The destination server is currently rejecting replication requests

Ben Broadfoot 21 Reputation points
2021-09-13T05:42:37.543+00:00

I have recently restored 2 working Windows 2008R2 domain controllers (NPD-DC01 & NPD-DC02) into a test lab environment. I am getting the error "8457 The destination server is currently rejecting replication requests." in the Directory Service event log.

I have tried some suggestions already:

repadmin /options NPD-DC01 +DISABLE_OUTBOUND_REPL
repadmin /options NPD-DC01 -DISABLE_OUTBOUND_REPL
repadmin /options NPD-DC01 +DISABLE_INBOUND_REPL

repadmin /options NPD-DC01 -DISABLE_INBOUND_REPL

repadmin /options NPD-DC02 +DISABLE_OUTBOUND_REPL
repadmin /options NPD-DC02 -DISABLE_OUTBOUND_REPL
repadmin /options NPD-DC02 +DISABLE_INBOUND_REPL
repadmin /options NPD-DC02 -DISABLE_INBOUND_REPL

however I still cannot get them replicating - all network comms between the 2 are fine.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,108 questions
Accepted answer
  1. Dave Patrick 426.1K Reputation points MVP
    2021-09-15T01:30:05.847+00:00

    The current DC is not in the domain controller's OU NPD-DC01

    Out-of-date attribute pwdLastSet on NPD-DC02 (writeable)
    https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/use-netdom-reset-domain-controller-password

    How long has this been going on?
    https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/replication-error-8456-8457

    w32time Service is stopped on [NPD-DC01] start it

    Looks like NPD-DC02 tombstoned long ago. The only solution here is to remove it. Perform cleanup on NPD-DC01 to remove remnants
    https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
    https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564

    then stand up a new one for replacement.

    I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2008, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Dave Patrick 426.1K Reputation points MVP
    2021-09-14T11:56:52.51+00:00

    You should never restore multiple domain controllers from backup.

    Please run;

    Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
    repadmin /showrepl >C:\repl.txt
    ipconfig /all > C:\dc1.txt
    ipconfig /all > C:\dc2.txt
    ipconfig /all > C:\dc3.txt

    then put unzipped text files up on OneDrive and share a link.

    1 person found this answer helpful.