Much errors after DC migration

tarek H 181 Reputation points
2021-09-11T09:46:03.22+00:00

i created a new DC VM 2016 , moved the roles , waited for the replication and changed the IP ( flush dns , register dns and dcdiag fix ) but i am still getting errors in the dcdiag i am not able to understand
i want to demote the original DC ( called server1 )
IP or domain name presence is not important , this is a airgapped system

Windows PowerShell
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator.OTOJUSTE> dcdiag /fix

Directory Server Diagnosis

Performing initial setup:
Trying to find home server...
Home Server = DC
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\DC
Starting test: Connectivity
......................... DC passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\DC
Starting test: Advertising
......................... DC passed test Advertising
Starting test: FrsEvent
......................... DC passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... DC failed test DFSREvent
Starting test: SysVolCheck
......................... DC passed test SysVolCheck
Starting test: KccEvent
An error event occurred. EventID: 0xC0000827
Time Generated: 09/11/2021 08:32:55
Event String:
Active Directory Domain Services could not resolve the following DNS host name of the source domain controll
er to an IP address. This error prevents additions, deletions and changes in Active Directory Domain Services from repli
cating between one or more domain controllers in the forest. Security groups, group policy, users and computers and thei
r passwords will be inconsistent between domain controllers until this error is resolved, potentially affecting logon au
thentication and access to network resources.
A warning event occurred. EventID: 0x80000BE1
Time Generated: 09/11/2021 09:20:11
Event String:
The security of this directory server can be significantly enhanced by configuring the server to enforce va
lidation of Channel Binding Tokens received in LDAP bind requests sent over LDAPS connections. Even if no clients are i
ssuing LDAP bind requests over LDAPS, configuring the server to validate Channel Binding Tokens will improve the securi
ty of this server.
A warning event occurred. EventID: 0x80000B47
Time Generated: 09/11/2021 09:20:11
Event String:
......................... DC failed test KccEvent
Starting test: KnowsOfRoleHolders
......................... DC passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... DC passed test MachineAccount
Starting test: NCSecDesc
......................... DC passed test NCSecDesc
Starting test: NetLogons
......................... DC passed test NetLogons
Starting test: ObjectsReplicated
......................... DC passed test ObjectsReplicated
Starting test: Replications
[SERVER1] DsBindWithSpnEx() failed with error 5,
Access is denied..
[Replications Check,DC] A recent replication attempt failed:
From SERVER1 to DC
Naming Context: CN=Schema,CN=Configuration,DC=Otojuste,DC=local
The replication generated an error (8524):
The DSA operation is unable to proceed because of a DNS lookup failure.
The failure occurred at 2021-09-11 08:50:35.
The last success occurred at 2021-09-11 07:50:15.
1 failures have occurred since the last success.
The guid-based DNS name 6b1b8529-7380-49da-b4c2-8044e7ebbe2a._msdcs.Otojuste.local
is not registered on one or more DNS servers.
[Replications Check,DC] A recent replication attempt failed:
From SERVER1 to DC
Naming Context: CN=Configuration,DC=Otojuste,DC=local
The replication generated an error (8524):
The DSA operation is unable to proceed because of a DNS lookup failure.
The failure occurred at 2021-09-11 08:50:28.
The last success occurred at 2021-09-11 07:50:15.
1 failures have occurred since the last success.
The guid-based DNS name 6b1b8529-7380-49da-b4c2-8044e7ebbe2a._msdcs.Otojuste.local
is not registered on one or more DNS servers.
......................... DC failed test Replications
Starting test: RidManager
......................... DC passed test RidManager
Starting test: Services
......................... DC passed test Services
Starting test: SystemLog
An error event occurred. EventID: 0x00002720
Time Generated: 09/11/2021 08:32:13
Event String:
The application-specific permission settings do not grant Local Activation permission for the COM Server app
lication with CLSID
A warning event occurred. EventID: 0x00001695
Time Generated: 09/11/2021 08:32:52
Event String:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'Otojuste.local.' fai
led. These records are used by other computers to locate this server as a domain controller (if the specified domain is
an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).
A warning event occurred. EventID: 0x00001695
Time Generated: 09/11/2021 08:32:52
Event String:
Dynamic registration or deletion of one or more DNS records associated with DNS domain 'ForestDnsZones.Otoju
ste.local.' failed. These records are used by other computers to locate this server as a domain controller (if the spec
ified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

     A warning event occurred.  EventID: 0x00001695
        Time Generated: 09/11/2021   08:32:52
        Event String:
        Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.Otoju

ste.local.' failed. These records are used by other computers to locate this server as a domain controller (if the spec
ified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

     An error event occurred.  EventID: 0x40000004
        Time Generated: 09/11/2021   08:32:58
        Event String:
        The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc$. The target name used was OTOJU

STE\SERVER1$. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur
when the target server principal name (SPN) is registered on an account other than the account the target service is usi
ng. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the t
arget service account password is different than what is configured on the Kerberos Key Distribution Center for that tar
get service. Ensure that the service on the server and the KDC are both configured to use the same password. If the serv
er name is not fully qualified, and the target domain (OTOJUSTE.LOCAL) is different from the client domain (OTOJUSTE.LOC
AL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to ident
ify the server.
An error event occurred. EventID: 0x40000004
Time Generated: 09/11/2021 08:33:07
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc$. The target name used was E3514
235-4B06-11D1-AB04-00C04FC2DCD2/6b1b8529-7380-49da-b4c2-8044e7ebbe2a/Otojuste.local@Otojuste.local. This indicates that
the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal n
ame (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is
only registered on the account used by the server. This error can also happen if the target service account password is
different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the servi
ce on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, an
d the target domain (OTOJUSTE.LOCAL) is different from the client domain (OTOJUSTE.LOCAL), check if there are identicall
y named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x40000004
Time Generated: 09/11/2021 08:34:35
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc$. The target name used was LDAP/
6b1b8529-7380-49da-b4c2-8044e7ebbe2a._msdcs.Otojuste.local. This indicates that the target server failed to decrypt the
ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account ot
her than the account the target service is using. Ensure that the target SPN is only registered on the account used by t
he server. This error can also happen if the target service account password is different than what is configured on the
Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both co
nfigured to use the same password. If the server name is not fully qualified, and the target domain (OTOJUSTE.LOCAL) is
different from the client domain (OTOJUSTE.LOCAL), check if there are identically named server accounts in these two dom
ains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x0000272C
Time Generated: 09/11/2021 09:13:23
Event String:
DCOM was unable to communicate with the computer 1.1.1.1 using any of the configured protocols; requested by
PID 11b4 (C:\Windows\system32\dcdiag.exe).
An error event occurred. EventID: 0x0000272C
Time Generated: 09/11/2021 09:13:44
Event String:
DCOM was unable to communicate with the computer 8.8.8.8 using any of the configured protocols; requested by
PID 11b4 (C:\Windows\system32\dcdiag.exe).
An error event occurred. EventID: 0x40000004
Time Generated: 09/11/2021 09:34:41
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc$. The target name used was LDAP/
6b1b8529-7380-49da-b4c2-8044e7ebbe2a._msdcs.Otojuste.local. This indicates that the target server failed to decrypt the
ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account ot
her than the account the target service is using. Ensure that the target SPN is only registered on the account used by t
he server. This error can also happen if the target service account password is different than what is configured on the
Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both co
nfigured to use the same password. If the server name is not fully qualified, and the target domain (OTOJUSTE.LOCAL) is
different from the client domain (OTOJUSTE.LOCAL), check if there are identically named server accounts in these two dom
ains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x000003EE
Time Generated: 09/11/2021 00:01:37
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a d
omain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
......................... DC failed test SystemLog
Starting test: VerifyReferences
......................... DC passed test VerifyReferences

Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation

Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation

Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation

Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation

Running partition tests on : Otojuste
Starting test: CheckSDRefDom
......................... Otojuste passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Otojuste passed test CrossRefValidation

Running enterprise tests on : Otojuste.local
Starting test: LocatorCheck
......................... Otojuste.local passed test LocatorCheck
Starting test: Intersite
......................... Otojuste.local passed test Intersite
PS C:\Users\Administrator.OTOJUSTE>

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,368 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,822 questions
0 comments No comments
{count} votes

Accepted answer
  1. tarek H 181 Reputation points
    2021-09-15T13:56:03.46+00:00

    we can close this thread , i did a metadata cleanup and errors stopped


5 additional answers

Sort by: Most helpful
  1. Dave Patrick 426K Reputation points MVP
    2021-09-11T13:08:14.413+00:00

    Please run;

    Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
    repadmin /showrepl >C:\repl.txt
    ipconfig /all > C:\dc1.txt
    ipconfig /all > C:\dc2.txt
    ipconfig /all > C:\dc3.txt

    then put unzipped text files up on OneDrive and share a link.


  2. tarek H 181 Reputation points
    2021-09-13T11:56:49.88+00:00

    i am not getting a lot of dns error and my dns is missing all the folders in the msdcs zone

    Microsoft Windows [Version 10.0.14393]
    (c) 2016 Microsoft Corporation. All rights reserved.

    C:\Users\Administrator.OTOJUSTE>dcdiga /fix
    'dcdiga' is not recognized as an internal or external command,
    operable program or batch file.

    C:\Users\Administrator.OTOJUSTE>dcdiag /fix

    Directory Server Diagnosis

    Performing initial setup:
    Trying to find home server...
    Home Server = DC
    * Identified AD Forest.
    Done gathering initial info.

    Doing initial required tests

    Testing server: Default-First-Site-Name\DC
    Starting test: Connectivity
    ......................... DC passed test Connectivity

    Doing primary tests

    Testing server: Default-First-Site-Name\DC
    Starting test: Advertising
    ......................... DC passed test Advertising
    Starting test: FrsEvent
    ......................... DC passed test FrsEvent
    Starting test: DFSREvent
    There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.
    ......................... DC failed test DFSREvent
    Starting test: SysVolCheck
    ......................... DC passed test SysVolCheck
    Starting test: KccEvent
    A warning event occurred. EventID: 0x80000829
    Time Generated: 09/13/2021 12:28:27
    Event String: This directory partition has not been backed up since at least the following number of days.
    A warning event occurred. EventID: 0x80000829
    Time Generated: 09/13/2021 12:28:27
    Event String: This directory partition has not been backed up since at least the following number of days.
    A warning event occurred. EventID: 0x80000829
    Time Generated: 09/13/2021 12:28:27
    Event String: This directory partition has not been backed up since at least the following number of days.
    A warning event occurred. EventID: 0x80000829
    Time Generated: 09/13/2021 12:28:27
    Event String: This directory partition has not been backed up since at least the following number of days.
    A warning event occurred. EventID: 0x80000829
    Time Generated: 09/13/2021 12:28:27
    Event String: This directory partition has not been backed up since at least the following number of days.
    A warning event occurred. EventID: 0x80000603
    Time Generated: 09/13/2021 12:38:48
    Event String: Active Directory Domain Services could not disable the software-based disk write cache on the following hard disk.
    A warning event occurred. EventID: 0x80000B46
    Time Generated: 09/13/2021 12:38:58
    Event String:
    The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a clear text (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.
    A warning event occurred. EventID: 0x80000BE1
    Time Generated: 09/13/2021 12:38:58
    Event String:
    The security of this directory server can be significantly enhanced by configuring the server to enforce validation of Channel Binding Tokens received in LDAP bind requests sent over LDAPS connections. Even if no clients are issuing LDAP bind requests over LDAPS, configuring the server to validate Channel Binding Tokens will improve the security of this server.
    ......................... DC passed test KccEvent
    Starting test: KnowsOfRoleHolders
    ......................... DC passed test KnowsOfRoleHolders
    Starting test: MachineAccount
    ......................... DC passed test MachineAccount
    Starting test: NCSecDesc
    ......................... DC passed test NCSecDesc
    Starting test: NetLogons
    ......................... DC passed test NetLogons
    Starting test: ObjectsReplicated
    ......................... DC passed test ObjectsReplicated
    Starting test: Replications
    ......................... DC passed test Replications
    Starting test: RidManager
    ......................... DC passed test RidManager
    Starting test: Services
    ......................... DC passed test Services
    Starting test: SystemLog
    An error event occurred. EventID: 0x0000165B
    Time Generated: 09/13/2021 11:52:03
    Event String: The session setup from computer 'CALCULE11' failed because the security database does not contain a trust account 'CALCULE11$' referenced by the specified computer.
    An error event occurred. EventID: 0x0000272C
    Time Generated: 09/13/2021 11:53:02
    Event String: DCOM was unable to communicate with the computer 1.1.1.1 using any of the configured protocols; requested by PID 1698 (C:\Windows\system32\dcdiag.exe).
    An error event occurred. EventID: 0x0000272C
    Time Generated: 09/13/2021 11:53:23
    Event String: DCOM was unable to communicate with the computer 8.8.8.8 using any of the configured protocols; requested by PID 1698 (C:\Windows\system32\dcdiag.exe).
    An error event occurred. EventID: 0x000016AD
    Time Generated: 09/13/2021 11:56:30
    Event String: The session setup from the computer CALCULE11 failed to authenticate. The following error occurred:
    A warning event occurred. EventID: 0x00001695
    Time Generated: 09/13/2021 12:19:28
    Event String:
    Dynamic registration or deletion of one or more DNS records associated with DNS domain 'Otojuste.local.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).
    A warning event occurred. EventID: 0x00001695
    Time Generated: 09/13/2021 12:19:29
    Event String:
    Dynamic registration or deletion of one or more DNS records associated with DNS domain 'ForestDnsZones.Otojuste.local.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).
    A warning event occurred. EventID: 0x00001695
    Time Generated: 09/13/2021 12:19:29
    Event String:
    Dynamic registration or deletion of one or more DNS records associated with DNS domain 'DomainDnsZones.Otojuste.local.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).
    An error event occurred. EventID: 0x00002720
    Time Generated: 09/13/2021 12:37:58
    Event String: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    A warning event occurred. EventID: 0x000727A5
    Time Generated: 09/13/2021 12:38:39
    Event String: The WinRM service is not listening for WS-Management requests.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 09/13/2021 12:38:48
    Event String: The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 09/13/2021 12:38:48
    Event String: The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.
    A warning event occurred. EventID: 0x80040020
    Time Generated: 09/13/2021 12:38:48
    Event String: The driver detected that the device \Device\Harddisk0\DR0 has its write cache enabled. Data corruption may occur.
    A warning event occurred. EventID: 0x000003F6
    Time Generated: 09/13/2021 12:38:50
    Event String: Name resolution for the name wpad timed out after none of the configured DNS servers responded.
    A warning event occurred. EventID: 0x000003F6
    Time Generated: 09/13/2021 12:38:50
    Event String: Name resolution for the name wpad timed out after none of the configured DNS servers responded.
    A warning event occurred. EventID: 0x000727AA
    Time Generated: 09/13/2021 12:39:05
    Event String: The WinRM service failed to create the following SPNs: WSMAN/DC.Otojuste.local; WSMAN/DC.
    A warning event occurred. EventID: 0x00000086
    Time Generated: 09/13/2021 12:39:21
    Event String:
    NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on '0.ro.pool.ntp.org'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
    A warning event occurred. EventID: 0x00000086
    Time Generated: 09/13/2021 12:39:21
    Event String:
    NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on '1.ro.pool.ntp.org'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
    A warning event occurred. EventID: 0x00001796
    Time Generated: 09/13/2021 12:40:08
    Event String:
    Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
    ......................... DC failed test SystemLog
    Starting test: VerifyReferences
    ......................... DC passed test VerifyReferences

    Running partition tests on : DomainDnsZones
    Starting test: CheckSDRefDom
    ......................... DomainDnsZones passed test CheckSDRefDom
    Starting test: CrossRefValidation
    ......................... DomainDnsZones passed test CrossRefValidation

    Running partition tests on : ForestDnsZones
    Starting test: CheckSDRefDom
    ......................... ForestDnsZones passed test CheckSDRefDom
    Starting test: CrossRefValidation
    ......................... ForestDnsZones passed test CrossRefValidation

    Running partition tests on : Schema
    Starting test: CheckSDRefDom
    ......................... Schema passed test CheckSDRefDom
    Starting test: CrossRefValidation
    ......................... Schema passed test CrossRefValidation

    Running partition tests on : Configuration
    Starting test: CheckSDRefDom
    ......................... Configuration passed test CheckSDRefDom
    Starting test: CrossRefValidation
    ......................... Configuration passed test CrossRefValidation

    Running partition tests on : Otojuste
    Starting test: CheckSDRefDom
    ......................... Otojuste passed test CheckSDRefDom
    Starting test: CrossRefValidation
    ......................... Otojuste passed test CrossRefValidation

    Running enterprise tests on : Otojuste.local
    Starting test: LocatorCheck
    ......................... Otojuste.local passed test LocatorCheck
    Starting test: Intersite
    ......................... Otojuste.local passed test Intersite

    C:\Users\Administrator.OTOJUSTE>DCDiag /test:DNS

    Directory Server Diagnosis

    Performing initial setup:
    Trying to find home server...
    Home Server = DC
    * Identified AD Forest.
    Done gathering initial info.

    Doing initial required tests

    Testing server: Default-First-Site-Name\DC
    Starting test: Connectivity
    ......................... DC passed test Connectivity

    Doing primary tests

    Testing server: Default-First-Site-Name\DC

      Starting test: DNS
    
         DNS Tests are running and not hung. Please wait a few minutes...
         ......................... DC passed test DNS
    

    Running partition tests on : DomainDnsZones

    Running partition tests on : ForestDnsZones

    Running partition tests on : Schema

    Running partition tests on : Configuration

    Running partition tests on : Otojuste

    Running enterprise tests on : Otojuste.local
    Starting test: DNS
    ......................... Otojuste.local passed test DNS

    C:\Users\Administrator.OTOJUSTE>


  3. tarek H 181 Reputation points
    2021-09-13T15:17:26.407+00:00

    this is the link , but please now my dns is screwed .. i need someone to show me his 2016 AD integrated dns so i can copy everything
    https://1drv.ms/u/s!AtBxD5JGrj1RgZwY1UVfzThU9fEFTg?e=RHfZcA


  4. Limitless Technology 39,336 Reputation points
    2021-09-13T15:36:11.823+00:00

    Hello @tarek H

    I would like to suggest you to check below Troubleshooting steps.

    1. Please change preferred DNS ip to one of DC closest to this DC.
    2. Please check Date\Time are Synced.
    3. Please check ip subnet and site settings from Active Directory sites and Services mmc.
    4. Please check Firewall ports are opened and Disable Antivirus for temporary
    5. Please download Active Directory Replication Status Tool to see any replication related errors and from which DC its failing.

    https://www.microsoft.com/en-in/download/details.aspx?id=30005

    If the reply was helpful, please don’t forget to upvote or accept as answer.

    0 comments No comments