Remove From My Forums

Repadmin /syncall not pushing changes to DC at another site.

Question
0

Sign in to vote

Hello all and thanks for reading my question.

I'm faced with an issue where we have four sites in the domain. KCC isn't properly routing inter site replication, so we were forced to use manually defined replication connections. We have one site acting as a replication hub that replicates changes to, from, and between the other three sites. The problem I'm having is that one site in the forest is only replicating to another DC in the site and not out to the hub. When I do a repadmin /syncall, it only lists the other DC in the site, and when I use the Sites and Services console to replicate to the replication hub, the changes don't ever go through. Am I missing something obvious here?

Monday, August 12, 2013 7:12 PM

Answers

2

Sign in to vote
Without knowing specifics about your infrastructure, since none was provided, I can provide general information on it:

If you have an hub and spoke topology with specific physical connectivity only between the hub and other locations, did you disable BASL (Bridge All Site Links), and create specific links for each site from the hub?

If you didn't disable BASL, the KCC will try to generate partnerships between DCs in sites that they can't directly communicate with.

If you've disabled BASL and manually created separate IP links, the KCC will properly partner up DCs from each site to the hub site. But keep in mind, you will not always see all DCs between each site and hub partnered. The KCC automatically determines what's best and works with the ISTG (Intersite Topology Generator) to construct an optimum replication topology.

Also, if there are any antivirus software on the DCs that haven't been properly configured to exclude AD processes (there are folders, services and registry entries that need to be excluded), then that will cause *major* replication problems. This comes up very often in the forums and is a main thorn in the side for AD replication. It's suggested to check the AV vendor site for specific instructions for their products on how to do that.

Another thorn in the side are firewall rules between locations. If the whole range (TCP 1-65535 & UDP 1-65535) are not opened, expect problems.

And if any of the DCs are multihomed (more than one IP, NIC, RRAS on a DC, and/or iSCSI interface), then that can cause numerous problems, too.

-

To provide specific assistance, please comment/respond on what I've posted above. Also included:

Unedited ipconfig /all from DCs from two of your sites
Event log errors on those DCs. Application, System, and under Application and Services Logs on a DC for the AD Web services, DFS Replication, Directory Services, DNS Server & File Replication Server logs. Post the Event ID# and Source name in the event, and the server name it came from.
Run dcdiag /v > c:\dcdiag.txt
Post the results to a sharing site with a link to them, please.
Is TMG or Proxy at any of the sites?

-

You can use the following to check your replication topology and status (these two tools, along with event log entries, PortQry GUI (to see if there are any ports being blocked between sites), and dcdiags, help me all the time figuring out replication issues). These tools have helped me greatly with troubleshooting large customer installations, besides of course analyzing if DNS was designed properly to support the forest.

1. ReplDIAG: (run it as repldiag > c:\repldiag.txt, then open it as a CSV in Excel choosing comma separated, to be able to clearly read the output)
   Explained here:
     Troubleshooting replication with ReplDiag.exe [part 1 of 4], Rob Bolbotowski [MSFT], 13 Oct 2010 12:04 PM
     http://blogs.technet.com/b/robertbo/archive/2010/10/13/troubleshooting-replication-with-repldiag-exe-part-1-of-4.aspx
        ReplDiag Downloadable from:
        http://activedirectoryutils.codeplex.com/releases/view/13664

2. Download The Active Directory Replication Status Tool:
   http://www.microsoft.com/en-us/download/details.aspx?id=30005
     This tool requires .Net Framework 4. If it's not installed, download and install it:
       Microsoft .NET Framework 4 (Web Installer)
       http://www.microsoft.com/en-us/download/details.aspx?id=17851

3. Run PortQry GUI choosing the "Domains & Trusts" option between each other (DCs). Run the test from a DC to a DC from both sides to each other, or you can also run it from a client to a DC. Post only errors with "NOTLISTENING," 0x00000001, and 0x00000002.
       PortQryUI - GUI - Version 2.0 8/2/2004
       http://www.microsoft.com/download/en/details.aspx?id=24009

Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

This post is provided AS-IS with no warranties or guarantees and confers no rights.
- Proposed as answer by Meinolf Weber Tuesday, August 13, 2013 7:08 AM
- Marked as answer by Amy Wang_ Monday, August 19, 2013 1:35 AM
Monday, August 12, 2013 10:07 PM
1

Sign in to vote
Hi G.Summer,

According to your description, my understanding is that the problematic site in your domain may not have network connectivity or a proper site link with the hub site.

Firstly, please check the network connectivity between the problematic site and the hub site. I suggest you use PING command to verify the network connectivity between two sites.

If the network connectivity is fine, please check the site link in Active Directory Sites and Services.

Here are some links below could be useful to you:

Ping

http://technet.microsoft.com/en-us/library/bb490968.aspx

Create a site link

http://technet.microsoft.com/en-us/library/cc783909(v=WS.10).aspx

Managing Sites

http://technet.microsoft.com/en-us/library/bb727051.aspx

Hub and spoke topology with sites and services

http://social.technet.microsoft.com/Forums/windowsserver/en-US/70104b15-2e6f-428e-9361-ddc1eb816b12/hub-and-spoke-topology-with-sites-and-services

Please let us know if your problem still exists.

Best Regards,
Amy Wang
- Edited by Amy Wang_ Friday, August 16, 2013 1:15 AM edit
- Marked as answer by Amy Wang_ Monday, August 19, 2013 1:35 AM
Tuesday, August 13, 2013 8:52 AM
0

Sign in to vote
Hello everyone,

Thanks for all of your helpful posts. The issue is somewhat resolved. I was able to get point to point replication going by resetting the machine account password (http://support.microsoft.com/kb/325850/en-us). I eventually was able to convince the customer to open all the DCs at each site to each other (instead of the hub/spoke they wanted) and allow KCC to do it's thing as, which it's doing now. Replication is working at the regular intervals now although I had to shorten the interval. So far so good.

Using the tips you guys gave me, I was able to identify two other problems I have; one where manually defined replication links (repadmin /add) only work for one replication, then generate the "AD Replication error 8452: "The naming context is in the process of being removed or is not replicated from the specified server."; another with manually created Replication objects (via Sites and Services) that don't replicate anything but a single partition.

My curiosity wants to know more about why this is, but for now I'd say I'm good to go. Thanks to all of you!
- Edited by G. Summer Tuesday, September 17, 2013 6:07 PM
- Marked as answer by Amy Wang_ Wednesday, September 18, 2013 1:23 AM
Tuesday, September 17, 2013 6:00 PM

All replies

2

Sign in to vote
Without knowing specifics about your infrastructure, since none was provided, I can provide general information on it:

If you have an hub and spoke topology with specific physical connectivity only between the hub and other locations, did you disable BASL (Bridge All Site Links), and create specific links for each site from the hub?

If you didn't disable BASL, the KCC will try to generate partnerships between DCs in sites that they can't directly communicate with.

If you've disabled BASL and manually created separate IP links, the KCC will properly partner up DCs from each site to the hub site. But keep in mind, you will not always see all DCs between each site and hub partnered. The KCC automatically determines what's best and works with the ISTG (Intersite Topology Generator) to construct an optimum replication topology.

Also, if there are any antivirus software on the DCs that haven't been properly configured to exclude AD processes (there are folders, services and registry entries that need to be excluded), then that will cause *major* replication problems. This comes up very often in the forums and is a main thorn in the side for AD replication. It's suggested to check the AV vendor site for specific instructions for their products on how to do that.

Another thorn in the side are firewall rules between locations. If the whole range (TCP 1-65535 & UDP 1-65535) are not opened, expect problems.

And if any of the DCs are multihomed (more than one IP, NIC, RRAS on a DC, and/or iSCSI interface), then that can cause numerous problems, too.

-

To provide specific assistance, please comment/respond on what I've posted above. Also included:

Unedited ipconfig /all from DCs from two of your sites
Event log errors on those DCs. Application, System, and under Application and Services Logs on a DC for the AD Web services, DFS Replication, Directory Services, DNS Server & File Replication Server logs. Post the Event ID# and Source name in the event, and the server name it came from.
Run dcdiag /v > c:\dcdiag.txt
Post the results to a sharing site with a link to them, please.
Is TMG or Proxy at any of the sites?

-

You can use the following to check your replication topology and status (these two tools, along with event log entries, PortQry GUI (to see if there are any ports being blocked between sites), and dcdiags, help me all the time figuring out replication issues). These tools have helped me greatly with troubleshooting large customer installations, besides of course analyzing if DNS was designed properly to support the forest.

1. ReplDIAG: (run it as repldiag > c:\repldiag.txt, then open it as a CSV in Excel choosing comma separated, to be able to clearly read the output)
   Explained here:
     Troubleshooting replication with ReplDiag.exe [part 1 of 4], Rob Bolbotowski [MSFT], 13 Oct 2010 12:04 PM
     http://blogs.technet.com/b/robertbo/archive/2010/10/13/troubleshooting-replication-with-repldiag-exe-part-1-of-4.aspx
        ReplDiag Downloadable from:
        http://activedirectoryutils.codeplex.com/releases/view/13664

2. Download The Active Directory Replication Status Tool:
   http://www.microsoft.com/en-us/download/details.aspx?id=30005
     This tool requires .Net Framework 4. If it's not installed, download and install it:
       Microsoft .NET Framework 4 (Web Installer)
       http://www.microsoft.com/en-us/download/details.aspx?id=17851

3. Run PortQry GUI choosing the "Domains & Trusts" option between each other (DCs). Run the test from a DC to a DC from both sides to each other, or you can also run it from a client to a DC. Post only errors with "NOTLISTENING," 0x00000001, and 0x00000002.
       PortQryUI - GUI - Version 2.0 8/2/2004
       http://www.microsoft.com/download/en/details.aspx?id=24009

Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

This post is provided AS-IS with no warranties or guarantees and confers no rights.
- Proposed as answer by Meinolf Weber Tuesday, August 13, 2013 7:08 AM
- Marked as answer by Amy Wang_ Monday, August 19, 2013 1:35 AM
Monday, August 12, 2013 10:07 PM
0

Sign in to vote

I second Ace with the information provided. If you are manually performing replication & its not working means even replication & its not happening, then i would look at the errors in the event log of the DC & also, verify the overall health of my AD environment.

Did you check the event logs, what it says? BTW, KCC can do its job considering all the sites,subnets, sites links are defined properly. By default, BASL is enabled.

Active Directory Replication Status Tool Released

What does DCDIAG actually… do?

I would suggest you to refer the below two articles from the DS team.

http://blogs.technet.com/b/markmoro/archive/2012/10/26/3445433.aspx

http://blogs.technet.com/b/askds/archive/2011/04/29/sites-sites-everywhere.aspx

Awinish Vishwakarma - MVP

My Blog: awinish.wordpress.com

Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Tuesday, August 13, 2013 1:26 AM
1

Sign in to vote
Hi G.Summer,

According to your description, my understanding is that the problematic site in your domain may not have network connectivity or a proper site link with the hub site.

Firstly, please check the network connectivity between the problematic site and the hub site. I suggest you use PING command to verify the network connectivity between two sites.

If the network connectivity is fine, please check the site link in Active Directory Sites and Services.

Here are some links below could be useful to you:

Ping

http://technet.microsoft.com/en-us/library/bb490968.aspx

Create a site link

http://technet.microsoft.com/en-us/library/cc783909(v=WS.10).aspx

Managing Sites

http://technet.microsoft.com/en-us/library/bb727051.aspx

Hub and spoke topology with sites and services

http://social.technet.microsoft.com/Forums/windowsserver/en-US/70104b15-2e6f-428e-9361-ddc1eb816b12/hub-and-spoke-topology-with-sites-and-services

Please let us know if your problem still exists.

Best Regards,
Amy Wang
- Edited by Amy Wang_ Friday, August 16, 2013 1:15 AM edit
- Marked as answer by Amy Wang_ Monday, August 19, 2013 1:35 AM
Tuesday, August 13, 2013 8:52 AM
0

Sign in to vote
Hello everyone,

Thanks for all of your helpful posts. The issue is somewhat resolved. I was able to get point to point replication going by resetting the machine account password (http://support.microsoft.com/kb/325850/en-us). I eventually was able to convince the customer to open all the DCs at each site to each other (instead of the hub/spoke they wanted) and allow KCC to do it's thing as, which it's doing now. Replication is working at the regular intervals now although I had to shorten the interval. So far so good.

Using the tips you guys gave me, I was able to identify two other problems I have; one where manually defined replication links (repadmin /add) only work for one replication, then generate the "AD Replication error 8452: "The naming context is in the process of being removed or is not replicated from the specified server."; another with manually created Replication objects (via Sites and Services) that don't replicate anything but a single partition.

My curiosity wants to know more about why this is, but for now I'd say I'm good to go. Thanks to all of you!
- Edited by G. Summer Tuesday, September 17, 2013 6:07 PM
- Marked as answer by Amy Wang_ Wednesday, September 18, 2013 1:23 AM
Tuesday, September 17, 2013 6:00 PM
0

Sign in to vote

Hi G.Summer,

Thank you very much for your sharing! I’m glad it all worked out.

This solution will help lots of people who have similar issues.

Since this post was released a long time ago, if there are further requirements, would you please release another post on the forum, so we can discuss the issue more efficiently?

Thank you for your support and understanding!

Best Regards,

Amy Wang

Wednesday, September 18, 2013 1:31 AM

Products

Resources

Solutions

Updates

Trials

Related Sites

Training

Certifications

Other resources

Support options

More support

Not an IT pro?

Answered by:

Repadmin /syncall not pushing changes to DC at another site.

Question

Answers

All replies