My domain currently has Two DC (both are Windows 2008 R2 Enterprise servers) and 12 RODCs (all are Windows Standard SP2 servers). We installed a new Windows R2 Standard (SP1) server (which will replace one of the RODCs) and made it a third DC (for
offsite DC redundancy). The new Server - DISTFILESRV - has DS and DNS running. However, DNS reports the following 4 errors when I run the "Best Practices Analyzer":
Issue 1
*******************************************************************************
Issue:
None of the secondary servers configured for zone TrustAnchors are responding.
Impact:
Secondary servers will fail DNS queries for the zone TrustAnchors.
Resolution:
Validate secondary servers for zone TrustAnchors.
*******************************************************************************
Issue 2
*******************************************************************************
Issue:
The secondary DNS server XXX.XXX.XX.141 does not respond to queries for the zone TrustAnchors.
Impact:
DNS queries for the zone TrustAnchors might fail.
Resolution:
Verify that the server XXX.XXX.XX.141 is a secondary DNS server that hosts the zone TrustAnchors.
*******************************************************************************
Issue 3
*******************************************************************************
Issue:
The secondary DNS server XXX.XXX.XX.203 does not respond to queries for the zone TrustAnchors.
Impact:
DNS queries for the zone TrustAnchors might fail.
Resolution:
Verify that the server XXX.XXX.XX.203 is a secondary DNS server that hosts the zone TrustAnchors.
*******************************************************************************
Issue 4
*******************************************************************************
Issue:
The secondary DNS server XXX.XXX.XX.142 does not respond to queries for the zone TrustAnchors.
Impact:
DNS queries for the zone TrustAnchors might fail.
Resolution:
Verify that the server XXX.XXX.XX.142 is a secondary DNS server that hosts the zone TrustAnchors.
*******************************************************************************
When I run the "Best Practices Analyzer" on the original DCs, no errors are reported. Also, when I run this command:
dcdiag /v >> "c:\AD Health Check\ad_diag.txt"
on the new DC, I get this error:
******************************************************************************
......................... DISTFILESRV passed test Advertising
Starting test: FrsEvent
* The File Replication Service Event log test
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
A warning event occurred. EventID: 0x800034FA
Time Generated: 07/11/2012 15:06:39
Event String:
Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller
\\ADSecondary.my.domain for FRS replica set configuration information.
This computer is not part of any valid replica set.
A warning event occurred. EventID: 0x800034FD
Time Generated: 07/11/2012 15:11:19
Event String:
File Replication Service is initializing the system volume with data from another domain controller. Computer DISTFILESRV cannot become a domain controller until this process is complete.
The system volume will then be shared as SYSVOL.
To check for the SYSVOL share, at the command prompt, type:
net share
When File Replication Service completes the initialization process, the SYSVOL share will appear.
The initialization of the system volume can take some time. The time is dependent on the amount of data in the system volume, the availability of other domain controllers, and the replication
interval between domain controllers.
A warning event occurred. EventID: 0x800034C4
Time Generated: 07/11/2012 15:20:18
Event String:
The File Replication Service is having trouble enabling replication from ADMaster to DISTFILESRV for d:\dnsbackup\sysvol\domain using the DNS name ADMaster.my.domain. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name ADMaster.my.domain from this computer.
[2] FRS is not running on ADMaster.my.domain.
[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.
This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
......................... DISTFILESRV passed test FrsEvent
**********************************************************
When I run the same command on the PDC, I get this error:
**********************************************************
Starting test: FrsEvent
* The File Replication Service Event log test
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
A warning event occurred. EventID: 0x800034C4
Time Generated: 07/11/2012 15:16:34
Event String:
The File Replication Service is having trouble enabling replication from DISTFILESRV to ADMASTER for c:\addomain\sysvol\domain using the DNS name DISTFILESRV.my.domain. FRS will keep retrying.
Following are some of the reasons you would see this warning.
[1] FRS can not correctly resolve the DNS name DISTFILESRV.my.domain from this computer.
[2] FRS is not running on DISTFILESRV.my.domain.
[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.
This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.
A warning event occurred. EventID: 0x800034C5
Time Generated: 07/11/2012 15:19:35
Event String:
The File Replication Service has enabled replication from DISTFILESRV to ADMASTER for c:\addomain\sysvol\domain after repeated retries.
......................... ADMASTER passed test FrsEvent
*******************************************************************
Any ideas on how to resolve this issue. Also, none of the DCs have the TrustAnchor option checked or configured.
Chris Premo
TrustAnchors erros on new AD DC/DNS server
