Troubleshooting AD Active Directory Replication Error 8456 or 8457: "The source | destination server is currently rejecting replication requests"

-

Symptoms

 This article describes the symptoms, cause, and resolution steps for situations where Active Directory operations fail with error 8456 or 8457: "The source | destination server is currently rejecting replication requests"
  1. The DCPROMO promotion of a new domain controller in an existing forest fails with the error "The source server is currently rejecting replication requests." 
    Dialog title text:  
    Active Directory Installation Wizard 
    Dialog message text: 
    The operation failed because:  Active Directory could not transfer the remaining data in directory partition  to domain controller .  "The source server is currently rejecting replication requests."
  2. DCDIAG reports the error "The source server is currently rejecting replication requests" or "The destination server is currently rejecting replication requests."
    Testing server: Default-First-Site-Name\
          Starting test: Replications         * Replications Check         [Replications Check,] A recent replication attempt failed:            From IADOMINO to
                Naming Context: DC=
                The replication generated an error (8456):            The source server is currently rejecting replication requests.            The failure occurred at             The last success occurred at             957 failures have occurred since the last success.            Replication has been explicitly disabled through the server optionsTesting server: Default-First-Site-Name\
          Starting test: Replications         * Replications Check         [Replications Check,] A recent replication attempt failed:            From IADOMINO to
                Naming Context: DC=
                The replication generated an error (8457):            The destination server is currently rejecting replication requests.            The failure occurred at             The last success occurred at             957 failures have occurred since the last success.            Replication has been explicitly disabled through the server options
  3. REPADMIN indicates that incoming and outgoing Active Directory replication may be failing with the error "The source | destination server is currently rejecting replication."

    DC=Contoso,DC=COM
        \ via RPC
            DC object GUID:
            Last attempt @
  4. Event sources and event IDs that indicate that a USN rollback has occurred include but are not limited to the following.


     
    Event source
    Event ID
    Event string
    NTDS KCC1308The Knowledge Consistency Checker (KCC) has detected that successive attempts to replicate with the following domain controller has consistently failed.
    NTDS KCC
    1925
    The attempt to establish a replication link for the following writable directory partition failed. 
    NTDS KCC
    1926
    The attempt to establish a replication link to a read-only directory partition with the following parameters failed
    NTDS Replication1586
    The Windows NT 4.0 or earlier replication checkpoint with the PDC emulator master was unsuccessful.  
    A full synchronization of the security accounts manager (SAM) database to domain controllers running Windows NT 4.0 and earlier might occur if the PDC emulator master role is transferred to the local domain controller before the next successful checkpoint. 
    The checkpoint process will be tried again in four hours. 
    NTDS Replication2023The local domain controller was unable to replicate changes to the following remote domain controller for the following directory partition.
    Microsoft-Windows-ActiveDirectory_DomainService2095
    During an Active Directory Domain Services replication request, the local domain controller (DC) identified a remote DC which has received replication data from the local DC by using already acknowledged USN tracking numbers.
    Microsoft-Windows-ActiveDirectory_DomainService2103
    The Active Directory Domain Services database was restored by using an unsupported restoration procedure.  
    Active Directory Domain Services will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused.



    Where embedded status codes 8456 and 8457 map to the following. 

     
    Decimal error
    Hexadecimal error
    Error string
    8456
    2108
    The source server is currently rejecting replication
    8457
    2109
    The destination server is currently rejecting replication
     
  5. NTDS General Event 2013 may be logged in the Directory Services event log. This indicates that a USN rollback occurred because of an unsupported rollback or restore of the Active Directory Database.
    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 2103
    Date:
    Time:
  6. NTDS General Event 1393 may be logged in the Directory Services event log. This indicates that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space:
    Event Type: Error
    Event Source: NTDS General
    Event Category: Service Control
    Event ID: 1393
    Date:
    Time:

Cause

Incoming or outgoing replication was automatically disabled by the operating system because of multiple root causes/

Three events that disable inbound or outbound replication include:
A USN rollback occurred (NTDS General Event 2103).
  • The hard disk is full (NTDS General Event 1393). 
  • A corrupt UTD vector is present (Event 2881).

    • The operating system automatically makes four configuration changes when one of three conditions occurs. The four configuration changes are as follows:
    1. Incoming Active Directory replication is disabled.
    2. Outgoing Active Directory replication is disabled.
    3. "DSA not writable" is set to a nonzero value in the registry.
    4. The NETLOGON service status is changed from "running" to "paused."


      The dominant root cause for this error condition is a USN rollback discussed in MSKB 875495

      875495 How to detect and recover from a USN rollback in Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2
      http://support.microsoft.com/default.aspx?scid=kb;EN-US;875495
      Do not assume that any nonzero value for "DSA not writable" or that a source or destination server "is currently rejecting replication requests" during DCPROMO / AD Replication definitively means that a USN rollback has occurred and that such domain controllers implicitly have to be force-demoted or force-repromoted. Demotion may be the correct option. However, it may be excessive when the error is caused by insufficient free disk space.

      Resolution

      1. Check the value for "DSA not writable." 

        For each domain controller that is logging the 8456 or 8457 error, determine whether one of the three triggering events automatically disabled incoming or outgoing Active Directory Replication by reading the value for "DSA not writable" from the local registry.

        When replication is automatically disabled, the operating system writes one of four possible values to "DSA not writable":
         
        Path
        HKLM\System\CurrentControlSet\Services\NTDS\Parameters
        Setting
        DSA not writable 
        Type
         (Reg_dword)
        Values
        #define DSA_WRITABLE_GEN 1
        #define DSA_WRITABLE_NO_SPACE 2
        #define DSA_WRITABLE_USNROLLBCK 4
        #define DSA_WRITABLE_CORRUPT_UTDV 8

        A value of 1 can be written only when the forest version is incompatible with the OS (for example, the W2K DC is promoted into a W2K3 forest functional level forest or the like).

        A value of 2 means that the physical or virtual drive that is hosting the Active Directory database or log files lacks sufficient free disk space.

        A value of 4 means that a USN rollback occurred because the Active Directory database was incorrectly rolled back in time. Operations that are known to cause a USN rollback include the following:

        ·         The booting from previously saved virtual machine snapshots of domain controller role computers on Hyper-V or VMWARE hosts
        ·         Incorrect physical-to-virtual (P2V) conversions in forests that contain more than one domain controller
        ·         Restoring DC role computers by using imaging products such as Ghost
        ·         Rolling the contents of a partition that is hosting the active directory database back in time by using an advanced disk subsystem

        A value of 8 indicates that the up-to-dateness-vector is corrupted on the local DC.
        Technically, "DSA not writable" could consist of multiple values. For example, a registry value of 10 would indicate insufficient disk space anda corrupted UTD. Typically, a single value is written to "DSA not writable."        Note It is common for support professionals and administrators to partly disable the replication quarantine by enabling outgoing replication, by enabling incoming replication, by changing the startup value for the NETLOGON service from disabled to automatic, and by starting the NETLOGON service. Therefore, the full quarantine configuration may not be in place when it is examined.
      2. Check the Directory Service event log for quarantine events.

        Assuming the Directory Service event log has not wrapped, you may find one or more related events logged in the Directory Service event log of a domain controller that is logging the 8456 or 8457 error.
         
        NTDS General 2103
        The Active Directory database was restored by using an unsupported restoration procedure. Active Directory will be unable to log on users while this condition persists. Therefore, the Net Logon service has paused. User Action See previous event logs for more information.
        NTDS General Event 1393
        There is insufficient space on the disk.
        Event 2881
        Not applicable
      3. Perform the recovery based on the value of "DSA not writable" or on events that are logged on the system:
        • If "DSA not writable" equals 4 or if NTDS General Event 2103 is logged, perform the recovery steps for a USN Rollback. For more information, see Microsoft Knowledge Base article 875495.
        • If "DSA not writable" equals 2 or if NTDS General event 1393 is logged, check for sufficient free disk space on the physical and virtual partitions that are hosting the Active Directory database and log files. Free up space as required.
        • If "DSA not writable" equals 8, demote and then repromote the domain controller before it can replicate its bad value to other domain controllers in the forest.

      Comments

      Post a Comment

      Popular posts from this blog

      altiris software key

      -
      Image
      I think a lot of people, like me, spend a lot of time try finding how to get those download: Latest Symantec workspace Virtualization , SWV 6.1, that is advanced SVS version, is integrated with the Altiris client management suite CMS 7.  (Yes, it was also named "SVS PRO") Notice 1: This package includes the "Wise Virtual Composer", and both x86+x64 versions. Notice 2: This link currently also includes SWS (Streaming) and SWC (Corporate) [please vote my post if you use it ;-] Story : I was thinking only SVS 2.1 (Software Virtualization Solution) was integrated into the "Client Management Suite 7". But this is not the case and SWV 6.1 (Symantec Workspace Virtualization) must not be paid in addition . Free home license : Both SVS 2.1 "light" version & SWV are still free personal use. I suggest you use now the latest SWV 6.4 (That is SWV 6.1 SP7 or following! Yes Symantec do this version naming - vote here also to a...
      Read more

      Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe)

      -
      Image
      Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe) Table of Contents SPN Purpose SPN Format SetSPN Viewing or Checking SPN Registrations SPN Registration Errors Related to SPN Registration or Configuration Manually Registering SPNs Troubleshooting SPN Issues Resolving SPN Registration Issues SPN Lookup Errors Delegation External Articles SPN Purpose A service principal name (SPN) is the name by which a Kerberos client uniquely identifies an instance of a service for a given Kerberos target computer. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. ↑  Return to T...
      Read more

      Troubleshooting Netlogon Error Codes

      -
      Image
      Quick Reference: Troubleshooting Netlogon Error Codes ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ January 28, 2013   by  Mark Morowczynski [MSFT]   //   24 Comments 0 0 Hi this is Brandon Wilson and today I will be providing you with a quick reference for troubleshooting Netlogon error codes. I say “quick reference” very loosely here, because this is one of those sticky subjects that can easily expand into many more areas and become a very long discussion. So, I’m going to do my best to focus on just the codes and possible solutions for the error codes that are more common to see. Anyone who has dealt with some of these issues knows that some of these outlined areas can lead to huge revenue loss for a business, or at the very least an annoying authentication prompt J I welcome you to leave comments and questions, or suggestions for articles that you as the reader would be interested in seeing us do on AskPFE Platforms ( http://blogs.tech...
      Read more