No FSMO Role on this DC,
The server was being promoted, after reboot, I could login in but could not open anything from system32 "Access Denied" after a while it fixed itself this error but now DNS service is no starting "
The DNS server is waiting for Active Directory Domain Services (AD DS) to signal that the initial synchronization of the directory has been completed. " Event ID 4013
Any idea will be much appreciate .
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 6/11/2018 4:23:46 PM
Event ID: 1557
Task Category: Replication
Level: Information
Keywords: Classic
User: ANONYMOUS LOGON
Computer: XYZDC11.com.au
Description:
This directory server has not completed a full synchronization of the following directory partition. This directory server will not available to clients until this task is completed.
Directory partition:
DC=com.au
An attempt to complete a full synchronization of this directory partition will be tried again later.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS General" />
<EventID Qualifiers="16384">1557</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>5</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2018-11-06T05:23:46.304087400Z" />
<EventRecordID>529</EventRecordID>
<Correlation />
<Execution ProcessID="492" ThreadID="1460" />
<Channel>Directory Service</Channel>
<Computer>XYZDC11.com.au</Computer>
<Security UserID="S-1-5-7" />
</System>
<EventData>
<Data>DC=Com,DC=au</Data>
</EventData>
</Event>
aWindows PowerShell
Copyright (C) 2012 Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> dcdiag /kcc
Invalid Syntax: Invalid option /kcc. Use dcdiag.exe /h for help.
PS C:\Windows\system32> repadmin /kcc
Repadmin: running command /kcc against full DC localhost
XYZDC
Current Site Options: (none)
Consistency check on localhost successful.
PS C:\Windows\system32> dcdiag
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = XYZDCDC11
The directory service on XYZDCDC11 has not finished initializing.
In order for the directory service to consider itself synchronized, it must attempt an initial synchronization with
at least one replica of this server's writeable domain. It must also obtain Rid information from the Rid FSMO
holder.
The directory service has not signalled the event which lets other services know that it is ready to accept
requests. Services such as the Key Distribution Center, Intersite Messaging Service, and NetLogon will not consider
this system as an eligible domain controller.
* Identified AD Forest.
The directory service on XYZDCDC11 has not finished initializing.
In order for the directory service to consider itself synchronized, it must attempt an initial synchronization with
at least one replica of this server's writeable domain. It must also obtain Rid information from the Rid FSMO
holder.
The directory service has not signalled the event which lets other services know that it is ready to accept
requests. Services such as the Key Distribution Center, Intersite Messaging Service, and NetLogon will not consider
this system as an eligible domain controller.
Done gathering initial info.
Doing initial required tests
Testing server: XYZDC\XYZDCDC11
Starting test: Connectivity
The directory service on XYZDCDC11 has not finished initializing.
In order for the directory service to consider itself synchronized, it must attempt an initial
synchronization with at least one replica of this server's writeable domain. It must also obtain Rid
information from the Rid FSMO holder.
The directory service has not signalled the event which lets other services know that it is ready to accept
requests. Services such as the Key Distribution Center, Intersite Messaging Service, and NetLogon will not
consider this system as an eligible domain controller.
......................... XYZDCDC11 passed test Connectivity
Doing primary tests
Testing server: XYZDC\XYZDCDC11
Starting test: Advertising
Warning: the directory service on XYZDCDC11 has not completed initial synchronization.
Other services will be delayed.
Verify that the server can replicate.
Warning: DsGetDcName returned information for\\XYZDCDC02.domain.com, when we were trying to reach XYZDCDC11.
SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
......................... XYZDCDC11 failed test Advertising
Starting test: FrsEvent
......................... XYZDCDC11 passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... XYZDCDC11 failed test DFSREvent
Starting test: SysVolCheck
......................... XYZDCDC11 passed test SysVolCheck
Starting test: KccEvent
A warning event occurred. EventID: 0x8000051C
Time Generated: 11/06/2018 16:27:18
Event String:
The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the followin
g directory service has consistently failed.
......................... XYZDCDC11 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... XYZDCDC11 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... XYZDCDC11 passed test MachineAccount
Starting test: NCSecDesc
......................... XYZDCDC11 passed test NCSecDesc
Starting test: NetLogons
......................... XYZDCDC11 passed test NetLogons
Starting test: ObjectsReplicated
......................... XYZDCDC11 passed test ObjectsReplicated
Starting test: Replications
REPLICATION LATENCY WARNING
XYZDCDC11: This replication path was preempted by higher priority work.
from GOULBDC01 to XYZDCDC11
Reason: The operation completed successfully.
The last success occurred at (never).
Replication of new changes along this path will be delayed.
REPLICATION LATENCY WARNING
XYZDCDC11: This replication path was preempted by higher priority work.
from GOULBDC01 to XYZDCDC11
Reason: The operation completed successfully.
The last success occurred at (never).
Replication of new changes along this path will be delayed.
REPLICATION LATENCY WARNING
XYZDCDC11: This replication path was preempted by higher priority work.
from GOULBDC01 to XYZDCDC11
Reason: The operation completed successfully.
The last success occurred at (never).
Replication of new changes along this path will be delayed.
REPLICATION LATENCY WARNING
XYZDCDC11: This replication path was preempted by higher priority work.
from GOULBDC01 to XYZDCDC11
Reason: The operation completed successfully.
The last success occurred at (never).
Replication of new changes along this path will be delayed.
REPLICATION LATENCY WARNING
XYZDCDC11: This replication path was preempted by higher priority work.
from GOULBDC01 to XYZDCDC11
Reason: The operation completed successfully.
The last success occurred at (never).
Replication of new changes along this path will be delayed.
REPLICATION LATENCY WARNING
XYZDCDC11: A full synchronization is in progress
from GOULBDC01 to XYZDCDC11
Replication of new changes along this path will be delayed.
The full sync is 0 percent complete.
[Replications Check,XYZDCDC11] A recent replication attempt failed:
From XYZDCDC02 to XYZDCDC11
Naming Context:
The replication generated an error (8461):
The replication operation was preempted.
The failure occurred at 2018-11-06 16:31:21.
The last success occurred at (never).
1 failures have occurred since the last success.
REPLICATION LATENCY WARNING
XYZDCDC11: A full synchronization is in progress
from XYZDCDC02 to XYZDCDC11
Replication of new changes along this path will be delayed.
The full sync is 87 percent complete.
......................... XYZDCDC11 failed test Replications
Starting test: RidManager
Warning: attribute rIdSetReferences missing from CN=XYZDCDC11,OU=Domain Controllers,
Could not get Rid set Reference :failed with 8481: The search failed to retrieve attributes from the database.
......................... XYZDCDC11 failed test RidManager
Starting test: Services
......................... XYZDCDC11 passed test Services
Starting test: SystemLog
A warning event occurred. EventID: 0x00001796
Time Generated: 11/06/2018 15:38:55
Event String:
Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and t
his server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
An error event occurred. EventID: 0x0000271A
Time Generated: 11/06/2018 16:21:43
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
An error event occurred. EventID: 0x0000271A
Time Generated: 11/06/2018 16:21:43
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
An error event occurred. EventID: 0x0000271A
Time Generated: 11/06/2018 16:21:43
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
An error event occurred. EventID: 0x0000271A
Time Generated: 11/06/2018 16:21:43
Event String:
The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
A warning event occurred. EventID: 0x00002724
Time Generated: 11/06/2018 16:22:27
Event String:
This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you s
hould use only static IPv6 addresses.
An error event occurred. EventID: 0x00000416
Time Generated: 11/06/2018 16:22:28
Event String:
The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain domain.com, has dete
rmined that it is not authorized to start. It has stopped servicing clients. The following are some possible reasons f
or this:
An error event occurred. EventID: 0x0000410B
Time Generated: 11/06/2018 16:22:48
Event String:
The request for a new account-identifier pool failed. The operation will be retried until the request succee
ds. The error is
......................... XYZDCDC11 failed test SystemLog
Starting test: VerifyReferences
......................... XYZDCDC11 passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : dec
Starting test: CheckSDRefDom
......................... dec passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... dec passed test CrossRefValidation
Running enterprise tests on : domain.com
Starting test: LocatorCheck
......................... domain.com passed test LocatorCheck
Starting test: Intersite
......................... domain.com passed test Intersite
PS C:\Windows\system32>
PS C:\Windows\system32> repadmin
Usage: repadmin <cmd> <args> [/u:{domain\user}] [/pw:{password|*}]
[/retry[:<retries>][:<delay>]]
[/csv]
Use these commands to see the help:
/? Displays a list of commands available for use in repadmin and their
description.
/help Same as /?
/?:<cmd> Displays the list of possible arguments <args>, appropriate
syntaxes and examples for the specified command <cmd>.
/help:<cmd> Same as /?:<cmd>
/experthelp Displays a list of commands for use by advanced users only.
/listhelp Displays the variations of syntax available for the DSA_NAME,
DSA_LIST, NCNAME and OBJ_LIST strings.
/oldhelp Displays a list of deprecated commands that still work but
are no longer supported by Microsoft.
Supported <cmd> commands (use /?<cmd> for detailed help):
/kcc Forces the KCC on targeted domain controller(s) to immediately
recalculate its inbound replication topology.
/prp This command allows an admin to view or modify the
password replication policy for RODCs.
/queue Displays inbound replication requests that the DC needs to issue
to become consistent with its source replication partners.
/replicate Triggers the immediate replication of the specified directory
partition to the destination domain controller from the source DC.
/replsingleobj Replicates a single object between any two domain
controllers that have common directory partitions.
/replsummary The replsummary operation quickly and concisely summarizes
the replication state and relative health of a forest.
/rodcpwdrepl Triggers replication of passwords for the specified user(s)
from the source (Hub DC) to one or more Read Only DC's.
/showattr Displays the attributes of an object.
/showobjmeta Displays the replication metadata for a specified object
stored in Active Directory, such as attribute ID, version
number, originating and local Update Sequence Number (USN), and
originating server's GUID and Date and Time stamp.
/showrepl Displays the replication status when specified domain controller
last attempted to inbound replicate Active Directory partitions.
/showutdvec displays the highest committed Update Sequence Number (USN)
that the targeted DC's copy of Active Directory shows as
committed for itself and its transitive partners.
/syncall Synchronizes a specified domain controller with all replication
partners.
Supported additional parameters:
/u: Specifies the domain and user name separated by a backslash
{domain\user} that has permissions to perform operations in
Active Directory. UPN logons not supported.
/pw: Specifies the password for the user name entered with the /u
parameter.
/retry This parameter will cause repadmin to repeat its attempt to bind
to the target dc should the first attempt fail with one of the
following error status:
1722 / 0x6ba : "The RPC Server is unavailable"
1753 / 0x6d9 : "There are no more endpoints available from the
endpoint mapper"
/csv Used with /showrepl to output results in comma separated
value format. See /csvhelp
Note: Most commands take their parameters in the order of "Destination or
Target DSA_LIST", then a "Source DSA_NAME" if required, and finally the
NC or Object DN if required.
<DSA_NAME> (or <DSA_LIST>) is a Directory Service Agent binding
string. For Active Directory Domain Services, this is simply a network
label (such as a DNS, NetBios, or IP address) of a Domain Controller.
For Active Directory Lightweight Directory Services, this must be a
network label of the AD LDS server followed by a colon and the LDAP
port of the AD LDS instance
Examples (AD DS): dc-01
dc-01.microsoft.com
Examples (AD LDS): ad-am-01:2000
ad-am-01.microsoft.com:2000
<Naming Context> is the Distinguished Name of the root of the NC
Example: DC=My-Domain,DC=Microsoft,DC=Com
Note: Text (Naming Context names, server names, etc) with International or
Unicode characters will only display correctly if appropriate fonts and
language support are loaded.
PS C:\Windows\system32> repadmin
NSW DECC