=domain controllers,dc=
jewels,dc=local
GUID : 6EE6D3C7-09C4-4A9E-BFCF-A4D5CE129320
Version : 1.0.0.0
USN Changed : 5685331
When Created : Wednesday, January 04, 2012 8:58:32 PM
When Changed : Wednesday, January 04, 2012 9:00:49 PM
SUBSCRIBER: DOMAIN SYSTEM VOLUME
DN : cn=domain system volume,cn=dfsr-localsettings,cn=win2k8dc1
,ou=domain controllers,dc=jewels,dc=local
GUID : 2C9380BE-39BE-49C9-87CA-82AA8483A5C8
Member Ref : cn=win2k8dc1,cn=topology,cn=domain system volume,cn=dfsr-g
lobalsettings,cn=system,dc=jewels,dc=local
USN Changed : 5685297
When Created : Wednesday, January 04, 2012 8:58:33 PM
When Changed : Wednesday, January 04, 2012 8:58:33 PM
SUBSCRIPTION: SYSVOL SUBSCRIPTION
DN : cn=sysvol subscription,cn=domain system volume,cn=dfsr-l
ocalsettings,cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
GUID : 3A9F879D-CB16-4484-8F22-703B8ACF3B11
ContentSetGuid: 0E31CFFA-FCD2-4A5D-8739-9277B0EF8478
Root Path : c:\windows\sysvol_dfsr\domain
Root Size : (null) (MB)
Staging Path : (null)
Staging Size : (null) (MB)
Conflict Path : (null)
Conflict Size : (null) (MB)
USN Changed : 5685489
When Created : Wednesday, January 04, 2012 8:58:33 PM
When Changed : Wednesday, January 04, 2012 9:05:34 PM
GLOBAL SETTINGS: DFSR-GLOBALSETTINGS
DN : cn=dfsr-globalsettings,cn=system,dc=jewels,dc=local
GUID : 30E9760E-6020-4DFD-A975-134F2C809A4D
USN Changed : 5685310
When Created : Wednesday, January 04, 2012 8:57:53 PM
When Changed : Wednesday, January 04, 2012 8:59:39 PM
REPLICATION GROUP: DOMAIN SYSTEM VOLUME
DN : cn=domain system volume,cn=dfsr-globalsettings,cn=system,dc=
jewels,dc=local
GUID : E0260157-9085-41F7-8912-F1A02026A0A5
Type : 1 (SYSVOL)
USN Changed : 5685278
When Created : Wednesday, January 04, 2012 8:57:53 PM
When Changed : Wednesday, January 04, 2012 8:57:53 PM
CONTENT: CONTENT
DN : cn=content,cn=domain system volume,cn=dfsr-globalsettings,
cn=system,dc=jewels,dc=local
GUID : 776B3EE9-6FF6-4929-A0B5-DC1256C330FE
USN Changed : 5685279
When Created : Wednesday, January 04, 2012 8:57:53 PM
When Changed : Wednesday, January 04, 2012 8:57:53 PM
CONTENT SET: SYSVOL SHARE
DN : cn=sysvol share,cn=content,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
GUID : 0E31CFFA-FCD2-4A5D-8739-9277B0EF8478
File Filter : (null)
Compression Excl : (null)
Dir Filter : DO_NOT_REMOVE_NtFrs_PreInstall_Directory,NtFrs_PreExisti
ng___See_EventLog
USN Changed : 5685280
When Created : Wednesday, January 04, 2012 8:57:53 PM
When Changed : Wednesday, January 04, 2012 8:57:53 PM
TOPOLOGY: TOPOLOGY
DN : cn=topology,cn=domain system volume,cn=dfsr-globalsettings
,cn=system,dc=jewels,dc=local
GUID : DB1E6BF2-9745-4B04-AD15-19E559502D4B
USN Changed : 5685281
When Created : Wednesday, January 04, 2012 8:57:53 PM
When Changed : Wednesday, January 04, 2012 8:57:53 PM
MEMBER: WIN2K8DC1
DN : cn=win2k8dc1,cn=topology,cn=domain system volume,cn=dfsr
-globalsettings,cn=system,dc=jewels,dc=local
GUID : BCAFE60C-2DFF-4BC0-85A4-22F66C96B043
Server Ref : cn=ntds settings,cn=win2k8dc1,cn=servers,cn=default-firs
t-site-name,cn=sites,cn=configuration,dc=jewels,dc=local
Computer Ref : cn=win2k8dc1,ou=domain controllers,dc=jewels,dc=local
Keywords : (null)
Computer DNS : win2k8dc1.jewels.local
USN Changed : 5685293
When Created : Wednesday, January 04, 2012 8:58:32 PM
When Changed : Wednesday, January 04, 2012 8:58:32 PM
CXTION: D0736C4D-B39D-4521-B4AF-5D8B7E627280
DN : cn=d0736c4d-b39d-4521-b4af-5d8b7e627280,cn=ntds settin
gs,cn=win2k8dc1,cn=servers,cn=default-first-site-name,cn=sites,cn=configuration,
dc=jewels,dc=local
GUID : 04854E9E-07E3-4A3E-BA6C-F3FBAB67B21F
Inbound : true
Partner DN : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
USN Changed : 2830713
When Created : Wednesday, April 13, 2011 8:12:57 PM
When Changed : Friday, August 19, 2011 1:02:17 PM
CXTION: C21C575F-EEB2-44E9-A464-85E4833963B5
DN : cn=c21c575f-eeb2-44e9-a464-85e4833963b5,cn=ntds settin
gs,cn=win2k8dc2,cn=servers,cn=default-first-site-name,cn=sites,cn=configuration,
dc=jewels,dc=local
GUID : F26BEC3F-1EB7-4002-BE66-6204485CDC8C
Inbound : false
Partner DN : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=df
sr-globalsettings,cn=system,dc=jewels,dc=local
USN Changed : 4927588
When Created : Wednesday, April 13, 2011 8:12:40 PM
When Changed : Tuesday, December 13, 2011 9:41:33 PM
MEMBER: WIN2K8DC2
DN : cn=win2k8dc2,cn=topology,cn=domain system volume,cn=dfsr
-globalsettings,cn=system,dc=jewels,dc=local
GUID : 1AF9DFAD-9793-4B3D-BE1B-5A497857C4E6
Server Ref : cn=ntds settings,cn=win2k8dc2,cn=servers,cn=default-firs
t-site-name,cn=sites,cn=configuration,dc=jewels,dc=local
Computer Ref : cn=win2k8dc2,ou=domain controllers,dc=jewels,dc=local
Keywords : (null)
Computer DNS : win2k8dc2.jewels.local
USN Changed : 5685434
When Created : Wednesday, January 04, 2012 9:01:29 PM
When Changed : Wednesday, January 04, 2012 9:01:45 PM
Operation Succeeded
Em relação ao FRS para replicação SYSVOL - este domínio foi atualizado a partir de 2003? O SYSVOL ainda pode estar usando o FRS para replicação, a menos que você tenha migrado para a pós-atualização de replicação do DFS-R.
Você pode usar o Guia de migração de replicação do SYSVOL para mova-o do FRS para o DFS-R
Em relação ao firewall, só porque eles estão na mesma rede local, o firewall local do Windows também pode estar bloqueando a conexão.