question

BrianCampbell-8512 avatar image
0 Votes"
BrianCampbell-8512 asked ·

Azure AD Domain Services Domain Controller's failing Replications Test

I have up Azure AD DS, have joined some Windows 10 PC's, and created some security groups and GPO's. I am getting investigating an error in the Windows 10 System Event Log (Event 4, Security-Kerberos. The Kerberos client received a KRB_AP_ERR_Modified error from the server [AADDS-DC-SERVER-NAME$]. The target name used was ldap/FQDN-OF-SERVER/DOMAIN.COM@DOMAIN.COM. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (DOMAIN.COM) is different from the client domain (DOMAIN.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.). I thought I'd do a quick test on the AADDS Domain Controllers with DCDIAG, and they are showing that Replications have been failing since yesterday. Results below:

Starting test: Replications
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=ForestDnsZones,DC=domain,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
34 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=DomainDnsZones,DC=domain,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
45 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
31 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Configuration,DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
33 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 11:15:57.
The last success occurred at 2020-01-16 04:54:52.
1777 failures have occurred since the last success.
......................... DC2 failed test Replications

Given that the AADDS DC's are supposed to be locked down, how is this happening?

azure-ad-domain-services
· 1
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

So, I have been investigating further and if I run repadmin /showrepl, one of the DC's show no errors and the other continues to show: "failed, result -2146893022 (0x80090322): The target principal name is incorrect.". I believe that the cause may be "The destination domain controller receives a service ticket from a Kerberos Key Distribution Center (KDC) that has an old version of the password for the source domain controller." as per article https://support.microsoft.com/en-gb/help/2090913/active-directory-replication-error-2146893022-the-target-principal-nam. How can I resolve this if I cannot stop or start a service on the VM's, or even reboot? It appears I can only raise a support ticket on this if I purchase a Support Plan. Any advice appreciated.

0 Votes 0 ·

1 Answer

FrankHuMSFT-3200 avatar image
0 Votes"
FrankHuMSFT-3200 answered ·

It sounds like there's an issue with your networking or your AAD DS is having issues.

If you're still having an issue here, please email AzCommunity[at]microsoft[dot]com and I can enable a one time free support ticket. Please provide your Azure Subscription GUID and a reference to this thread. And hopefully we can get you on the right path again soon. 

Please see : https://blogs.msdn.microsoft.com/mschray/2016/03/18/getting-your-azure-subscription-guid-new-portal/

On how to get a subscription GUID.

In addition to that once you are able to resolve your issue with the support engineer, please post your response on this thread so that future readers will be able to benefit from your solution. 

· 1 ·
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

One time free support ticket given via twitter contact, fault confirmed and rectified by Azure back end support.

0 Votes 0 ·