При репликации возникла ошибка 8457

Здравствуйте.

Совершил классическую ошибку: сделал бекап сервера контроллера домена (для переноса), потом развернул его.

Теперь, соответственно, не работает репликация.

Попытка поднять новый контроллер домена заканчивается ошибкой подключения с домену и сообщением «нет серверов для репликации».

В сети 3 контроллера домена. Два из них были перенесены ранее, и не работают уже давно. Третий (он же основной) был перенесён совсем недавно, но и он не работает.

Хотелось бы как-нибудь получить доступ к домену, чтобы была возможность при помощь dcpromo добавить к домену рабочий контроллер и перевести на него все роли. В данный момент, при попытке подключить новый контроллер домена,
ошибка возникает на стадии «запуск репликации».

Источник
title description ms.date author ms.author manager audience ms.topic ms.prod localization_priority ms.reviewer ms.custom ms.technology

Troubleshoot replication error 8456 or 8457

Describes how to troubleshoot replication error 8456 or 8457.

04/28/2023

Deland-Han

delhan

dcscontentpm

itpro

troubleshooting

windows-server

medium

kaushika

sap:active-directory-replication, csstroubleshoot

windows-server-active-directory

Active Directory replication error 8456 or 8457: The source | destination server is currently rejecting replication requests

This article describes the symptoms, cause, and resolution steps for situations where Active Directory operations fail with error 8456 or 8457.

Applies to:   Windows Server 2012 R2
Original KB number:   2023007

[!NOTE]
Home users: This article is only intended for technical support agents and IT professionals. If you’re looking for help with a problem, ask the Microsoft Community.

Symptoms

Active Directory operations fail with error 8456 or 8457: The source | destination server is currently rejecting replication requests.

  1. The DCPROMO promotion of a new domain controller in an existing forest fails with the error: The source server is currently rejecting replication requests.

    Dialog title text: Active Directory Installation Wizard
    Dialog message text:

    The operation failed because: Active Directory could not transfer the remaining data in directory partition <directory partition DN path> to domain controller <destination DC>. «The source server is currently rejecting replication requests.»

  2. DCDIAG reports the error: The source server is currently rejecting replication requests or The destination server is currently rejecting replication requests.

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8456):
    The source server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8457):
    The destination server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

  3. REPADMIN indicates that incoming and outgoing Active Directory replication may be failing with the error: The source | destination server is currently rejecting replication.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8457 (0x2109):
    The destination server is currently rejecting replication requests.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8456 (0x2108):
    The source server is currently rejecting replication requests.

    [!NOTE]
    REPADMIN commands may display both the hexadecimal and the decimal equivalent for the currently rejecting replication error.

  4. Event sources and event IDs that indicate that a USN rollback has occurred include but are not limited to the following.

    Event source Event ID Event string
    NTDS KCC 1308 The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the following domain controller has consistently failed.
    NTDS KCC 1925 The attempt to establish a replication link for the following writable directory partition failed.
    NTDS KCC 1926 The attempt to establish a replication link to a read-only directory partition with the following parameters failed
    NTDS Replication 1586 The Windows NT 4.0 or earlier replication checkpoint with the PDC emulator master was unsuccessful. A full synchronization of the security accounts manager (SAM) database to domain controllers running Windows NT 4.0 and earlier might occur if the PDC emulator master role is transferred to the local domain controller before the next successful checkpoint. The checkpoint process will be tried again in four hours.
    NTDS Replication 2023 The local domain controller was unable to replicate changes to the following remote domain controller for the following directory partition.
    Microsoft-Windows-ActiveDirectory_DomainService 2095 During an Active Directory Domain Services replication request, the local domain controller (DC) identified a remote DC which has received replication data from the local DC by using already acknowledged USN tracking numbers.
    Microsoft-Windows-ActiveDirectory_DomainService 2103 The Active Directory Domain Services database was restored by using an unsupported restoration procedure. Active Directory Domain Services will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused.

    Where embedded status codes 8456 and 8457 map to the following.

    Decimal error Hexadecimal error Error string
    8456 2108 The source server is currently rejecting replication
    8457 2109 The destination server is currently rejecting replication

  5. NTDS General Event 2013 may be logged in the Directory Services event log. This indicates that a USN rollback occurred because of an unsupported rollback or restore of the Active Directory Database.

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 2103
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description: The Active Directory database has been restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. As a result, the Net Logon service has paused. User Action See previous event logs for details. For more information, visit the Help and Support Center at https://support.microsoft.com.

  6. NTDS General Event 1393 may be logged in the Directory Services event log. This indicates that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space:

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 1393
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description:
    Attempts to update the Directory Service database are failing with error 112. Since Windows will be unable to log on users while this condition persists, the NetLogon service is being paused. M ake sure that sufficient free disk space is available on the drives where the directory database and log files reside.

Cause

Incoming or outgoing replication was automatically disabled by the operating system because of multiple root causes.

Three events that disable inbound or outbound replication include:

  • A USN rollback occurred (NTDS General Event 2103).
  • The hard disk is full (NTDS General Event 1393).
  • A corrupt UTD vector is present (Event 2881).

The operating system automatically makes four configuration changes when one of three conditions occurs. The four configuration changes are as follows:

  1. Incoming Active Directory replication is disabled.
  2. Outgoing Active Directory replication is disabled.
  3. DSA not writable is set to a nonzero value in the registry.
  4. The NETLOGON service status is changed from running to paused.

The dominant root cause for this error condition is a USN rollback discussed in A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

Do not assume that any nonzero value for DSA not writable or that a source or destination server is currently rejecting replication requests during DCPROMO / AD Replication definitively means that a USN rollback has occurred and that such domain controllers implicitly have to be force-demoted or force-repromoted. Demotionmaybe the correct option. However, it may be excessive when the error is caused by insufficient free disk space.

Resolution

  1. Check the value for DSA not writable.

    For each domain controller that is logging the 8456 or 8457 error, determine whether one of the three triggering events automatically disabled incoming or outgoing Active Directory Replication by reading the value for » DSA not writable» from the local registry.

    When replication is automatically disabled, the operating system writes one of four possible values to DSA not writable:

    • Path: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
    • Setting: DSA not writable
    • Type: Reg_dword
    • Values:
      • #define DSA_WRITABLE_GEN 1
      • #define DSA_WRITABLE_NO_SPACE 2
      • #define DSA_WRITABLE_USNROLLBCK 4
      • #define DSA_WRITABLE_CORRUPT_UTDV 8

    A value of 1 can be written only when the forest version is incompatible with the OS (for example, the W2K DC is promoted into a Windows Server 2003 forest functional level forest or the like).

    A value of 2 means that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space.

    A value of 4 means that a USN rollback occurred because the Active Directory database was incorrectly rolled back in time. Operations that are known to cause a USN rollback include the following:

    • The booting from previously saved virtual machine snapshots of domain controller role computers on Hyper-V or VMWARE hosts.
    • Incorrect physical-to-virtual (P2V) conversions in forests that contain more than one domain controller.
    • Restoring DC role computers by using imaging products such as Ghost.
    • Rolling the contents of a partition that is hosting the active directory database back in time by using an advanced disk subsystem.

    A value of 8 indicates that the up-to-dateness-vector is corrupted on the local DC.

    Technically, DSA not writable could consist of multiple values. For example, a registry value of 10 would indicate insufficient disk space and a corrupted UTD. Typically, a single value is written to DSA not writable.

    [!NOTE]
    It is common for support professionals and administrators to partly disable the replication quarantine by enabling outgoing replication, by enabling incoming replication, by changing the startup value for the NETLOGON service from disabled to automatic, and by starting the NETLOGON service. Therefore, the full quarantine configuration may not be in place when it is examined.

  2. Check the Directory Service event log for quarantine events.

    Assuming the Directory Service event log has not wrapped, you may find one or more related events logged in the Directory Service event log of a domain controller that is logging the 8456 or 8457 error.

    Event Details
    NTDS General 2103 The Active Directory database was restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused. User Action See previous event logs for more information.
    NTDS General Event 1393 There is insufficient space on the disk.
    Event 2881 Not applicable

  3. Perform the recovery based on the value of DSA not writable or on events that are logged on the system:

    • If DSA not writable equals 4 or if NTDS General Event 2103 is logged, perform the recovery steps for a USN Rollback. For more information, see A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

    • If DSA not writable equals 2 or if NTDS General event 1393 is logged, check for sufficient free disk space on the physical and virtual partitions that are hosting the Active Directory database and log files. Free up space as required.

    • If DSA not writable equals 8, demote and then repromote the domain controller before it can replicate its bad value to other domain controllers in the forest.

Data collection

If you need assistance from Microsoft support, we recommend you collect the information by following the steps mentioned in Gather information by using TSSv2 for Active Directory replication issues.

Источник

My replications are not working properly, I have ran repadmin /showrepl and this produces the below result can anybosy help for this.

Repadmin: running command /showrepl against full DC localhost

Default-First-SiteABCFILE10

DSA Options: IS_GC DISABLE_INBOUND_REPL DISABLE_OUTBOUND_REPL

Site Options: (none)

DSA object GUID: f028fefc-3c33-45cb-bd5b-1af941257eb4

DSA invocationID: a25e775c-d34d-4e8c-8e5f-50d6a8d80117

==== INBOUND NEIGHBORS ======================================

DC=penzanceco,DC=local

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        41 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 10:40:17 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        826 consecutive failure(s).

        Last success @ 2010-10-12 20:29:10.

CN=Configuration,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        14 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

CN=Schema,CN=Configuration,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

DC=ForestDnsZones,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        38 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

DC=DomainDnsZones,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

Source: Default-First-SiteABCPRINT

******* 808 CONSECUTIVE FAILURES since 2010-10-12 20:29:10

Last error: 8457 (0x2109):

            The destination server is currently rejecting replication requests.

Source: WalkerABCFILE2

******* 42 CONSECUTIVE FAILURES since 2010-10-12 20:09:35

Last error: 8457 (0x2109):

            The destination server is currently rejecting replication requests.

My replications are not working properly, I have ran repadmin /showrepl and this produces the below result can anybosy help for this.

Repadmin: running command /showrepl against full DC localhost

Default-First-SiteABCFILE10

DSA Options: IS_GC DISABLE_INBOUND_REPL DISABLE_OUTBOUND_REPL

Site Options: (none)

DSA object GUID: f028fefc-3c33-45cb-bd5b-1af941257eb4

DSA invocationID: a25e775c-d34d-4e8c-8e5f-50d6a8d80117

==== INBOUND NEIGHBORS ======================================

DC=penzanceco,DC=local

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        41 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 10:40:17 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        826 consecutive failure(s).

        Last success @ 2010-10-12 20:29:10.

CN=Configuration,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        14 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

CN=Schema,CN=Configuration,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

DC=ForestDnsZones,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        38 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

DC=DomainDnsZones,DC=penzanceco,DC=local

    Default-First-SiteABCPRINT via RPC

        DSA object GUID: 3b3ee4aa-7420-4ca9-af9d-790301726088

        Last attempt @ 2010-10-18 09:56:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        13 consecutive failure(s).

        Last success @ 2010-10-12 19:54:35.

    WalkerABCFILE2 via RPC

        DSA object GUID: 7492f21f-d251-40c1-bc21-7a36940b8eb0

        Last attempt @ 2010-10-18 10:26:23 failed, result 8457 (0x2109):

            The destination server is currently rejecting replication requests.

        42 consecutive failure(s).

        Last success @ 2010-10-12 20:09:35.

Source: Default-First-SiteABCPRINT

******* 808 CONSECUTIVE FAILURES since 2010-10-12 20:29:10

Last error: 8457 (0x2109):

            The destination server is currently rejecting replication requests.

Source: WalkerABCFILE2

******* 42 CONSECUTIVE FAILURES since 2010-10-12 20:09:35

Last error: 8457 (0x2109):

            The destination server is currently rejecting replication requests.

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 225

1

Ошибка репликации между контроллерами домена

16.09.2020, 17:42. Показов 5003. Ответов 9

После установки обновления на Контроллеры Домена, один из КД после перезагрузки перестал запускаться.
Все попытки запустить его не привели к успеху.
Единственным решением оставалось восстановить машину из резервной копии.
После восстановления и успешного запуска, этот контроллер перестал синхронизироваться с остальными контроллерами домена. В чём причина?
Все сетевые настройки остались в том виде, что и были раньше. Эта машины видна в сети и с неё видны все остальные КД. Однако при каждой попытке принудительной синхронизации появляется следующее сообщение:
При попытке синхронизации контекста именования с контроллера домена CN=Configuration,DC=<мой домен>,DC=local с контроллера домена DC4 на контроллер домена DC3 имела место следующая ошибка: Исходный сервер в настоящий момент отвергает запросы на репликацию.
В журнале событий также ошибки: 8457 Конечный сервер в настоящий момент отвергает запросы на репликацию.
Это КД является FSMO (Хозяином операций). Я не могу перести роль на другой КД (опять же из-за невозможности репликации.
Как восстановить репликацию? Почему она сбилась?
Прошу помощи!!

__________________
Помощь в написании контрольных, курсовых и дипломных работ, диссертаций здесь

0

233 / 223 / 46

Регистрация: 12.12.2012

Сообщений: 1,926

17.09.2020, 12:05

2

Хорошая практика, не восстанавливать из бэкапа КД, если есть другие живые. Просто удаляете и поднимаете новый.

Думаю, Ваша СРК не умеет работать с USN. https://winitpro.ru/index.php/… ry-backup/

Потому лучшем способом будет удалить его и поднять новый.

— Захватите принудительно на живом КД все роли, потом понизьте проблемный и удалите.

Так же до этого, можете использоваться в cmd от админа, dcdiag /q чтоб посмотреть ошибки и попробовать нагуглить.

Но самый безболезненный и простой путь захват ролей на живом и понижение, удаление старого. Потом можете вновь поднять виртуалку, дать ей такие же сетевые настройки, имя и поднять до контроллера.

0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 225

17.09.2020, 12:24

 [ТС]

3

pEntity Спасибо!
Тогда у меня несколько вопросов:

1.Можете дать точную последовательность действий ?
2.Как принудительно захватить роли на рабочем КД?
3.Нужно ли переустанавливать DNS на проблемном КД?
4.Надо ли удалять полностью машину или после понижения просто снова повысить?
5.Как избежать таких проблем в будущем?

Можно ли доверять этой статье по ссылке ниже, что бы делать всё в точности с ней?
https://docs.microsoft.com/ru-… -level-100

спасибо..

0

3 / 1 / 3

Регистрация: 17.08.2012

Сообщений: 197

17.09.2020, 14:55

4

Покажите результат команд:
1) REPADMIN/SHOWREPL
2) w32tm /query /status
3) DCDIAG

0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 225

17.09.2020, 16:13

 [ТС]

5

Принудительно перенес все роли на другой КД.
Понизил проблемный КД до обычного сервера.

Интересуют следующие вопросы:

Можно ли эту машину снова повысить до уровна КД? Не возникнет ли проблем с ней? Или лучше установить новую машину??
Как в будущем избежать данной проблемы, если снова один и КД не может загрузиться??

Пожалуйста, напишите ответы как можно скорее!

0

3 / 1 / 3

Регистрация: 17.08.2012

Сообщений: 197

17.09.2020, 16:38

6

Можно, ток лучше переустановить сервер, полностью его обновить и в конце отключить автоматическое обновление, потом уже накатывать AD и повышать роль.

Контроллеры лучше не обновлять, ток если железо новое и то лучше проверять совместимость всего железа с новыми версиями драйверов.

Был случай,что на старом железе крутился контроллер на 2012r2, пришло обновление с новым драйвером на чипсет, но он оказался кривым для данной мамки и в итоге сервак в bsod падал…. После откатил все обратно и отключил обновления, 2 года бед не знаю, работает и без ошибок.

0

233 / 223 / 46

Регистрация: 12.12.2012

Сообщений: 1,926

17.09.2020, 18:11

7

Цитата
Сообщение от Nightingale81
Посмотреть сообщение

Можно ли эту машину снова повысить до уровна КД? Не возникнет ли проблем с ней? Или лучше установить новую машину??
Как в будущем избежать данной проблемы, если снова один и КД не может загрузиться??

1. Всяко лучше установить с нуля, новую виртуальную машину. В эру виртуализации это быстро и удобно. Зачем Вам тянуть какие-либо старые данные с нее, настройки и т.д. ? Вы будете уверены, что всё впорядке.

2. Как я уже сказал, удалить просто виртуальную машину. На живом КД в оснастке пользователи и компьютеры, удалить неисправный контроллер.

0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 225

22.09.2020, 12:36

 [ТС]

8

Спасибо!

Подняли КД с нуля.
Выходит, что делать резервные копии КД по сути бессмысленно (разве что есть важные данные на нём) если восстановление не работает.
Каким же образом надо делать бэкапы, что бы можно было нормально восстановить контроллеры с синхронизацией?

0

233 / 223 / 46

Регистрация: 12.12.2012

Сообщений: 1,926

23.09.2020, 10:42

9

Не бессмысленно. Если Вам нужно восстановить удаленные объекты, которые были удалены два месяца назад к примеру ?

Или простой пример, у Вас Exchange сервер и он умер, Вам нужно сделать восстановление. Процесс там выглядит как установка нового сервера, ресет учетки объекта компьютера в AD и последующая уставка Exchange сервера, таким образом он подхватывает данные с AD. А вот если не получилось ? Второго шанса нет, потому Вам и придется восстанавливать AD или этот объект с бэкапа.

Бэкап всегда нужен на все случаи траблшутинга.

Каким образом делать бэкап? Купить любую платную систему бэкапа. Мне кажется щас все нормально работают с AD, я работал с вимом и акронисом 12.5(После ребрендинга, ИНФОЗАЩИТА), они точно умеют.

Ну и даже тот же Windows Server Backup, но там нужно уметь еще им восстанавливать. https://winitpro.ru/index.php/… ry-backup/

0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 225

28.09.2020, 10:59

 [ТС]

10

Для создания резервных копий мы используем платный Veeam. С него же и восстанавливали.
Вроде как можно AD резервировать через встроенный Windows Server Backup.
Пока не пробовали. Не пользовались им никогда..

0
title description ms.date author ms.author manager audience ms.topic ms.prod localization_priority ms.reviewer ms.custom ms.technology

Troubleshoot replication error 8456 or 8457

Describes how to troubleshoot replication error 8456 or 8457.

10/10/2020

Deland-Han

delhan

dcscontentpm

itpro

troubleshooting

windows-server

medium

kaushika

sap:active-directory-replication, csstroubleshoot

windows-server-active-directory

Active Directory replication error 8456 or 8457: The source | destination server is currently rejecting replication requests

This article describes the symptoms, cause, and resolution steps for situations where Active Directory operations fail with error 8456 or 8457.

Applies to:   Windows Server 2012 R2
Original KB number:   2023007

[!NOTE]
Home users: This article is only intended for technical support agents and IT professionals. If you’re looking for help with a problem, ask the Microsoft Community.

Symptoms

Active Directory operations fail with error 8456 or 8457: The source | destination server is currently rejecting replication requests.

  1. The DCPROMO promotion of a new domain controller in an existing forest fails with the error: The source server is currently rejecting replication requests.

    Dialog title text: Active Directory Installation Wizard
    Dialog message text:

    The operation failed because: Active Directory could not transfer the remaining data in directory partition <directory partition DN path> to domain controller <destination DC>. «The source server is currently rejecting replication requests.»

  2. DCDIAG reports the error: The source server is currently rejecting replication requests or The destination server is currently rejecting replication requests.

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8456):
    The source server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8457):
    The destination server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

  3. REPADMIN indicates that incoming and outgoing Active Directory replication may be failing with the error: The source | destination server is currently rejecting replication.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8457 (0x2109):
    The destination server is currently rejecting replication requests.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8456 (0x2108):
    The source server is currently rejecting replication requests.

    [!NOTE]
    REPADMIN commands may display both the hexadecimal and the decimal equivalent for the currently rejecting replication error.

  4. Event sources and event IDs that indicate that a USN rollback has occurred include but are not limited to the following.

    Event source Event ID Event string
    NTDS KCC 1308 The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the following domain controller has consistently failed.
    NTDS KCC 1925 The attempt to establish a replication link for the following writable directory partition failed.
    NTDS KCC 1926 The attempt to establish a replication link to a read-only directory partition with the following parameters failed
    NTDS Replication 1586 The Windows NT 4.0 or earlier replication checkpoint with the PDC emulator master was unsuccessful. A full synchronization of the security accounts manager (SAM) database to domain controllers running Windows NT 4.0 and earlier might occur if the PDC emulator master role is transferred to the local domain controller before the next successful checkpoint. The checkpoint process will be tried again in four hours.
    NTDS Replication 2023 The local domain controller was unable to replicate changes to the following remote domain controller for the following directory partition.
    Microsoft-Windows-ActiveDirectory_DomainService 2095 During an Active Directory Domain Services replication request, the local domain controller (DC) identified a remote DC which has received replication data from the local DC by using already acknowledged USN tracking numbers.
    Microsoft-Windows-ActiveDirectory_DomainService 2103 The Active Directory Domain Services database was restored by using an unsupported restoration procedure. Active Directory Domain Services will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused.

    Where embedded status codes 8456 and 8457 map to the following.

    Decimal error Hexadecimal error Error string
    8456 2108 The source server is currently rejecting replication
    8457 2109 The destination server is currently rejecting replication

  5. NTDS General Event 2013 may be logged in the Directory Services event log. This indicates that a USN rollback occurred because of an unsupported rollback or restore of the Active Directory Database.

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 2103
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description: The Active Directory database has been restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. As a result, the Net Logon service has paused. User Action See previous event logs for details. For more information, visit the Help and Support Center at https://support.microsoft.com.

  6. NTDS General Event 1393 may be logged in the Directory Services event log. This indicates that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space:

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 1393
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description:
    Attempts to update the Directory Service database are failing with error 112. Since Windows will be unable to log on users while this condition persists, the NetLogon service is being paused. M ake sure that sufficient free disk space is available on the drives where the directory database and log files reside.

Cause

Incoming or outgoing replication was automatically disabled by the operating system because of multiple root causes.

Three events that disable inbound or outbound replication include:

  • A USN rollback occurred (NTDS General Event 2103).
  • The hard disk is full (NTDS General Event 1393).
  • A corrupt UTD vector is present (Event 2881).

The operating system automatically makes four configuration changes when one of three conditions occurs. The four configuration changes are as follows:

  1. Incoming Active Directory replication is disabled.
  2. Outgoing Active Directory replication is disabled.
  3. DSA not writable is set to a nonzero value in the registry.
  4. The NETLOGON service status is changed from running to paused.

The dominant root cause for this error condition is a USN rollback discussed in A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

Do not assume that any nonzero value for DSA not writable or that a source or destination server is currently rejecting replication requests during DCPROMO / AD Replication definitively means that a USN rollback has occurred and that such domain controllers implicitly have to be force-demoted or force-repromoted. Demotionmaybe the correct option. However, it may be excessive when the error is caused by insufficient free disk space.

Resolution

  1. Check the value for DSA not writable.

    For each domain controller that is logging the 8456 or 8457 error, determine whether one of the three triggering events automatically disabled incoming or outgoing Active Directory Replication by reading the value for » DSA not writable» from the local registry.

    When replication is automatically disabled, the operating system writes one of four possible values to DSA not writable:

    • Path: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
    • Setting: DSA not writable
    • Type: Reg_dword
    • Values:
      • #define DSA_WRITABLE_GEN 1
      • #define DSA_WRITABLE_NO_SPACE 2
      • #define DSA_WRITABLE_USNROLLBCK 4
      • #define DSA_WRITABLE_CORRUPT_UTDV 8

    A value of 1 can be written only when the forest version is incompatible with the OS (for example, the W2K DC is promoted into a Windows Server 2003 forest functional level forest or the like).

    A value of 2 means that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space.

    A value of 4 means that a USN rollback occurred because the Active Directory database was incorrectly rolled back in time. Operations that are known to cause a USN rollback include the following:

    • The booting from previously saved virtual machine snapshots of domain controller role computers on Hyper-V or VMWARE hosts.
    • Incorrect physical-to-virtual (P2V) conversions in forests that contain more than one domain controller.
    • Restoring DC role computers by using imaging products such as Ghost.
    • Rolling the contents of a partition that is hosting the active directory database back in time by using an advanced disk subsystem.

    A value of 8 indicates that the up-to-dateness-vector is corrupted on the local DC.

    Technically, DSA not writable could consist of multiple values. For example, a registry value of 10 would indicate insufficient disk space and a corrupted UTD. Typically, a single value is written to DSA not writable.

    [!NOTE]
    It is common for support professionals and administrators to partly disable the replication quarantine by enabling outgoing replication, by enabling incoming replication, by changing the startup value for the NETLOGON service from disabled to automatic, and by starting the NETLOGON service. Therefore, the full quarantine configuration may not be in place when it is examined.

  2. Check the Directory Service event log for quarantine events.

    Assuming the Directory Service event log has not wrapped, you may find one or more related events logged in the Directory Service event log of a domain controller that is logging the 8456 or 8457 error.

    Event Details
    NTDS General 2103 The Active Directory database was restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused. User Action See previous event logs for more information.
    NTDS General Event 1393 There is insufficient space on the disk.
    Event 2881 Not applicable

  3. Perform the recovery based on the value of DSA not writable or on events that are logged on the system:

    • If DSA not writable equals 4 or if NTDS General Event 2103 is logged, perform the recovery steps for a USN Rollback. For more information, see A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

    • If DSA not writable equals 2 or if NTDS General event 1393 is logged, check for sufficient free disk space on the physical and virtual partitions that are hosting the Active Directory database and log files. Free up space as required.

    • If DSA not writable equals 8, demote and then repromote the domain controller before it can replicate its bad value to other domain controllers in the forest.

title description ms.date author ms.author manager audience ms.topic ms.prod localization_priority ms.reviewer ms.custom ms.technology

Troubleshoot replication error 8456 or 8457

Describes how to troubleshoot replication error 8456 or 8457.

10/10/2020

Deland-Han

delhan

dcscontentpm

itpro

troubleshooting

windows-server

medium

kaushika

sap:active-directory-replication, csstroubleshoot

windows-server-active-directory

Active Directory replication error 8456 or 8457: The source | destination server is currently rejecting replication requests

This article describes the symptoms, cause, and resolution steps for situations where Active Directory operations fail with error 8456 or 8457.

Applies to:   Windows Server 2012 R2
Original KB number:   2023007

[!NOTE]
Home users: This article is only intended for technical support agents and IT professionals. If you’re looking for help with a problem, ask the Microsoft Community.

Symptoms

Active Directory operations fail with error 8456 or 8457: The source | destination server is currently rejecting replication requests.

  1. The DCPROMO promotion of a new domain controller in an existing forest fails with the error: The source server is currently rejecting replication requests.

    Dialog title text: Active Directory Installation Wizard
    Dialog message text:

    The operation failed because: Active Directory could not transfer the remaining data in directory partition <directory partition DN path> to domain controller <destination DC>. «The source server is currently rejecting replication requests.»

  2. DCDIAG reports the error: The source server is currently rejecting replication requests or The destination server is currently rejecting replication requests.

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8456):
    The source server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

    Testing server: Default-First-Site-Name<DC NAME>
    Starting test: Replications
    * Replications Check
    [Replications Check,<DC NAME>] A recent replication attempt failed:
    From IADOMINO to <DC NAME>
    Naming Context: DC=<DN path of partition>
    The replication generated an error (8457):
    The destination server is currently rejecting replication requests.
    The failure occurred at <Date> <Time>.
    The last success occurred at <Date> <time>.
    957 failures have occurred since the last success.
    Replication has been explicitly disabled through the server options

  3. REPADMIN indicates that incoming and outgoing Active Directory replication may be failing with the error: The source | destination server is currently rejecting replication.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8457 (0x2109):
    The destination server is currently rejecting replication requests.

    DC=Contoso,DC=COM
    <site name><dc name> via RPC
    DC object GUID: <objectguid of source DCs NTDS settings object>
    Last attempt @ <date> <time> failed, result 8456 (0x2108):
    The source server is currently rejecting replication requests.

    [!NOTE]
    REPADMIN commands may display both the hexadecimal and the decimal equivalent for the currently rejecting replication error.

  4. Event sources and event IDs that indicate that a USN rollback has occurred include but are not limited to the following.

    Event source Event ID Event string
    NTDS KCC 1308 The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the following domain controller has consistently failed.
    NTDS KCC 1925 The attempt to establish a replication link for the following writable directory partition failed.
    NTDS KCC 1926 The attempt to establish a replication link to a read-only directory partition with the following parameters failed
    NTDS Replication 1586 The Windows NT 4.0 or earlier replication checkpoint with the PDC emulator master was unsuccessful. A full synchronization of the security accounts manager (SAM) database to domain controllers running Windows NT 4.0 and earlier might occur if the PDC emulator master role is transferred to the local domain controller before the next successful checkpoint. The checkpoint process will be tried again in four hours.
    NTDS Replication 2023 The local domain controller was unable to replicate changes to the following remote domain controller for the following directory partition.
    Microsoft-Windows-ActiveDirectory_DomainService 2095 During an Active Directory Domain Services replication request, the local domain controller (DC) identified a remote DC which has received replication data from the local DC by using already acknowledged USN tracking numbers.
    Microsoft-Windows-ActiveDirectory_DomainService 2103 The Active Directory Domain Services database was restored by using an unsupported restoration procedure. Active Directory Domain Services will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused.

    Where embedded status codes 8456 and 8457 map to the following.

    Decimal error Hexadecimal error Error string
    8456 2108 The source server is currently rejecting replication
    8457 2109 The destination server is currently rejecting replication

  5. NTDS General Event 2013 may be logged in the Directory Services event log. This indicates that a USN rollback occurred because of an unsupported rollback or restore of the Active Directory Database.

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 2103
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description: The Active Directory database has been restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. As a result, the Net Logon service has paused. User Action See previous event logs for details. For more information, visit the Help and Support Center at https://support.microsoft.com.

  6. NTDS General Event 1393 may be logged in the Directory Services event log. This indicates that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space:

    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 1393
    Date: <date>
    Time: <time>
    User: <user name>
    Computer: <computer name>
    Description:
    Attempts to update the Directory Service database are failing with error 112. Since Windows will be unable to log on users while this condition persists, the NetLogon service is being paused. M ake sure that sufficient free disk space is available on the drives where the directory database and log files reside.

Cause

Incoming or outgoing replication was automatically disabled by the operating system because of multiple root causes.

Three events that disable inbound or outbound replication include:

  • A USN rollback occurred (NTDS General Event 2103).
  • The hard disk is full (NTDS General Event 1393).
  • A corrupt UTD vector is present (Event 2881).

The operating system automatically makes four configuration changes when one of three conditions occurs. The four configuration changes are as follows:

  1. Incoming Active Directory replication is disabled.
  2. Outgoing Active Directory replication is disabled.
  3. DSA not writable is set to a nonzero value in the registry.
  4. The NETLOGON service status is changed from running to paused.

The dominant root cause for this error condition is a USN rollback discussed in A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

Do not assume that any nonzero value for DSA not writable or that a source or destination server is currently rejecting replication requests during DCPROMO / AD Replication definitively means that a USN rollback has occurred and that such domain controllers implicitly have to be force-demoted or force-repromoted. Demotionmaybe the correct option. However, it may be excessive when the error is caused by insufficient free disk space.

Resolution

  1. Check the value for DSA not writable.

    For each domain controller that is logging the 8456 or 8457 error, determine whether one of the three triggering events automatically disabled incoming or outgoing Active Directory Replication by reading the value for » DSA not writable» from the local registry.

    When replication is automatically disabled, the operating system writes one of four possible values to DSA not writable:

    • Path: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
    • Setting: DSA not writable
    • Type: Reg_dword
    • Values:
      • #define DSA_WRITABLE_GEN 1
      • #define DSA_WRITABLE_NO_SPACE 2
      • #define DSA_WRITABLE_USNROLLBCK 4
      • #define DSA_WRITABLE_CORRUPT_UTDV 8

    A value of 1 can be written only when the forest version is incompatible with the OS (for example, the W2K DC is promoted into a Windows Server 2003 forest functional level forest or the like).

    A value of 2 means that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space.

    A value of 4 means that a USN rollback occurred because the Active Directory database was incorrectly rolled back in time. Operations that are known to cause a USN rollback include the following:

    • The booting from previously saved virtual machine snapshots of domain controller role computers on Hyper-V or VMWARE hosts.
    • Incorrect physical-to-virtual (P2V) conversions in forests that contain more than one domain controller.
    • Restoring DC role computers by using imaging products such as Ghost.
    • Rolling the contents of a partition that is hosting the active directory database back in time by using an advanced disk subsystem.

    A value of 8 indicates that the up-to-dateness-vector is corrupted on the local DC.

    Technically, DSA not writable could consist of multiple values. For example, a registry value of 10 would indicate insufficient disk space and a corrupted UTD. Typically, a single value is written to DSA not writable.

    [!NOTE]
    It is common for support professionals and administrators to partly disable the replication quarantine by enabling outgoing replication, by enabling incoming replication, by changing the startup value for the NETLOGON service from disabled to automatic, and by starting the NETLOGON service. Therefore, the full quarantine configuration may not be in place when it is examined.

  2. Check the Directory Service event log for quarantine events.

    Assuming the Directory Service event log has not wrapped, you may find one or more related events logged in the Directory Service event log of a domain controller that is logging the 8456 or 8457 error.

    Event Details
    NTDS General 2103 The Active Directory database was restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused. User Action See previous event logs for more information.
    NTDS General Event 1393 There is insufficient space on the disk.
    Event 2881 Not applicable

  3. Perform the recovery based on the value of DSA not writable or on events that are logged on the system:

    • If DSA not writable equals 4 or if NTDS General Event 2103 is logged, perform the recovery steps for a USN Rollback. For more information, see A Windows Server domain controller logs Directory Services event 2095 when it encounters a USN rollback.

    • If DSA not writable equals 2 or if NTDS General event 1393 is logged, check for sufficient free disk space on the physical and virtual partitions that are hosting the Active Directory database and log files. Free up space as required.

    • If DSA not writable equals 8, demote and then repromote the domain controller before it can replicate its bad value to other domain controllers in the forest.

Источник

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 233

1

Ошибка репликации между контроллерами домена

16.09.2020, 17:42. Показов 5561. Ответов 9

Студворк — интернет-сервис помощи студентам

После установки обновления на Контроллеры Домена, один из КД после перезагрузки перестал запускаться.
Все попытки запустить его не привели к успеху.
Единственным решением оставалось восстановить машину из резервной копии.
После восстановления и успешного запуска, этот контроллер перестал синхронизироваться с остальными контроллерами домена. В чём причина?
Все сетевые настройки остались в том виде, что и были раньше. Эта машины видна в сети и с неё видны все остальные КД. Однако при каждой попытке принудительной синхронизации появляется следующее сообщение:
При попытке синхронизации контекста именования с контроллера домена CN=Configuration,DC=<мой домен>,DC=local с контроллера домена DC4 на контроллер домена DC3 имела место следующая ошибка: Исходный сервер в настоящий момент отвергает запросы на репликацию.
В журнале событий также ошибки: 8457 Конечный сервер в настоящий момент отвергает запросы на репликацию.
Это КД является FSMO (Хозяином операций). Я не могу перести роль на другой КД (опять же из-за невозможности репликации.
Как восстановить репликацию? Почему она сбилась?
Прошу помощи!!



0

239 / 228 / 47

Регистрация: 12.12.2012

Сообщений: 1,945

17.09.2020, 12:05

2

Хорошая практика, не восстанавливать из бэкапа КД, если есть другие живые. Просто удаляете и поднимаете новый.

Думаю, Ваша СРК не умеет работать с USN. https://winitpro.ru/index.php/… ry-backup/

Потому лучшем способом будет удалить его и поднять новый.

— Захватите принудительно на живом КД все роли, потом понизьте проблемный и удалите.

Так же до этого, можете использоваться в cmd от админа, dcdiag /q чтоб посмотреть ошибки и попробовать нагуглить.

Но самый безболезненный и простой путь захват ролей на живом и понижение, удаление старого. Потом можете вновь поднять виртуалку, дать ей такие же сетевые настройки, имя и поднять до контроллера.



0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 233

17.09.2020, 12:24

 [ТС]

3

pEntity Спасибо!
Тогда у меня несколько вопросов:

1.Можете дать точную последовательность действий ?
2.Как принудительно захватить роли на рабочем КД?
3.Нужно ли переустанавливать DNS на проблемном КД?
4.Надо ли удалять полностью машину или после понижения просто снова повысить?
5.Как избежать таких проблем в будущем?

Можно ли доверять этой статье по ссылке ниже, что бы делать всё в точности с ней?
https://docs.microsoft.com/ru-… -level-100

спасибо..



0

3 / 1 / 3

Регистрация: 17.08.2012

Сообщений: 197

17.09.2020, 14:55

4

Покажите результат команд:
1) REPADMIN/SHOWREPL
2) w32tm /query /status
3) DCDIAG



0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 233

17.09.2020, 16:13

 [ТС]

5

Принудительно перенес все роли на другой КД.
Понизил проблемный КД до обычного сервера.

Интересуют следующие вопросы:

Можно ли эту машину снова повысить до уровна КД? Не возникнет ли проблем с ней? Или лучше установить новую машину??
Как в будущем избежать данной проблемы, если снова один и КД не может загрузиться??

Пожалуйста, напишите ответы как можно скорее!



0

3 / 1 / 3

Регистрация: 17.08.2012

Сообщений: 197

17.09.2020, 16:38

6

Можно, ток лучше переустановить сервер, полностью его обновить и в конце отключить автоматическое обновление, потом уже накатывать AD и повышать роль.

Контроллеры лучше не обновлять, ток если железо новое и то лучше проверять совместимость всего железа с новыми версиями драйверов.

Был случай,что на старом железе крутился контроллер на 2012r2, пришло обновление с новым драйвером на чипсет, но он оказался кривым для данной мамки и в итоге сервак в bsod падал…. После откатил все обратно и отключил обновления, 2 года бед не знаю, работает и без ошибок.



0

239 / 228 / 47

Регистрация: 12.12.2012

Сообщений: 1,945

17.09.2020, 18:11

7

Цитата
Сообщение от Nightingale81
Посмотреть сообщение

Можно ли эту машину снова повысить до уровна КД? Не возникнет ли проблем с ней? Или лучше установить новую машину??
Как в будущем избежать данной проблемы, если снова один и КД не может загрузиться??

1. Всяко лучше установить с нуля, новую виртуальную машину. В эру виртуализации это быстро и удобно. Зачем Вам тянуть какие-либо старые данные с нее, настройки и т.д. ? Вы будете уверены, что всё впорядке.

2. Как я уже сказал, удалить просто виртуальную машину. На живом КД в оснастке пользователи и компьютеры, удалить неисправный контроллер.



0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 233

22.09.2020, 12:36

 [ТС]

8

Спасибо!

Подняли КД с нуля.
Выходит, что делать резервные копии КД по сути бессмысленно (разве что есть важные данные на нём) если восстановление не работает.
Каким же образом надо делать бэкапы, что бы можно было нормально восстановить контроллеры с синхронизацией?



0

239 / 228 / 47

Регистрация: 12.12.2012

Сообщений: 1,945

23.09.2020, 10:42

9

Не бессмысленно. Если Вам нужно восстановить удаленные объекты, которые были удалены два месяца назад к примеру ?

Или простой пример, у Вас Exchange сервер и он умер, Вам нужно сделать восстановление. Процесс там выглядит как установка нового сервера, ресет учетки объекта компьютера в AD и последующая уставка Exchange сервера, таким образом он подхватывает данные с AD. А вот если не получилось ? Второго шанса нет, потому Вам и придется восстанавливать AD или этот объект с бэкапа.

Бэкап всегда нужен на все случаи траблшутинга.

Каким образом делать бэкап? Купить любую платную систему бэкапа. Мне кажется щас все нормально работают с AD, я работал с вимом и акронисом 12.5(После ребрендинга, ИНФОЗАЩИТА), они точно умеют.

Ну и даже тот же Windows Server Backup, но там нужно уметь еще им восстанавливать. https://winitpro.ru/index.php/… ry-backup/



0

-10 / 0 / 0

Регистрация: 09.06.2016

Сообщений: 233

28.09.2020, 10:59

 [ТС]

10

Для создания резервных копий мы используем платный Veeam. С него же и восстанавливали.
Вроде как можно AD резервировать через встроенный Windows Server Backup.
Пока не пробовали. Не пользовались им никогда..



0
Источник

  • При репликации возникла ошибка 8456
  • При репликации возникла ошибка 8451
  • При репликации возникла ошибка 1908
  • При репликации возникла ошибка 1256
  • При рендеринге вылетает ошибка