samedi 14 septembre 2013

[Windows Server 2012] Issues with Active Directory in a Lab environment - Part 4


Active Directory is a great feature in Windows Server. However, imagine that you stop your lab environment for several days, weeks and perhaps months. You will certainly encounter some troubles when you'll try to turn on again your DCs.
In that series, I will share my own experience and show how to solve that troubles.

1. The DNS is waiting for Active Directory - KB 2001093
2. DFSR JET database is not shut down cleanly
3. This server has been disconnected from other partners for 60 days
4. The DFS Replication service failed to register the WMI providers


4. The DFS Replication service failed to register the WMI providers


Symptoms
You note that replication of the SYSVOL folder between your DCs doesn't work: For example, if you add manually a file in that folder, that file is not replicated on the other DC. That problem can also create some troubles on computers if they can't download the right version of their GPO.
Of course, all DCs are online and can be joined normally.

In Event logs,you find the following Event:

Event ID:      6104
Log Name:      DFS Replication
Source:        DFSR
Level:         Error
The DFS Replication service failed to register the WMI providers. Replication is disabled until the problem is resolved.






Resolution

Unfortunately, I have not found any KB about that trouble on Microsoft web site. With several blogs and forums, I found command lines that solve my problem :

CD %windir%\system32\wbem
mofcomp dfsrprov.mof
mofcomp dfsrprov.mfl
wmiprvse /regserver
net stop dfsr
net start dfsr



I hope that feedback will be helpful if you encounter the same issue.



See you soon
Julien

vendredi 16 août 2013

[Windows Server 2012] Issues with Active Directory in a Lab environment - Part 3


Active Directory is a great feature in Windows Server. However, imagine that you stop your lab environment for several days, weeks and perhaps months. You will certainly encounter some troubles when you'll try to turn on again your DCs.
In that series, I will share my own experience and show how to solve that troubles.

1. The DNS is waiting for Active Directory - KB 2001093
2. DFSR JET database is not shut down cleanly
3. This server has been disconnected from other partners for 60 days
4. The DFS Replication service failed to register the WMI providers


3. This server has been disconnected from other partners for 60 days


Symptoms
You note that replication of the SYSVOL folder between your DCs doesn't work: For example, if you add manually a file in that folder, that file is not replicated on the other DC. That problem can also create some troubles on computers if they can't download the right version of their GPO.
Of course, all DCs are online and can be joined normally.

In Event logs,you find the Event ID 4012 with the following description:
The DFS Replication service stopped replication on the folder with the following local path: C:\Windows\SYSVOL\domain. This server has been disconnected from other partners for 60 days, which is longer than the time allowed by the MaxOfflineTimeInDays parameter (60). DFS Replication considers the data in this folder to be stale, and this server will not replicate the folder until this error is corrected.
Error: 9061 (The replicated folder has been offline for too long.)
Replicated Folder Name: SYSVOL Share



Cause and Resolution

In the rest of the description you get the following resolution proposal:
To resume replication of this folder, use the DFS Management snap-in to remove this server from the replication group, and then add it back to the group. This causes the server to perform an initial synchronization task, which replaces the stale data with fresh data from other members of the replication group.

However, even if you add the DFS Management snap-in on your DCs (not installed by default), you can't accomplish the actions. Indeed, the SYSVOL replication group settings are protected and provided in read-only mode.


To solve that issue, you need to perform an authoritative synchronization of DFSR-replicated SYSVOL:

For each DC:
 - In ADSIEDIT console, open the CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> object


 - Modify the following attribute:
   msDFSR-Enabled=FALSE
 

 - For the domain controller you want to make authoritative (preferably the PDC Emulator, which is usually the most up to date for SYSVOL contents) ONLY, modify also the following attribute:
   msDFSR-options=1



  - Force Active Directory replication throughout the domain and validate its success on all DCs (open ADSIEDIT and check attributes values)

 - Restart the DFSR service of the DC set as authoritative.
You will see Event ID 4114 in the DFSR event log indicating SYSVOL is no longer being replicated


 - Open the CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> object of the DC you set as authoritative
 - Modify the following attribute:
   msDFSR-Enabled=TRUE


 - Force Active Directory replication throughout the domain and validate its success on all DCs

 - On the DC you set as authoritative, type the command line DFSRDIAG POLLAD


Note: Microsoft indicates that on Windows Server 2008 R2 you will see Event ID 4602 in the DFSR event log indicating SYSVOL has been initialized. On a Windows Server 2012, I never saw Event ID 4602 but Event ID 46014:
The DFS Replication service initialized SYSVOL at local path C:\Windows\SYSVOL\domain and is waiting to perform initial replication...


Perform the previous commands on all the other DCs:
 - Restart the DFSR service. You will see Event ID 4114 in the DFSR event log.
 - Open the CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=<the server name>,OU=Domain Controllers,DC=<domain> object
 - Modify the following attribute:
   msDFSR-Enabled=TRUE
 - Type the command line DFSRDIAG POLLAD



To monitor the replication queue, you can use the following command line:
Dfsrdiag backlog /sendingMember:DC2012 /RGName:"Domain System Volume" /RFName:"SYSVOL Share"



To ensure SYSVOL replication works correctly, just create a file in the SYSVOL folder and ensure that file is replicated on all the other DCs.



See you soon
Julien

mercredi 14 août 2013

[Windows Server 2012] Issues with Active Directory in a Lab environment - Part 2


Active Directory is a great feature in Windows Server. However, imagine you lose or crash your DC's during tests...
In that series, I will share my own experience and show how to solve that troubles.

1. The DNS is waiting for Active Directory - KB 2001093
2. DFSR JET database is not shut down cleanly
3. This server has been disconnected from other partners for 60 days
4. The DFS Replication service failed to register the WMI providers


2. DFSR JET database is not shut down cleanly


Symptoms

You note that replications between your DCs don't work: For example, when you create an account on one DC, the account doesn't appear on the other DCs. All DCs are online and can be joined normally.

In Event logs,you find the Event ID 2213 with the following description:
The DFS Replication service stopped replication on volume C:. This occurs when a DFSR JET database is not shut down cleanly and Auto Recovery is disabled. To resolve this issue, back up the files in the affected replicated folders, and then use the ResumeReplication WMI method to resume replication.
Recovery Steps
1. Back up the files in all replicated folders on the volume. Failure to do so may result in data loss due to unexpected conflict resolution during the recovery of the replicated folders.
2. To resume the replication for this volume, use the WMI method ResumeReplication of the DfsrVolumeConfig class. For example, from an elevated command prompt, type the following command:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" call ResumeReplication




Cause and Resolution

By design on Windows Server 2012, after an unexpected shutdown, the DFS Replication service no longer automatically recovers databases. This behavior enables you to back up the replicated files before you start the recovery process.

To start replication again, execute the command line provided in the Event description:
wmic /namespace:\\root\microsoftdfs path dfsrVolumeConfig where volumeGuid="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" call ResumeReplication



To prevent that behavior in a lab environment, you may want to automatically recover databases. You can set the HKLM\System\CurrentControlSet\Services\DFSR\Parameters\StopReplicationOnAutoRecovery registry value to 0.



To get more information, read the KB 2663685 Changes that are not replicated to a downstream server are lost on the upstream server after an automatic recovery process occurs in a DFS Replication environment in Windows Server 2008 R2.



See you soon
Julien