none
GPOTool: DS and Sysvol Version Mismatch

    Question

  • First some background:  We have three DCs: the PDC role is on DC1 (Windows Server 2008 x64) in Site_A and DC2 (Windows Server 2008 R2 x64) and DC3 (Windows Server 2008 R2 x64) are in Site_B.  Site_A and Site_B are connected with a dedicated 1GB fibre link.  Connectivity between all of the DCs seems okay (ping <1ms; SMB/RPC access works).

    I am trying to diagnose a group policy issue where changes to group policy are not being successfully replicated.  This is showing up in a number of ways including a 'null' group policy (see my earlier thread: http://social.technet.microsoft.com/Forums/en/winserverGP/thread/39c3b195-a981-434a-9dce-7873616bf831) and differences in DS and Sysvol version numbers between some group policies.

    I have read the advice from Miles Zhang from another post (http://social.technet.microsoft.com/Forums/en/winserverGP/thread/019d27df-fdb7-41f6-a88f-275be24f8275) but this seems to assume that the version mismatch is on the PDC however this does not seem to be the case for me:  the DS and Sysvol versions match on the PDC but not on the other DCs.


    Validating DCs...
    Available DCs:
    DC1.domain.suffix
    DC2.domain.suffix
    DC3.domain.suffix
    Searching for policies...
    Found 1 policies
    ============================================================
    Policy {4DCDE90A-5F03-497E-9A05-C695A5A7A6AD}
    Friendly name: Mapped drives & Folder Redirections
    Error: Version mismatch on DC2.domain.suffix, DS=14876720, sysvol=13631532
    Error: Version mismatch on DC3.domain.suffix, DS=14876720, sysvol=13631532
    Details:
    ------------------------------------------------------------
    DC: DC1.domain.suffix
    Friendly name: Mapped drives & Folder Redirections
    Created: 14/05/2009 08:58:36
    Changed: 30/11/2009 14:40:59
    DS version:     227(user) 48(machine)
    Sysvol version: 227(user) 48(machine)
    Flags: 0 (user side enabled; machine side enabled)
    User extensions: [{00000000-0000-0000-0000-000000000000}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{0E28E245-9368-4853-AD84
    -6DA3BA35BB75}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C
    04FB9603F}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
    Machine extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{42B5FAAE-6536-11D2-A
    E5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-
    00A0C90F574B}][{C631DF4C-088F-4156-B058-4375F0853CD8}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]
    Functionality version: 2
    ------------------------------------------------------------
    ------------------------------------------------------------
    DC: DC2.domain.suffix
    Friendly name: Mapped drives & Folder Redirections
    Created: 14/05/2009 08:58:36
    Changed: 30/11/2009 14:49:36
    DS version:     227(user) 48(machine)
    Sysvol version: 208(user) 44(machine)
    Flags: 0 (user side enabled; machine side enabled)
    User extensions: [{00000000-0000-0000-0000-000000000000}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{0E28E245-9368-4853-AD84
    -6DA3BA35BB75}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C
    04FB9603F}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
    Machine extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{42B5FAAE-6536-11D2-A
    E5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-
    00A0C90F574B}][{C631DF4C-088F-4156-B058-4375F0853CD8}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]
    Functionality version: 2
    ------------------------------------------------------------
    ------------------------------------------------------------
    DC: DC3.domain.suffix
    Friendly name: Mapped drives & Folder Redirections
    Created: 14/05/2009 08:58:36
    Changed: 30/11/2009 14:49:34
    DS version:     227(user) 48(machine)
    Sysvol version: 208(user) 44(machine)
    Flags: 0 (user side enabled; machine side enabled)
    User extensions: [{00000000-0000-0000-0000-000000000000}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{0E28E245-9368-4853-AD84
    -6DA3BA35BB75}{35141B6B-498A-4CC7-AD59-CEF93D89B2CE}][{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C
    04FB9603F}][{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}]
    Machine extensions: [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{42B5FAAE-6536-11D2-A
    E5A-0000F87571E3}{40B6664F-4972-11D1-A7CA-0000F87571E3}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-
    00A0C90F574B}][{C631DF4C-088F-4156-B058-4375F0853CD8}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]
    Functionality version: 2
    ------------------------------------------------------------


    Now it is possible that at some point the PDC role was pushed from DC1 to DC2 or DC3 and has since been pushed back.  My question is what can I do to diagnose why replication between DC1 and DC2/DC3 is not working (I am having some trouble getting repadmin to show me anything meaningful) and how can I force DC2/DC3 to pick up the latest version of the Group Policy?

    Many thanks, 
    Monday, November 30, 2009 3:54 PM

Answers

  • Hi Luke,

    In order to keep trace of troubleshooting and avoid confusion, I suggest we update in one thread. Please let me know which one you prefer.

    Please note, DC1 and DC2, DC3 are in different sites, so the replication delay is longer. To make sure the replication occurs, try to replicate manually:

    In the Active Directory Sites and Services MMC console, right-click a connection object, and then click Replicate Now.

    DFS Replication replaces the File Replication Service (FRS) as the replication engine for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level. Please let us know the Domain functional level.

    And collect the following information:

    1.    Run "repadmin /showreps DC2", "repadmin /showreps DC3" on DC1 and let us know the result.
    2.    Run "repadmin /showreps" on DC2, DC3.

    Thanks.

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, December 01, 2009 6:13 AM
    Moderator

All replies

  • Hi Luke,

    In order to keep trace of troubleshooting and avoid confusion, I suggest we update in one thread. Please let me know which one you prefer.

    Please note, DC1 and DC2, DC3 are in different sites, so the replication delay is longer. To make sure the replication occurs, try to replicate manually:

    In the Active Directory Sites and Services MMC console, right-click a connection object, and then click Replicate Now.

    DFS Replication replaces the File Replication Service (FRS) as the replication engine for replicating the AD DS SYSVOL folder in domains that use the Windows Server 2008 domain functional level. Please let us know the Domain functional level.

    And collect the following information:

    1.    Run "repadmin /showreps DC2", "repadmin /showreps DC3" on DC1 and let us know the result.
    2.    Run "repadmin /showreps" on DC2, DC3.

    Thanks.

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, December 01, 2009 6:13 AM
    Moderator
  • Hi Luke,

    Have you tried the suggestions? Any update is welcomed. If there is any problem, please let us know the detailed error message.

    Thanks.

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Tuesday, December 08, 2009 1:57 AM
    Moderator