Проблема с домен контроллерами, незнаю что делать

[larry]

Недавно пришёл работать на контору как сисадмин.
Cистемы Windows Server 2003.
На оффисе стоит два контроллера, один должен быть основной srv-1, другой резвервный srv-2. Когда выключен srv-2, начинаются проблемы, например, я немогу залогинится на srv-1 по rdp, пишет что нет доступа. При обоих включенных машинах, на srv-1 создаю нового доменного пользователя, пытаюсь сделать так, чтобы от него запускался какой-нить сервис на srv-1, когда ввожу его имя, пароль и нажимаю ok, выскакивает ошибка, что такой пользователь несуществует, хотя при указании имени пользователя я пользовался обзором пользователей в AD, там был такой и я его смог выбрать.
На сегодняшний день дошло до того, что я немогу зайти по rdp на srv-1 при включенном srv-2, пишет что нет доступа, хотя спокойно могу лазить по скрытым и открытым шарам на srv-1.

"dcdiag /fix" выдаёт

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\srv-2
Starting test: Connectivity
......................... srv-2 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\srv-2
Starting test: Replications
[Replications Check,srv-2] A recent replication attempt failed:
From srv-1 to srv-2
Naming Context: DC=mydomen,DC=by
The replication generated an error (8456):
Win32 Error 8456
The failure occurred at 2007-06-18 15:53.35.
The last success occurred at 2007-03-16 19:32.22.
5269 failures have occurred since the last success.
Replication has been explicitly disabled through the server options.
REPLICATION LATENCY WARNING
ERROR: Expected notification link is missing.
Source srv-1
Replication of new changes along this path will be delayed.
This problem should self-correct on the next periodic sync.
[Replications Check,srv-2] A recent replication attempt failed:
From srv-1 to srv-2
Naming Context: CN=Configuration,DC=mydomen,DC=by
The replication generated an error (8456):
Win32 Error 8456
The failure occurred at 2007-06-18 15:53.35.
The last success occurred at 2007-03-16 18:52.14.
5168 failures have occurred since the last success.
Replication has been explicitly disabled through the server options.
[Replications Check,srv-2] A recent replication attempt failed:
From srv-1 to srv-2
Naming Context: CN=Schema,CN=Configuration,DC=mydomen,DC=by
The replication generated an error (8456):
Win32 Error 8456
The failure occurred at 2007-06-18 15:53.35.
The last success occurred at 2007-03-16 18:52.10.
2221 failures have occurred since the last success.
Replication has been explicitly disabled through the server options.
[Replications Check,srv-2] A recent replication attempt failed:
From srv-1 to srv-2
Naming Context: DC=DomainDnsZones,DC=mydomen,DC=by
The replication generated an error (8456):
Win32 Error 8456
The failure occurred at 2007-06-18 15:53.35.
The last success occurred at 2007-03-16 18:52.10.
2221 failures have occurred since the last success.
Replication has been explicitly disabled through the server options.
[Replications Check,srv-2] A recent replication attempt failed:
From srv-1 to srv-2
Naming Context: DC=ForestDnsZones,DC=mydomen,DC=by
The replication generated an error (8456):
Win32 Error 8456
The failure occurred at 2007-06-18 15:53.35.
The last success occurred at 2007-03-16 18:52.10.
2224 failures have occurred since the last success.
Replication has been explicitly disabled through the server options.
......................... srv-2 passed test Replications
Starting test: NCSecDesc
......................... srv-2 passed test NCSecDesc
Starting test: NetLogons
......................... srv-2 passed test NetLogons
Starting test: Advertising
......................... srv-2 passed test Advertising
Starting test: KnowsOfRoleHolders
......................... srv-2 passed test KnowsOfRoleHolders
Starting test: RidManager
......................... srv-2 passed test RidManager
Starting test: MachineAccount
......................... srv-2 passed test MachineAccount
Starting test: Services
RPCLOCATOR Service is stopped on [srv-2]
TrkWks Service is stopped on [srv-2]
TrkSvr Service is stopped on [srv-2]
......................... srv-2 failed test Services
Starting test: ObjectsReplicated
......................... srv-2 passed test ObjectsReplicated
Starting test: frssysvol
There are errors after the SYSVOL has been shared.
The SYSVOL can prevent the AD from starting.
......................... srv-2 passed test frssysvol
Starting test: kccevent
......................... srv-2 passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 06/18/2007 16:38:39
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 06/18/2007 16:38:40
(Event String could not be retrieved)
......................... srv-2 failed test systemlog

Running enterprise tests on : mydomen.by
Starting test: Intersite
......................... mydomen.by passed test Intersite
Starting test: FsmoCheck
......................... mydomen.by passed test FsmoCheck

1. С чем это может быть связано ?
2. Какие возможны решения данной проблемы ?

[monkkey]

Зачем выключается второй домен-контроллер? Проверьте роли, которые держат Ваши srv-1 и srv-2. Похоже, srv-2 у вас является эмулятором PDC. Приведите ipconfig /all c обоих. У Вас не работает репликация. Смотрите журнал событий. Правильно ли настроен DNS?

[larry]

на оффисе бывает скачет свет, на бесперебойник денег жалеют.
ipconfig srv-2
Windows IP Configuration



Host Name . . . . . . . . . . . . : srv-2

Primary Dns Suffix . . . . . . . : mydomen.by

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No

DNS Suffix Search List. . . . . . : mydomen.by



Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet NIC

Physical Address. . . . . . . . . : бла бла

DHCP Enabled. . . . . . . . . . . : No

IP Address. . . . . . . . . . . . : 192.168.1.2

Subnet Mask . . . . . . . . . . . : 255.255.255.224

DNS Servers . . . . . . . . . . . : 127.0.0.1

192.168.1.1

ipconfig srv-1 немогу привести, так как немогу залезть на него по rdp, возможно есть другой способ, но я его просто незнаю.

я думаю чт онеработает репликация, так как сыпятся ошибки:

Windows cannot search for Organizational Unit hierarchy. (52). Group Policy processing aborted.
Logon rejected for mydomen\larry. Unable to obtain Terminal Server User Configuration. Error: Access is denied.
Windows cannot determine the user or computer name. (The target principal name is incorrect. ). Group Policy processing aborted.
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Windows cannot bind to mydomen.by domain. (Local Error). Group Policy processing aborted.
This is the replication status for the following directory partition on the local domain controller.

Directory partition:
CN=Schema,CN=Configuration,DC=mydomen,DC=by

The local domain controller has not recently received replication information from a number of domain controllers. The count of domain controllers is shown, divided into the following intervals.

More than 24 hours:
1
More than a week:
1
More than one month:
1
More than two months:
1
More than a tombstone lifetime:
1
Tombstone lifetime (days):
60
Domain controllers that do not replicate in a timely manner may encounter errors. It may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.

To identify the domain controllers by name, install the support tools included on the installation CD and run dcdiag.exe.
You can also use the support tool repadmin.exe to display the replication latencies of the domain controllers in the forest. The command is "repadmin /showvector /latency <partition-dn>".
It has been too long since this machine last replicated with the named source machine. The time between replications with this source has exceeded the tombstone lifetime. Replication has been stopped with this source.
The reason that replication is not allowed to continue is that the two machine's views of deleted objects may now be different. The source machine may still have copies of objects that have been deleted (and garbage collected) on this machine. If they were allowed to replicate, the source machine might return objects which have already been deleted.
Time of last successful replication:
2007-03-12 10:50:28
Invocation ID of source:
0075f980-f970-0075-0100-000000000000
Name of source:
60f70b01-a183-46f4-bd8c-7a5cddaf9c63._msdcs.mydomen.by
Tombstone lifetime (days):
60

The replication operation has failed.

User Action:

Determine which of the two machines was disconnected from the forest and is now out of date. You have three options:

1. Demote or reinstall the machine(s) that were disconnected.
2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent deleted objects and then resume replication.
3. Resume replication. Inconsistent deleted objects may be introduced. You can continue replication by using the following registry key. Once the systems replicate once, it is recommended that you remove the key to reinstate the protection.
Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner


For more information, see Help and Support Center at

я слабо знаком с администрированием server 2003. в основном локальные машинки ковырял.

[Angry Demon]

larry
ipconfig srv-1 немогу привести, так как немогу залезть на него по rdp, возможно есть другой способ, но я его просто незнаю.
Безусловно, есть. Зайти в консоль. Локально. :)

[larry]

зайти локально проблема тоже :)
нет возможности пока что

[GreenIce]

При настройке dns основным должен идти другой контроллер, а вторичным текущий. Иначе может произойти замыкание на себя.

[monkkey]

может произойти замыкание на себя
что Вы имеете в виду?

[GreenIce]

Цитата из книги Зубанова "Active Directory подход профессионалов"

Пусть у контроллера домена изменился IP адрес. Так как первичным сервером DNS для него является он сам, то он внесет соответствующее изменение в запись CNAME в собственный сервер DNS. Любой другой контроллер домена, настроенный аналогично, не сможет реплицировать эти изменения, так как в "его" сервере DNS записан старый адрес контроллера домена, на котором произошло изменение. Таким образом контроллер окажется в изоляции, или на "острове", поскольку ни одно из изменений, вносимых в Active Directory, не будет тиражироваться на другие контроллеры.