Hi Dear,
please check the below info :
1.What
is our domain functional level and forest functional level? Functional as AD DS and DNS
2.How
many domain do you have? 1 domain
3.How
many DCs is each domain? 1 DC
4.What
specific operations are you doing, then we receive this error (add RODC to domain or promote RODC)? It is perfect that you can provide the screenshot with error message. add
RODC
5.Would
you please do the same operations with built-in domain Administrator account and check if it helps? I will check
also please check the below info :
C:\Users\a.maxsood>Dcdiag /v
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
* Verifying that the local machine APS-DC, is a Directory Server.
Home Server = APS-DC
* Connecting to directory service on server APS-DC.
* Identified AD Forest.
Collecting AD specific global data
* Collecting site info.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=aps,DC=iq,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
The previous call succeeded
Iterating through the sites
Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
Getting ISTG and options for the site
* Identifying all servers.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=aps,DC=iq,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
The previous call succeeded....
The previous call succeeded
Iterating through the list of servers
Getting information for the server CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site-Name\APS-DC
Starting test: Connectivity
* Active Directory LDAP Services Check
Determining IP4 connectivity
* Active Directory RPC Services Check
......................... APS-DC passed test Connectivity
Doing primary tests
Testing server: Default-First-Site-Name\APS-DC
Starting test: Advertising
The DC APS-DC is advertising itself as a DC and having a DS.
The DC APS-DC is advertising as an LDAP server
The DC APS-DC is advertising as having a writeable directory
The DC APS-DC is advertising as a Key Distribution Center
Warning: APS-DC is not advertising as a time server.
The DS APS-DC is advertising as a GC.
......................... APS-DC failed test Advertising
Test omitted by user request: CheckSecurityError
Test omitted by user request: CutoffServers
Starting test: FrsEvent
* The File Replication Service Event log test
Skip the test because the server is running DFSR.
......................... APS-DC passed test FrsEvent
Starting test: DFSREvent
The DFS Replication Event Log.
......................... APS-DC passed test DFSREvent
Starting test: SysVolCheck
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... APS-DC passed test SysVolCheck
Starting test: KccEvent
* The KCC Event log test
Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
......................... APS-DC passed test KccEvent
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
Role Domain Owner = CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
Role PDC Owner = CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
Role Rid Owner = CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
Role Infrastructure Update Owner = CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq
......................... APS-DC passed test KnowsOfRoleHolders
Starting test: MachineAccount
Checking machine account for DC APS-DC on DC APS-DC.
* SPN found :LDAP/APS-DC.aps.iq/aps.iq
* SPN found :LDAP/APS-DC.aps.iq
* SPN found :LDAP/APS-DC
* SPN found :LDAP/APS-DC.aps.iq/APS
* SPN found :LDAP/720c98fa-dd7c-48f5-9483-f6d7067f72f4._msdcs.aps.iq
* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/720c98fa-dd7c-48f5-9483-f6d7067f72f4/aps.iq
* SPN found :HOST/APS-DC.aps.iq/aps.iq
* SPN found :HOST/APS-DC.aps.iq
* SPN found :HOST/APS-DC
* SPN found :HOST/APS-DC.aps.iq/APS
* SPN found :GC/APS-DC.aps.iq/aps.iq
......................... APS-DC passed test MachineAccount
Starting test: NCSecDesc
* Security Permissions check for all NC's on DC APS-DC.
* Security Permissions Check for
DC=ForestDnsZones,DC=aps,DC=iq
(NDNC,Version 3)
* Security Permissions Check for
DC=DomainDnsZones,DC=aps,DC=iq
(NDNC,Version 3)
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=aps,DC=iq
(Schema,Version 3)
* Security Permissions Check for
CN=Configuration,DC=aps,DC=iq
(Configuration,Version 3)
* Security Permissions Check for
DC=aps,DC=iq
(Domain,Version 3)
......................... APS-DC passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
Verified share \\APS-DC\netlogon
Verified share \\APS-DC\sysvol
[APS-DC] User credentials does not have permission to perform this operation.
The account used for this test must have network logon privileges
for this machine's domain.
......................... APS-DC failed test NetLogons
Starting test: ObjectsReplicated
APS-DC is in domain DC=aps,DC=iq
Checking for CN=APS-DC,OU=Domain Controllers,DC=aps,DC=iq in domain DC=aps,DC=iq on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq in domain CN=Configuration,DC=aps,DC=iq on 1 servers
Object is up-to-date on all servers.
......................... APS-DC passed test ObjectsReplicated
Test omitted by user request: OutboundSecureChannels
Starting test: Replications
* Replications Check
[Replications Check,APS-DC] DsReplicaGetInfo(PENDING_OPS, NULL) failed, error 0x2105
"Replication access was denied."
......................... APS-DC failed test Replications
Starting test: RidManager
* Available RID Pool for the Domain is 2604 to 1073741823
* APS-DC.aps.iq is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 2104 to 2603
* rIDPreviousAllocationPool is 2104 to 2603
* rIDNextRID: 2200
......................... APS-DC passed test RidManager
Starting test: Services
* Checking Service: EventSystem
* Checking Service: RpcSs
* Checking Service: NTDS
Could not open NTDS Service on APS-DC, error 0x5 "Access is denied."
* Checking Service: DnsCache
* Checking Service: DFSR
* Checking Service: IsmServ
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: w32time
* Checking Service: NETLOGON
......................... APS-DC failed test Services
Starting test: SystemLog
* The System Event log test
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:34:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
A warning event occurred. EventID: 0x00004249
Time Generated: 07/26/2020 11:35:31
Event String:
6 remote calls to the SAM database have been denied in the past 900 seconds throttling window.
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:36:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:38:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:40:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:42:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:44:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:46:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0xC0000010
Time Generated: 07/26/2020 11:47:03
Event String:
While processing a TGS request for the target server m.qassim, the account m.qassim@APS.IQ did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 8). The requested etypes were 18
17. The accounts available etypes were 23 -133 -128 18 17. Changing or resetting the password of m.qassim will generate a proper key.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:47:15
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:47:22
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:47:23
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:48:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:50:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:52:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
A warning event occurred. EventID: 0x00004249
Time Generated: 07/26/2020 11:53:33
Event String:
4 remote calls to the SAM database have been denied in the past 900 seconds throttling window.
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:54:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0xC0000010
Time Generated: 07/26/2020 11:54:30
Event String:
While processing a TGS request for the target server a.abbas, the account a.abbas@APS.IQ did not have a suitable key for generating a Kerberos ticket (the missing key has an ID of 8). The requested etypes were 18
17. The accounts available etypes were 23 -133 -128 18 17. Changing or resetting the password of a.abbas will generate a proper key.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:56:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 11:58:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:00:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:02:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:04:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:06:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:08:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:10:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:12:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
A warning event occurred. EventID: 0x00004249
Time Generated: 07/26/2020 12:13:38
Event String:
5 remote calls to the SAM database have been denied in the past 900 seconds throttling window.
For more information please see http://go.microsoft.com/fwlink/?LinkId=787651.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:14:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:16:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:18:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:20:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:22:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:24:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:26:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:28:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:30:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
An error event occurred. EventID: 0x00009005
Time Generated: 07/26/2020 12:32:05
Event String:
The TLS server credential's certificate does not have a private key information property attached to it. This most often occurs when a certificate is backed up incorrectly and then later restored. This message can also
indicate a certificate enrollment failure.
......................... APS-DC failed test SystemLog
Test omitted by user request: Topology
Test omitted by user request: VerifyEnterpriseReferences
Starting test: VerifyReferences
The system object reference (serverReference) CN=APS-DC,OU=Domain Controllers,DC=aps,DC=iq and backlink on
CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq are correct.
The system object reference (serverReferenceBL)
CN=APS-DC,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=aps,DC=iq and backlink on
CN=NTDS Settings,CN=APS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=aps,DC=iq are
correct.
The system object reference (msDFSR-ComputerReferenceBL)
CN=APS-DC,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=aps,DC=iq and backlink on
CN=APS-DC,OU=Domain Controllers,DC=aps,DC=iq are correct.
......................... APS-DC passed test VerifyReferences
Test omitted by user request: VerifyReplicas
Test omitted by user request: DNS
Test omitted by user request: DNS
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : aps
Starting test: CheckSDRefDom
......................... aps passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... aps passed test CrossRefValidation
Running enterprise tests on : aps.iq
Test omitted by user request: DNS
Test omitted by user request: DNS
Starting test: LocatorCheck
GC Name: \\APS-DC.aps.iq
Locator Flags: 0xe001f1bd
PDC Name: \\APS-DC.aps.iq
Locator Flags: 0xe001f1bd
Warning: DcGetDcName(TIME_SERVER) call failed, error 1355
A Time Server could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355
A Good Time Server could not be located.
KDC Name: \\APS-DC.aps.iq
Locator Flags: 0xe001f1bd
......................... aps.iq failed test LocatorCheck
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside the scope provided by the command line arguments
provided.
......................... aps.iq passed test Intersite
C:\Users\a.maxsood>repadmin /showrepl
Repadmin: running command /showrepl against full DC localhost
Default-First-Site-Name\APS-DC
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 720c98fa-dd7c-48f5-9483-f6d7067f72f4
DSA invocationID: ea5521a1-5e95-4bcd-a92c-566052c72ca7
C:\Users\a.maxsood>repadmin /replsum
Replication Summary Start Time: 2020-07-26 12:33:17
Beginning data collection for replication summary, this may take awhile:
....
Source DSA largest delta fails/total %% error
Destination DSA largest delta fails/total %% error
C:\Users\a.maxsood>
error: 5 (Access s denied) RODC (win srv 2012) with DC (win srv 2016)
