Windows Server

Tim Frawley · Guest

I recently migrated our AD DC to a windows 2003 server SP1. I used
ntdsutil to transfer all the roles to the new server (ROBERTS). The
old server WRATHER was shut down to test that the migration was
completed.

I have the following issues:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1097
Date: 9/6/2005
Time: 2:28:35 PM
User: NT AUTHORITY\SYSTEM
Computer: ROBERTS
Description:
Windows cannot find the machine account, The Local Security Authority
cannot be contacted .

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Followed by this error:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 9/6/2005
Time: 2:28:35 PM
User: NT AUTHORITY\SYSTEM
Computer: ROBERTS
Description:
Windows cannot query for the list of Group Policy objects. Check the
event log for possible messages previously logged by the policy engine
that describes the reason for this.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Another warning includes:

Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 12
Date: 9/6/2005
Time: 2:28:10 PM
User: N/A
Computer: ROBERTS
Description:
Time Provider NtpClient: This machine is configured to use the domain
hierarchy to determine its time source, but it is the PDC emulator for
the domain at the root of the forest, so there is no machine above it
in the domain hierarchy to use as a time source. It is recommended
that you either configure a reliable time service in the root domain,
or manually configure the PDC to synchronize with an external time
source. Otherwise, this machine will function as the authoritative
time source in the domain hierarchy. If an external time source is
not configured or used for this computer, you may choose to disable
the NtpClient.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I have tried everythign I can find on this W32Time to fix this issue
and cannot get it to go away.

DCDiag reports:

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\ROBERTS
Starting test: Connectivity
......................... ROBERTS passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\ROBERTS
Starting test: Replications
[Replications Check,ROBERTS] A recent replication attempt
failed:
From WRATHER to ROBERTS
Naming Context:
CN=Schema,CN=Configuration,DC=mtalab,DC=adfg
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2005-09-06 14:28:43.
The last success occurred at 2005-09-06 12:58:50.
2 failures have occurred since the last success.
[WRATHER] DsBindWithSpnEx() failed with error 1722,
The RPC server is unavailable..
The source remains down. Please check the machine.
[Replications Check,ROBERTS] A recent replication attempt
failed:
From WRATHER to ROBERTS
Naming Context: CN=Configuration,DC=mtalab,DC=adfg
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2005-09-06 14:29:04.
The last success occurred at 2005-09-06 14:20:53.
1 failures have occurred since the last success.
The source remains down. Please check the machine.
[Replications Check,ROBERTS] A recent replication attempt
failed:
From WRATHER to ROBERTS
Naming Context: DC=mtalab,DC=adfg
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2005-09-06 14:28:22.
The last success occurred at 2005-09-06 14:17:14.
1 failures have occurred since the last success.
The source remains down. Please check the machine.
......................... ROBERTS passed test Replications
Starting test: NCSecDesc
......................... ROBERTS passed test NCSecDesc
Starting test: NetLogons
......................... ROBERTS passed test NetLogons
Starting test: Advertising
......................... ROBERTS passed test Advertising
Starting test: KnowsOfRoleHolders
......................... ROBERTS passed test
KnowsOfRoleHolders
Starting test: RidManager
......................... ROBERTS passed test RidManager
Starting test: MachineAccount
......................... ROBERTS passed test MachineAccount
Starting test: Services
......................... ROBERTS passed test Services
Starting test: ObjectsReplicated
......................... ROBERTS passed test
ObjectsReplicated
Starting test: frssysvol
......................... ROBERTS passed test frssysvol
Starting test: frsevent
There are warning or error events within the last 24 hours
after the

SYSVOL has been shared. Failing SYSVOL replication problems
may cause

Group Policy problems.
......................... ROBERTS failed test frsevent
Starting test: kccevent
......................... ROBERTS passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000423
Time Generated: 09/06/2005 13:55:54
Event String: The DHCP service failed to see a directory
server

An Error Event occured. EventID: 0x00000423
Time Generated: 09/06/2005 13:55:59
Event String: The DHCP service failed to see a directory
server

......................... ROBERTS failed test systemlog
Starting test: VerifyReferences
......................... ROBERTS passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test
CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test
CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom

Running partition tests on : mtalab
Starting test: CrossRefValidation
......................... mtalab passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... mtalab passed test CheckSDRefDom

Running enterprise tests on : mtalab.adfg
Starting test: Intersite
......................... mtalab.adfg passed test Intersite
Starting test: FsmoCheck
......................... mtalab.adfg passed test FsmoCheck

How do I fully eliminate WRATHER from file replication?

here is the result from the command:

dcdiag /e /test:frssysvol

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\WRATHER
Starting test: Connectivity
Server WRATHER resolved to this IP address 146.63.252.125,
but the address couldn't be reached(pinged), so check the
network.
The error returned was: Error due to lack of resources.
This error more often means that the targeted server is
shutdown or disconnected from the network
......................... WRATHER failed test Connectivity

Testing server: Default-First-Site-Name\JUMBO
Starting test: Connectivity
......................... JUMBO passed test Connectivity

Testing server: Default-First-Site-Name\NUGGET
Starting test: Connectivity
......................... NUGGET passed test Connectivity

Testing server: Default-First-Site-Name\ROBERTS
Starting test: Connectivity
......................... ROBERTS passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\WRATHER

Testing server: Default-First-Site-Name\JUMBO
Starting test: frssysvol
......................... JUMBO passed test frssysvol

Testing server: Default-First-Site-Name\NUGGET
Starting test: frssysvol
......................... NUGGET passed test frssysvol

Testing server: Default-First-Site-Name\ROBERTS
Starting test: frssysvol
......................... ROBERTS passed test frssysvol

Running partition tests on : Schema

Running partition tests on : Configuration

Running partition tests on : mtalab

Running partition tests on : ForestDnsZones

Running partition tests on : DomainDnsZones

Running enterprise tests on : mtalab.adfg

Vincent Xu [MSFT] · Guest

Hi Tim,

I was confused about one thing:

the Ntdsutil isn't designed for migration from old domain to a new domain.
If you are doing such job, I recommend you using ADMT.

About the usage of ADMT, please refer to following article:

How to set up ADMT for Windows NT 4.0 to Windows 2000 migration
http://support.microsoft.com/default.aspx?scid=kb;en-us;260871

Windows 2000 Active Directory Migration Tool
http://www.microsoft.com/technet/prodtechnol/windows2000serv/downloads/w2kad
mt.mspx

If not,below is some information about your log.

For the first log:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1097
Date: 9/6/2005
Time: 2:28:35 PM
User: NT AUTHORITY\SYSTEM
Computer: ROBERTS

There is an article I'd like to provide:

You receive event ID 1097 and event ID 1030 error events when you restart a
Windows Server 2003-based domain controller
http://support.microsoft.com/default.aspx?scid=kb;en-us;832215&sd=ee

For the log:

The replication generated an error (1722):
The RPC server is unavailable.

Please check if HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet has an
empty Internet key. If so, please delete the Internet key and reboot.

839880 How to troubleshoot RPC Endpoint Mapper errors
http://support.microsoft.com/?id=839880

I hope the information is helpful.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Tim Frawley · Guest

Vincent,

I guess I used the wrong word "migration". What I did was setup a
Windows 2003 Server as a member domain controller. I setup DNS, DHCP
and WINS to run from this server called ROBERTS. I then used ntdsutil
to transfer the FSMO roles to ROBERTS as per this article:

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain
controller
http://support.microsoft.com/default.aspx?scid=kb;en-us;255504

I followed the instructions under the section "Transfer FSMO roles"

I also opened Active Directory Sites and Services and made ROBERTS the
Global Catalog server. I transfered the DHCP database to ROBERTS and
authorized it to service clients. Currently everything works from
ROBERTS except that it is still looking for WRATHER for file
replication. In addition to the UserEnv errors I get when I reboot I
am getting the following NtFrs errors occasionally:

Event Type: Warning
Event Source: NtFrs
Event Category: None
Event ID: 13508
Date: 9/6/2005
Time: 2:30:55 PM
User: N/A
Computer: ROBERTS
Description:
The File Replication Service is having trouble enabling replication
from WRATHER to ROBERTS for c:\activedirectory\sysvol\domain using the
DNS name wrather.mtalab.adfg. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name wrather.mtalab.adfg
from this computer.
[2] FRS is not running on wrather.mtalab.adfg.
[3] The topology information in the Active Directory for this replica
has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the
problem is fixed you will see another event log message indicating that
the connection has been established.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: ba 06 00 00 º...

As for the RPC information you gave me in your post, this key exists:

HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc

the "\Inernet" key does not exist.

This information:

You receive event ID 1097 and event ID 1030 error events when you
restart a Windows Server 2003-based domain controller
http://support.microsoft.com/default.aspx?scid=kb;en-us;832215&sd=ee

I have already read this article and read it again from your post. I
followed the instructions contained therein and it did not resolve the
problem. The Net Logon service was already set to Automatic and is
running.

I assume that my "migration" of the FSMO domain controller is
incomplete and at this point I am not sure what to do.

Vincent Xu [MSFT] · Guest

Hi Tim,

This is a quick note to let you know that I am researching your issue and
will get back to you as soon as possible. I appreciate your patience.

In addition, you may send me the full UserEnv log via v-xuwen@microsoft.com

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Vincent Xu [MSFT] · Guest

Hi,

Based on my research, transferring FSMO roles has nothing to do with this
event unless you also want to move the DC. I think I need a description of
everything he actually did related to transferring the FSMO roles (why did
he do it and where did the original FSMO role holder go), etc.

2nd, download File Replication Service Diagnostics Tool from following link:

<http://www.microsoft.com/downloads/details.aspx?FamilyID=43cb658e-8553-4de7
-811a-562563eb5ebf&displaylang=en>

run frsdiag.exe against ROBERTS.

3rd, download MPS report from
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/Mpsrpt_dirsvc.exe

and run it on both ROBERTS and WRATHER and send me the 2 CAB

Thanks for cooperation.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Vincent Xu [MSFT] · Guest

Hi,

Based on my experience, since the roberts is not a DC, you may not
successfully transfered the FSMO roles. So we need to verify which DC holds
these roles.

To determine which domain controller holds the RID master, PDC emulator, or
infrastructure master roles, perform the following steps.
1. Open Active Directory Users and Computers.
2. In the console tree, right-click Active Directory Users and Computers,
and then click Operations Masters.
3. Click the RID, PDC, or Infrastructure tab.
The name of the current operations master appears under Operations master.

To determine which domain controller holds the domain naming master role,
perform the following steps:
1. Open Active Directory Domains and Trusts.
2. Right-click Active Directory Domains and Trusts, and then click
Operations Master.
The name of the current domain naming master appears in the Change
Operations Master dialog box.

1. Register the Active Directory Schema snap-in by running the following
command:
regsvr32.exe %systemroot%\system32\schmmgmt.dll
2. Click OK to close the message that indicates the registration succeeded.
3. Create a custom Microsoft Management Console (MMC) console.
4. Add the Active Directory Schema snap-in to the console.
5. In the console tree, right-click Active Directory Schema, and then click
Operations Master.

If you didn't destoyed the WRATHER, I think you can boot it up and promote
Robert to DC and transfer FSMO again.

If the Wrather is not available, I think there is another DC in your
domain, we can try to Seize these roles.

Please refer to following article about how to seize the roles.
<http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Oper
ations/7db85b1d-3e70-48b9-8fc1-77a13fc35919.mspx>

Hope it helps.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Tim Frawley · Guest

Tim Frawley · Guest

Vincent,

Should I run DCPromo on WRATHER and demote it?

Vincent Xu [MSFT] · Guest

Hi,

For your situation, I think we need to move the data of WRATHER out of DC.
Please refer to following article to perform it:

216498 How to remove data in Active Directory after an unsuccessful domain
http://support.microsoft.com/?id=216498

Hope it helps.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Tim Frawley · Guest

Vincent,

I had not yet demoted WRATHER so this morning I ran DCPromo and demoted
it. Things look really good now, here is the DCDiag log:

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\ROBERTS
Starting test: Connectivity
......................... ROBERTS passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\ROBERTS
Starting test: Replications
......................... ROBERTS passed test Replications
Starting test: NCSecDesc
......................... ROBERTS passed test NCSecDesc
Starting test: NetLogons
......................... ROBERTS passed test NetLogons
Starting test: Advertising
......................... ROBERTS passed test Advertising
Starting test: KnowsOfRoleHolders
......................... ROBERTS passed test
KnowsOfRoleHolders
Starting test: RidManager
......................... ROBERTS passed test RidManager
Starting test: MachineAccount
......................... ROBERTS passed test MachineAccount
Starting test: Services
......................... ROBERTS passed test Services
Starting test: ObjectsReplicated
......................... ROBERTS passed test
ObjectsReplicated
Starting test: frssysvol
......................... ROBERTS passed test frssysvol
Starting test: frsevent
......................... ROBERTS passed test frsevent
Starting test: kccevent
......................... ROBERTS passed test kccevent
Starting test: systemlog
......................... ROBERTS passed test systemlog
Starting test: VerifyReferences
......................... ROBERTS passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test
CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test
CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom

Running partition tests on : mtalab
Starting test: CrossRefValidation
......................... mtalab passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... mtalab passed test CheckSDRefDom

Running enterprise tests on : mtalab.adfg
Starting test: Intersite
......................... mtalab.adfg passed test Intersite
Starting test: FsmoCheck
......................... mtalab.adfg passed test FsmoCheck

It looks like my file replication issues have been resolved. The only
issue I see now is the continuing UserEnv erros when I reboot ROBERTS:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1097
Date: 9/13/2005
Time: 9:01:38 AM
User: NT AUTHORITY\SYSTEM
Computer: ROBERTS
Description:
Windows cannot find the machine account, The Local Security Authority
cannot be contacted .

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Followed by:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 9/13/2005
Time: 9:01:38 AM
User: NT AUTHORITY\SYSTEM
Computer: ROBERTS
Description:
Windows cannot query for the list of Group Policy objects. Check the
event log for possible messages previously logged by the policy engine
that describes the reason for this.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I am continuing to look into this, if you have any additional
suggestions please let me know. Thank you very much for you
assistance!!

Tim

Vincent Xu [MSFT] · Guest

Hi Tim,

Regarding the first event log, please refer to my latest reply. You need to
remove the data of WRATHER out of AD.

216498 How to remove data in Active Directory after an unsuccessful domain
http://support.microsoft.com/?id=216498

Regarding the second event log, did it appear frequently? if not we may
just ignore it. Because it may be a sudden issue.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

AD DC migration from W2k to 2003 Server, event log errors 10

	Windows Server Forum Index -> Migration	All times are GMT
Page 1 of 1