+1 From: Eldridge, Dave [mailto:[email protected]] Sent: Thursday, March 26, 2009 6:21 AM To: NT System Admin Issues Subject: RE: Replication Issue - Cross Posting
I hear you. Sometimes the users come first if they are being impacted. Wondering after you dcpromo it down that it sits for awhile to see if it reappears but only as a member server. From: Sherry Abercrombie [mailto:[email protected]] Sent: Thursday, March 26, 2009 7:16 AM To: NT System Admin Issues Subject: Re: Replication Issue - Cross Posting Yeah Dave, unfortunately it will be unless I can come up with something solid and viable to look at. That's why I posted to these lists, it's a last ditch effort to find something to look at before it gets rebuilt. I'm usually able to find answers & resolutions for pesky things like this that my co-workers would have already given up on & rebuilt the server. A couple of months ago a domain controller (not this one in question now) started getting the BSOD, it would reboot from a BSOD and do it again. It got rebuilt immediately., a few weeks later a clustered file & print server started doing the same thing, same stop codes etc, by the time everyone else had arrived for the day I had found a MS KB article with a registry hack to fix it. It did fix it and the server didn't have to be rebuilt. I believe that fixing an issue by rebuilding the server isn't really the best way to proceed because the root issue wasn't found and fixed, and it could come up again. The reason this is going to get rebuilt is that the impact to the users is Outlook being down, which leads to the opinion that we have a flakey Exchange server, which of course is just as stable as it can be, as long as active directory is functioning the way it's supposed to. On Thu, Mar 26, 2009 at 7:55 AM, Eldridge, Dave <[email protected]<mailto:[email protected]>> wrote: Sherry you're not going to decommish this before you find out what's causing this? You have my curiosity. dave From: Sherry Abercrombie [mailto:[email protected]<mailto:[email protected]>] Sent: Thursday, March 26, 2009 6:45 AM To: NT System Admin Issues Subject: Re: Replication Issue - Cross Posting Yes, on 3/21....this started happening on 2/25...... On Thu, Mar 26, 2009 at 7:35 AM, Kennedy, Jim <[email protected]<mailto:[email protected]>> wrote: Did you apply the 3/10 DNS 'fix' for the vulnerability. I am seeing odd DNS stuff since then. Most annoying to do a netstat -a and have to weed through 2500 open dns connections. Maybe a clue....... From: Sherry Abercrombie [mailto:[email protected]<mailto:[email protected]>] Sent: Thursday, March 26, 2009 8:29 AM To: NT System Admin Issues Subject: Re: Replication Issue - Cross Posting On the domain controller that we are having the issue with, I do see errors of DNS time outs in the event log during that time-frame. On Wed, Mar 25, 2009 at 3:28 PM, John Cook <[email protected]<mailto:[email protected]>> wrote: Anything going on with DNS replication when this happens? John W. Cook Systems Administrator Partnership For Strong Families 315 SE 2nd Ave Gainesville, Fl 32601 Office (352) 393-2741 x320 Cell (352) 215-6944 Fax (352) 393-2746 MCSE, MCTS, MCP+I,CompTIA A+, N+ From: Sherry Abercrombie [mailto:[email protected]<mailto:[email protected]>] Sent: Wednesday, March 25, 2009 4:19 PM To: NT System Admin Issues Subject: Replication Issue - Cross Posting I have an interesting issue that has been happening for almost 6 weeks now. Every Wed. at approximately 1:40-1:45 PM, one of our domain controllers basically becomes totally unresponsive, causing the other two DC's to become effectively useless, AND causes the Exchange server to become unresponsive to clients. (Outlook 2003) . The only clue that I have from the event logs is from the Directory Service log, Event ID: 1232 Source: NTDS Replication Category: DS RPC Client Type: Warning Description: Active Directory attempted to perform a remote procedure call (RPC) to the following server. The call timed out and was cancelled. Server: f9f58f44-e7e7-4ea5-92fe-aa38ff4cb646._msdcs.domain.com<http://msdcs.domain.com> The server guid referenced here is one of the other domain controllers, that at this point in time, is scheduled to be rebuilt. (FSMO roles have been moved, etc etc) The Exchange server event log just shows that it cannot contact any global catalog server and lists the 3 dc's that we have which are all global catalog servers. During the duration of this "outage" this specific dc cannot be accessed either remote desktop, or direct on the console, but the other dc's are accessible as well as the Exchange server, albeit very slow response. I have Googled,looked at EventID.net and Microsoft on this, and have come up with very little. Did find a MS KB article that recommended making a registry change on the DC's to make the RPC call timeout at least 45 minutes, this was done last week, and the DC's were rebooted over the weekend to apply this registry change, but, today it happened again, so that didn't work. Found some other MS KB articles that were not applicable but did reference that event. Windows 2003 server, SP2. My question is, what the heck is replicating once a week that could be causing RPC to time out like this and basically bring the domain to a halt for 10 - 15 minutes? As I stated, this DC is going to be rebuilt, it just annoys me that I cannot find the reason for it, and a solution other than the rebuild. TIA, -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke ________________________________ CONFIDENTIALITY STATEMENT: The information transmitted, or contained or attached to or with this Notice is intended only for the person or entity to which it is addressed and may contain Protected Health Information (PHI), confidential and/or privileged material. Any review, transmission, dissemination, or other use of, and taking any action in reliance upon this information by persons or entities other than the intended recipient without the express written consent of the sender are prohibited. This information may be protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other Federal and Florida laws. Improper or unauthorized use or disclosure of this information could result in civil and/or criminal penalties. Consider the environment. Please don't print this e-mail unless you really need to. -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke Sent from: Haslet TX United States. -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke Sent from: Haslet TX United States. This e-mail contains the thoughts and opinions of the sender and does not represent official Parkview Medical Center policy. This communication is intended only for the recipient(s) named above, may be confidential and/or legally privileged: and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please return to sender and delete the message from your computer system. -- Sherry Abercrombie "Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke Sent from: Haslet TX United States. This e-mail contains the thoughts and opinions of the sender and does not represent official Parkview Medical Center policy. This communication is intended only for the recipient(s) named above, may be confidential and/or legally privileged: and, must be treated as such in accordance with state and federal laws. If you are not the intended recipient, you are hereby notified that any use of this communication, or any of its contents, is prohibited. If you have received this communication in error, please return to sender and delete the message from your computer system. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
