Apr 13 2022 10:48 PM - edited Apr 13 2022 11:04 PM
Hello everyone,
We are running Windows Server 2016 as a Primary Domain Controller. We don't have DFS management tool installed however I'm getting 6002 errors in event viewer. Please advise on how to investigate further. Object CN could not be found from ADSI edit
Apr 14 2022 12:23 AM - edited Apr 14 2022 12:47 AM
SYSVOL replication is done using DFSRS, not sure if that GUID is part of that. Do you have multiple Domain Controllers or just one? You can always install the DFS Management tools for more investigation
Apr 14 2022 12:45 AM
Apr 14 2022 12:47 AM
Apr 14 2022 03:57 AM
This isn't related to SYSVOL at all but another DFS-R replica that the domain controller once was/possibly still should be a member of.
If it was removed, then it clearly wasn't successfully and cleanly removed, hence the attribute issue flagged as event 6002.
If the domain controller is still meant to be a member of that replica (which ironically is simply named "DFS") then you want to put the distinguishedName of the domain controller computer object (what you're looking at in ADSI Edit: "CN=UZTASSRV01,OU=Domain Controllers,..." etc) into the "msDFSR-ComputerReference" on the object from the Event Viewer error (I'm not typing out GUIDs - it's the "CN=Topology" X.500 path).
If the domain controller is no longer mean to be a member of the replica then you want to remove the object listed in the Event Log error from AD.
Cheers,
Lain
Apr 14 2022 07:13 AM
Actually, I was going a bit too fast before without paying proper attention to detail. Specifically, the GUID from your Event Log error doesn't match anything below your ADSI Edit picture.
As such, the Event Log error isn't related at all to your ADSI Edit picture. This is actually good news though as I'll explain after speaking to the Event Log error.
The reference to UZTASSRV01.sm.local within the Event Viewer error is only saying which domain controller reported the issue, not that the domain controller is part of the issue.
Dealing with the Event Log error:
What we have from the Event Log error is a forward reference to the "msDFSR-Member" (i.e. objectClass = msDFSR-Member) object in AD. This object lives under the "CN=DFSR-GlobalSettings,CN=System" area, and it's this object that is missing a value for the "msDFSR-ComputerReference" attribute (which is what I was talking about before.)
The new part is this: You need to run a search to see if a matching "msDFSR-Subscriber" object with the same GUID value for the "cn" attribute exists. If it does, it will be nested below the computer we're trying to find in order to fix the missing "msDFSR-ComputerReference" error from the Event Log.
If you're familiar with PowerShell, you can find the msDFSR-Subscriber, and hence the missing computer reference using:
Get-ADObject -Filter { (objectClass -eq "msDFSR-Subscriber") -and (cn -eq "c3b24e94-239f-4621-b82b-b356d6cc9bed") } | select distinguishedName
If it does not exist then you should simply delete the object mentioned in the Event Log (i.e. "CN=<guid>,CN=Topology,CN=DFS,CN=DFSR-GlobalSettings, etc...".) Deleting the orphaned reference will stop event 6002 from being logged.
If it does exist, you will get a value back that looks like:
CN=c3b24e94-239f-4621-b82b-b356d6cc9bed,CN=DFSR-LocalSettings,CN=YourServerName,OU=SomeOU,...,DC=sm,DC=local
What you want to do now is:
These steps will put the missing computer reference back into the msDFSR-ComputerReference attribute, which will stop event 6002 from being logged.
About the ADSI Edit picture (purely additional information for education and has nothing to do with your event log error):
The GUIDs your looking at under the domain controller object in ADSI Edit are the forward references to the non-SYSVOL replicas to which the domain controller, UZTASSRV01.sm.local, is also a member.
You do not have to check those at all unless there's errors relating to them. You can if you'd like, but unless you're really unlucky, you will find matching "msDFSR-Member" objects matching the GUIDs from your ADSI Edit picture below one of the replica groups somewhere beneath "CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local".
Anyhow, as I say, this is purely additional information. The only thing you need to remember is that your ADSI Edit picture is totally unrelated to the Event Log error.
Cheers,
Lain
Apr 14 2022 09:11 PM
Thanks a lot for your detailed response!
I have tried to run the PowerShell script and it doesn't return any values. And I didn't clearly understood how I can delete it now?
Apr 15 2022 05:41 PM
Okay, given you didn't get any values returned from that command, just delete the object listed in the Event Viewer error.
In other words, delete the following object from AD (make sure you check I haven't typed the GUID incorrectly - you can copy-and-paste it from the Event Viewer error if you like):
CN=c3b24e94-239f-4621-b82b-b356d6cc9bed,CN=Topology,CN=DFS,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local
Cheers,
Lain
Apr 19 2022 01:00 AM
I still don't understand how I can delete the object if it doesn't appear either in AD or ADSI editor.
CN=c3b24e94-239f-4621-b82b-b356d6cc9bed,CN=Topology,CN=DFS,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local
Apr 19 2022 09:37 AM - edited Jun 10 2022 07:48 PM
If you can't see it then the error doesn't make any sense, either.
Rather than trying to work through checking each object individually, I've written a quick script (inserted at the bottom of this post) to pull some of the DFS (-N and -R) configuration information from Active Directory.
If you can save it as "Get-DfsConfiguration.ps1", then run it as shown below and upload the JSON, that would help with the cross-referencing.
You can direct-message me the results if you'd prefer not to post them here, but there's nothing confidential about it, meaning others here may be able to offer insight if you choose to paste the results in here.
.\Get-DfsConfiguration.ps1 | ConvertTo-Json -Depth 3
If the script throws an error, let me know and I'll fix it as I didn't spend much time quality assuring it. But if it behaves, the output will help with both of your TechCommunity threads.
It does not need any special rights and can (and should) be run as a normal, unprivileged user.
Also, can you check that the DFS service is running on your domain controller? (i.e. "Get-Service -Name Dfs")
Cheers,
Lain
[cmdletbinding()]
Param()
#region Class definitions.
class DfsrSubscriber
{
[string] $Status;
[guid] $ObjectGUID;
[string] $ObjectClass;
[string] $Name;
[string] $DistinguishedName;
[string] $MemberReference;
DfsrSubscriber([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $MemberReference)
{
$this.ObjectGUID = $ObjectGUID;
$this.ObjectClass = "msDFSR-Subscriber";
$this.Name = $Name;
$this.DistinguishedName = $DistinguishedName;
if (($MemberReference.Count -gt 0) -and ([adsi]::Exists("$($Script:AdsPrefix)/CN=SYSVOL Subscription,$DistinguishedName")))
{
$this.Status = "Okay";
$this.MemberReference = $MemberReference[0];
}
else
{
$this.Status = "Unhealthy";
$this.MemberReference = $null;
}
}
}
class DfsrSubscription
{
[string] $Status;
[guid] $ObjectGUID;
[string] $ObjectClass;
[string] $Name;
[string] $DistinguishedName;
DfsrSubscription([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName)
{
$this.Status = "Okay";
$this.ObjectGUID = $ObjectGUID;
$this.ObjectClass = "msDFSR-Subscription";
$this.Name = $Name;
$this.DistinguishedName = $DistinguishedName;
}
}
class DfsrReplicationGroup
{
[string] $Status;
[guid] $ObjectGUID;
[string] $ObjectClass;
[string] $Name;
[string] $DistinguishedName;
DfsrReplicationGroup([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName)
{
$this.ObjectGUID = $ObjectGUID;
$this.ObjectClass = "msDFSR-ReplicationGroup";
$this.Name = $Name;
$this.DistinguishedName = $DistinguishedName;
if ([adsi]::Exists("$($Script:AdsPrefix)/CN=Topology,$DistinguishedName"))
{
$this.Status = "Okay";
}
else
{
$this.Status = "Unhealthy";
}
}
}
class DfsrMember
{
[string] $Status;
[guid] $ObjectGUID;
[string] $ObjectClass;
[string] $Name;
[string] $DistinguishedName;
[string] $ComputerReference;
[string] $ServerReference;
[string] $MembershipBL;
DfsrMember([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $ComputerReference, [System.DirectoryServices.PropertyValueCollection] $ServerReference, [System.DirectoryServices.PropertyValueCollection] $MembershipBL)
{
$this.ObjectGUID = $ObjectGUID;
$this.ObjectClass = "msDFSR-Member";
$this.Name = $Name;
$this.DistinguishedName = $DistinguishedName;
$this.Status = "Okay";
$this.MembershipBL = $MembershipBL;
#region Validate ComputerReference.
if ($ComputerReference.Count -gt 0)
{
$this.ComputerReference = $ComputerReference[0];
}
else
{
$this.Status = "Unhealthy";
$this.ComputerReference = $null;
}
#endregion
#region Validate ServerReference.
if ($ServerReference.Count -gt 0)
{
$this.ServerReference = $ServerReference[0];
}
else
{
$this.Status = "Unhealthy";
$this.ServerReference = $null;
}
#endregion
#region Validate MembershipBL.
if ($MembershipBL.Count -gt 0)
{
$this.MembershipBL = $MembershipBL[0];
}
else
{
$this.Status = "Unhealthy";
$this.MembershipBL = $null;
}
#endregion
}
}
class DfsNamespaceV2
{
[string] $Status;
[guid] $ObjectGUID;
[string] $ObjectClass;
[string] $Name;
[string] $DistinguishedName;
[System.Collections.Generic.List[DfsNamespaceV2Target]] $Targets;
DfsNamespaceV2([guid] $ObjectGUID, [string] $Name, [string] $DistinguishedName, [System.DirectoryServices.PropertyValueCollection] $Targets)
{
$this.ObjectGUID = $ObjectGUID;
$this.ObjectClass = "msDFS-Namespacev2";
$this.Name = $Name;
$this.DistinguishedName = $DistinguishedName;
$this.Targets = Get-DfsV2Target -TargetListV2 $Targets;
if ($this.Targets.Count -gt 0)
{
$this.Status = "Okay";
}
else
{
$this.Status = "Unhealthy";
}
}
}
class DfsNamespaceV2Target
{
[bool] $Online;
[string] $Target;
DfsNamespaceV2Target([string] $Status, [string] $Target)
{
$this.Online = $Status -eq "online";
$this.Target = $Target;
}
}
#endregion
#region Function definitions.
function Get-DfsV2Target([System.DirectoryServices.PropertyValueCollection] $TargetListV2)
{
$Targets = [System.Collections.Generic.List[DfsNamespaceV2Target]]::new();
if ($TargetListV2.Count -gt 0)
{
$Xml = [xml]::new();
$Xml.LoadXml(([System.Text.Encoding]::Unicode.GetString($TargetListV2[0])).SubString(1));
foreach ($Entry in $Xml.DocumentElement.target)
{
$Targets.Add([DfsNamespaceV2Target]::new($Entry.state, $Entry.InnerText));
}
}
return($Targets);
}
#endregion
#region Preamble.
$RootDSE = [adsi]"LDAP://RootDSE";
$Server = $RootDSe.dNSHostName[0].ToLowerInvariant();
$DefaultNamingContext = $RootDSE.defaultNamingContext[0];
$AdsPrefix = "LDAP://$Server";
Write-Verbose "Connected to domain controller: $Server";
Write-Verbose "Default naming context: $DefaultNamingContext";
#endregion
#region Enumerate domain controllers for SYSVOL DFS-R memberships. These represent the forward references pointing to the replication groups.
Write-Warning "Enumerating domain controller SYSVOL DFS-R memberships:";
$SysvolTopology = [adsi]"$AdsPrefix/OU=Domain Controllers,$DefaultNamingContext";
foreach ($DomainController in $SysvolTopology.Children)
{
if (-not [adsi]::Exists("$AdsPrefix/CN=DFSR-LocalSettings,$($DomainController.distinguishedName)"))
{
continue;
}
foreach ($DfsrSubscriber in $DomainController.Children.Find("CN=DFSR-LocalSettings").Children)
{
$DfsrSubscriberSummary = [DfsrSubscriber]::new($DfsrSubscriber.objectGUID[0], $DfsrSubscriber.Name[0], $DfsrSubscriber.distinguishedName[0], $DfsrSubscriber.Properties['msDFSR-MemberReference']);
$DfsrSubscriberSummary;
if ($DfsrSubscriberSummary.Status.Equals("Okay", [System.StringComparison]::Ordinal))
{
foreach ($DfsrSubscription in $DfsrSubscriber.Children)
{
# Arguably, this could be left out as it currently doesn't add much to the SYSVOL discussion. Only red flag would be if it were missing (given the subscriber implicitly exists.)
[DfsrSubscription]::new($DfsrSubscription.objectGUID[0], $DfsrSubscription.Name[0], $DfsrSubscription.distinguishedName[0]);
}
}
}
}
$SysvolTopology.Dispose();
#endregion
#region Enumerate DFS-R replication groups. These contain the topology definitions, which in turn contain back-link references to the server objects' membership definitions.
Write-Warning "Enumerating DFS-R replication group topologies:";
$DfsrGroups = [adsi]"$AdsPrefix/CN=DFSR-GlobalSettings,CN=System,$DefaultNamingContext";
foreach ($DfsrGroup in $DfsrGroups.Children)
{
$DfsrGroupSummary = [DfsrReplicationGroup]::new($DfsrGroup.objectGUID[0], $DfsrGroup.Name[0], $DfsrGroup.distinguishedName[0]);
$DfsrGroupSummary;
if ($DfsrGroupSummary.Status.Equals("Okay", [System.StringComparison]::Ordinal))
{
foreach ($DfsrMember in $DfsrGroup.Children.Find("CN=Topology").Children)
{
[DfsrMember]::new($DfsrMember.objectGUID[0], $DfsrMember.Name[0], $DfsrMember.distinguishedName[0], $DfsrMember.'msDFSR-ComputerReference', $DfsrMember.serverReference, $DfsrMember.'msDFSR-MemberReferenceBL');
}
}
}
$DfsrGroups.Dispose();
#endregion
#region Enumerate DFS-N namespaces. Note: SYSVOL isn't defined here as that's handled differently.
Write-Warning "Enumerating DFS-N namespaces:";
$DfsNamespaces = [adsi]"$AdsPrefix/CN=Dfs-Configuration,CN=System,$DefaultNamingContext";
foreach ($DfsNamespaceAnchor in $DfsNamespaces.Children)
{
if ($DfsNamespaceAnchor.Children.Count -eq 0)
{
continue;
}
foreach ($DfsNamespace in $DfsNamespaceAnchor.Children)
{
[DfsNamespaceV2]::new($DfsNamespace.objectGUID[0], $DfsNamespace.Name[0], $DfsNamespace.distinguishedName[0], $DfsNamespace.'msDFS-TargetListv2');
}
}
$DfsNamespaces.Dispose();
#endregion
$RootDSE.Dispose();
Edited: 2022-06-11 to include a serverReference check on msDFSR-Member objects.
Apr 19 2022 09:18 PM - edited Apr 19 2022 09:20 PM
Good morning! Please see the script outcome below
WARNING: Enumerating domain controller SYSVOL DFS-R memberships:
WARNING: Enumerating DFS-R replication group topologies:
WARNING: Enumerating DFS-N namespaces:
[
{
"Status": "Unhealthy",
"ObjectGUID": "4510c737-8c38-495d-aa7b-e1f3ce92fa3b",
"ObjectClass": "msDFSR-Subscriber",
"Name": "45d9316b-1098-408e-a65d-8ce8449f0aaa",
"DistinguishedName": "CN=45d9316b-1098-408e-a65d-8ce8449f0aaa,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Con
trollers,DC=sm,DC=local",
"MemberReference": ""
},
{
"Status": "Unhealthy",
"ObjectGUID": "ea36c86a-ab6b-4648-ad76-16c5f2a21b32",
"ObjectClass": "msDFSR-Subscriber",
"Name": "a7297769-fdcd-4490-ae1c-c80808f44d36",
"DistinguishedName": "CN=a7297769-fdcd-4490-ae1c-c80808f44d36,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Con
trollers,DC=sm,DC=local",
"MemberReference": ""
},
{
"Status": "Okay",
"ObjectGUID": "43d626f7-7496-496a-8cf1-fefa0467c173",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,D
C=local",
"MemberReference": "CN=UZTASSRV01,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC
=local"
},
{
"Status": "Okay",
"ObjectGUID": "43d626f7-7496-496a-8cf1-fefa0467c173",
"ObjectClass": "msDFSR-Subscription",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,D
C=local"
},
{
"Status": "Okay",
"ObjectGUID": "3d74223e-5f1f-40c2-bf42-3255fd57227e",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "DFS",
"DistinguishedName": "CN=DFS,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "331bda39-781e-4bb9-ab31-b8432cc2f5ce",
"ObjectClass": "msDFSR-Member",
"Name": "45d9316b-1098-408e-a65d-8ce8449f0aaa",
"DistinguishedName": "CN=45d9316b-1098-408e-a65d-8ce8449f0aaa,CN=Topology,CN=DFS,CN=DFSR-GlobalSettings,CN=Syst
em,DC=sm,DC=local",
"ComputerReference": "CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local",
"MembershipBL": "CN=45d9316b-1098-408e-a65d-8ce8449f0aaa,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controll
ers,DC=sm,DC=local"
},
{
"Status": "Unhealthy",
"ObjectGUID": "66a0d320-8b34-4f9e-8dd1-3a93c5c4b7a1",
"ObjectClass": "msDFSR-Member",
"Name": "c3b24e94-239f-4621-b82b-b356d6cc9bed",
"DistinguishedName": "CN=c3b24e94-239f-4621-b82b-b356d6cc9bed,CN=Topology,CN=DFS,CN=DFSR-GlobalSettings,CN=Syst
em,DC=sm,DC=local",
"ComputerReference": "",
"MembershipBL": ""
},
{
"Status": "Okay",
"ObjectGUID": "cbc3347c-ee38-4d15-9737-34a0b9cafa84",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "DFS_IT",
"DistinguishedName": "CN=DFS_IT,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local"
},
{
"Status": "Unhealthy",
"ObjectGUID": "837b0736-bf19-41ff-a3bd-29c43c0c8c49",
"ObjectClass": "msDFSR-Member",
"Name": "6819feb2-58e2-4400-a2b0-db0a3c442183",
"DistinguishedName": "CN=6819feb2-58e2-4400-a2b0-db0a3c442183,CN=Topology,CN=DFS_IT,CN=DFSR-GlobalSettings,CN=S
ystem,DC=sm,DC=local",
"ComputerReference": "",
"MembershipBL": ""
},
{
"Status": "Okay",
"ObjectGUID": "fbeded44-7272-44d8-bea3-f2e700d68d3f",
"ObjectClass": "msDFSR-Member",
"Name": "a7297769-fdcd-4490-ae1c-c80808f44d36",
"DistinguishedName": "CN=a7297769-fdcd-4490-ae1c-c80808f44d36,CN=Topology,CN=DFS_IT,CN=DFSR-GlobalSettings,CN=S
ystem,DC=sm,DC=local",
"ComputerReference": "CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local",
"MembershipBL": "CN=a7297769-fdcd-4490-ae1c-c80808f44d36,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controll
ers,DC=sm,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "3a3d05c2-7738-4b40-b14c-03af84841594",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "88883960-839e-40b5-962c-f3020f49250d",
"ObjectClass": "msDFSR-Member",
"Name": "UZTASSRV01",
"DistinguishedName": "CN=UZTASSRV01,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,
DC=local",
"ComputerReference": "CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=loc
al"
},
{
"Status": "Unhealthy",
"ObjectGUID": "5eb07891-a762-4aab-a04d-9ddefd9c318f",
"ObjectClass": "msDFSR-Member",
"Name": "UZTASSVR02",
"DistinguishedName": "CN=UZTASSVR02,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,
DC=local",
"ComputerReference": "",
"MembershipBL": ""
}
]
Apr 19 2022 11:13 PM
Solution
Thanks, Nikita. That helped a great deal and saved a lot of time.
I'll start at the end and work backwards.
You want to run these commands to clean up what is a very broken DFS-R configuration. I'll provide an in-depth explanation after the commands
Remove-ADObject -Identity "CN=45d9316b-1098-408e-a65d-8ce8449f0aaa,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=a7297769-fdcd-4490-ae1c-c80808f44d36,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=DFS,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=DFS_IT,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=UZTASSVR02,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Overview
What the JSON output you provided showed is:
Approach
There were two options I could have pursued:
I have chosen option 2 since:
Explanation of each command
Line | Comment |
1 | Removes the orphaned subscription to the "DFS" replication group from UZTASSRV01. |
2 | Removes the orphaned subscription to the "DFS_IT" replication group from UZTASSRV01. |
3 | Removes the "DFS" replication group. |
4 | Removes the "DFS_IT" replication group. |
5 | Removes the orphaned UZTASSVR02 reference from the "Domain System Volume" replication group. |
Once you have removed these objects, it will take DFS-R a little while to recognise the changes.
If you want to hurry the process up, you can do any one of the following:
dfsdiag pollad
Anyhow, once you've either waited a bit or hurried things up, you should find the Event Viewer errors stop.
Cheers,
Lain
Apr 20 2022 12:31 AM
Thanks a lot for your effort and this very detailed answer. I'm going to try according to your proposal. Just wanted to clarify whether removal of those DSF references shouldn't anyhow impact existing DC, AD, GPO functionality currently running on uztassrv01?
Apr 20 2022 12:35 AM
No, not at all.
Lines 1 to 4 have nothing to do with the SYSVOL (which in turn relates to GPO and all that stuff).
Line 5 does relate to SYSVOL but only in the context that it's removing the now-orphaned reference to the domain controller UZTASSVR02 which no longer exists. In other words, it's fixing the SYSVOL replication group by removing the reference to UZTASSVR02.
Cheers,
Lain
Apr 20 2022 12:40 AM - edited Apr 20 2022 12:41 AM
With respect to UZTASSVR02, it looks like the demotion didn't work cleanly.
This isn't uncommon and normally you can run a process commonly called the "metadata cleanup" process to remove these kinds of orphaned references, such as you have in your Domain System Volume DFS-R set.
But because there are more issues than just the orphaned reference to UZTASSVR02 (such as those relating to the DFS and DFS_IT replication groups), it was easier just to deal with everything in one reply rather than handling the DFS, DFS_IT and Domain System Volume replication groups separately.
Cheers,
Lain
Apr 20 2022 01:00 AM
I have launched the commands to remove broken references and here is the the JSON outcome afterwards.
WARNING: Enumerating domain controller SYSVOL DFS-R memberships:
WARNING: Enumerating DFS-R replication group topologies:
WARNING: Enumerating DFS-N namespaces:
[
{
"Status": "Okay",
"ObjectGUID": "43d626f7-7496-496a-8cf1-fefa0467c173",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,D
C=local",
"MemberReference": "CN=UZTASSRV01,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC
=local"
},
{
"Status": "Okay",
"ObjectGUID": "43d626f7-7496-496a-8cf1-fefa0467c173",
"ObjectClass": "msDFSR-Subscription",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,D
C=local"
},
{
"Status": "Okay",
"ObjectGUID": "3a3d05c2-7738-4b40-b14c-03af84841594",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "88883960-839e-40b5-962c-f3020f49250d",
"ObjectClass": "msDFSR-Member",
"Name": "UZTASSRV01",
"DistinguishedName": "CN=UZTASSRV01,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,
DC=local",
"ComputerReference": "CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=loc
al"
}
]
Apr 20 2022 01:07 AM
That looks a lot healthier.
You should find your DFS-R errors stop soon.
You can probably focus on your other thread (the "gpt.ini" error) now as this one should be resolved.
Cheers,
Lain
Jun 09 2022 03:26 AM - edited Jun 09 2022 03:32 AM
That is a great script. Thank you for sharing. Do you think you could tell me how to fix mine?
Here is my output
{
"Status": "Okay",
"ObjectGUID": "f1516c20-c05e-4ac3-9ff2-7d171565adc3",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=BABBAGE,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "5fcab8b3-54e9-4f13-8162-b6558245df04",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Unhealthy",
"ObjectGUID": "36b08e1a-0c95-41c7-817d-3ca25983d2c7",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOS-SEA-A1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": ""
},
{
"Status": "Okay",
"ObjectGUID": "b3d25181-b8c1-4b2c-b66f-47d692328ceb",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=IOSLA-DCFS,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "860ff124-94ec-48dc-a84c-2f7178ae2701",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "b885a358-9efa-4b75-95da-a8708c167e8d",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=OR-VM-1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "63ae8858-7cb7-40db-80a5-9b87b29d1640",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "f76b9584-3391-4c5f-a319-8863a54c38f1",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=PS-BAY-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "8b5f8113-1697-4e8d-a555-12eb693dc1f8",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "80b931aa-fda5-4076-97a9-8db68eef6df6",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=PS-I-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "dc7544d5-65a1-4bc9-91a1-c3f21954f2aa",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "7d205027-558a-40fe-97cd-de0e2306a2d8",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,DC=local",
"MemberReference": "CN=PS-I-AD2,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "087929aa-cc98-4654-965d-faa8e18248d1",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "860c23c1-6213-4edc-8aa3-0c4b75f238da",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "4d4357ba-8801-4f20-846a-5dd0e4b4cb7c",
"ObjectClass": "msDFSR-Member",
"Name": "BABBAGE",
"DistinguishedName": "CN=BABBAGE,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "3ec9a4c7-fec3-4e51-bf4c-77324b26fbb6",
"ObjectClass": "msDFSR-Member",
"Name": "IOSLA-DCFS",
"DistinguishedName": "CN=IOSLA-DCFS,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "806d1444-4493-4adf-8a0f-da75bbdf6fa9",
"ObjectClass": "msDFSR-Member",
"Name": "OR-VM-1",
"DistinguishedName": "CN=OR-VM-1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "9e8b3739-6c0a-4a39-b357-b4191f4c558c",
"ObjectClass": "msDFSR-Member",
"Name": "PS-BAY-AD1",
"DistinguishedName": "CN=PS-BAY-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "2d0c5853-367f-4de4-b325-b62102f74b2e",
"ObjectClass": "msDFSR-Member",
"Name": "PS-I-AD1",
"DistinguishedName": "CN=PS-I-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "95b66f35-e63c-4167-b68b-b3196b210742",
"ObjectClass": "msDFSR-Member",
"Name": "PS-I-AD2",
"DistinguishedName": "CN=PS-I-AD2,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local",
"ComputerReference": "CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,DC=local"
}
]
PS C:\>
{
Jun 10 2022 03:56 AM
You've only got the one issue showing up for IOS-SEA-A1. It has a subscriber placeholder but no subscription, nor a matching DFS-R object residing within the SYSVOL replication group definition.
Either it's not a domain controller anymore and there's some lingering, orphaned references, or it is a broken domain controller.
Before making any changes, what does the following command return as output?
Get-ADObject -Identity "CN=IOS-SEA-A1,OU=Domain Controllers,DC=iosdomain,DC=local" -Properties * |
Select-Object -Property objectGUID, cn, dNSHostName, primaryGroupID, @{ n="lastLogonTimestamp"; e= { if ($_.lastLogonTimestamp) { [datetime]::FromFileTimeUtc($_.lastLogonTimestamp).ToString("u"); } else { "never"; } }};
Cheers,
Lain
Jun 10 2022 04:35 AM
I think I may have fixed it by adding the object back throuh ADSI
[
{
"Status": "Okay",
"ObjectGUID": "f1516c20-c05e-4ac3-9ff2-7d171565adc3",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain Controllers,DC=iosdoma
in,DC=local",
"MemberReference": "CN=BABBAGE,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomai
n,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "5fcab8b3-54e9-4f13-8162-b6558245df04",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain
Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "36b08e1a-0c95-41c7-817d-3ca25983d2c7",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOS-SEA-A1,OU=Domain Controllers,DC=iosd
omain,DC=local",
"MemberReference": "CN=IOS-SEA-A1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdo
main,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "626c7bfb-dd30-4435-852f-18177235a5c0",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOS-SEA-A1,OU=Dom
ain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "b3d25181-b8c1-4b2c-b66f-47d692328ceb",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosd
omain,DC=local",
"MemberReference": "CN=IOSLA-DCFS,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdo
main,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "860ff124-94ec-48dc-a84c-2f7178ae2701",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Dom
ain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "b885a358-9efa-4b75-95da-a8708c167e8d",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain Controllers,DC=iosdoma
in,DC=local",
"MemberReference": "CN=OR-VM-1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomai
n,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "63ae8858-7cb7-40db-80a5-9b87b29d1640",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain
Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "f76b9584-3391-4c5f-a319-8863a54c38f1",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosd
omain,DC=local",
"MemberReference": "CN=PS-BAY-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdo
main,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "8b5f8113-1697-4e8d-a555-12eb693dc1f8",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Dom
ain Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "80b931aa-fda5-4076-97a9-8db68eef6df6",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domain Controllers,DC=iosdom
ain,DC=local",
"MemberReference": "CN=PS-I-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdoma
in,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "dc7544d5-65a1-4bc9-91a1-c3f21954f2aa",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domai
n Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "7d205027-558a-40fe-97cd-de0e2306a2d8",
"ObjectClass": "msDFSR-Subscriber",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domain Controllers,DC=iosdom
ain,DC=local",
"MemberReference": "CN=PS-I-AD2,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdoma
in,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "087929aa-cc98-4654-965d-faa8e18248d1",
"ObjectClass": "msDFSR-Subscription",
"Name": "SYSVOL Subscription",
"DistinguishedName": "CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domai
n Controllers,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "860c23c1-6213-4edc-8aa3-0c4b75f238da",
"ObjectClass": "msDFSR-ReplicationGroup",
"Name": "Domain System Volume",
"DistinguishedName": "CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdomain,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "4d4357ba-8801-4f20-846a-5dd0e4b4cb7c",
"ObjectClass": "msDFSR-Member",
"Name": "BABBAGE",
"DistinguishedName": "CN=BABBAGE,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdom
ain,DC=local",
"ComputerReference": "CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=BABBAGE,OU=Domain Controllers,DC=iosdomain,DC
=local"
},
{
"Status": "Okay",
"ObjectGUID": "43a19c80-d9ab-4dcc-8434-7bc4987d3b5b",
"ObjectClass": "msDFSR-Member",
"Name": "IOS-SEA-A1",
"DistinguishedName": "CN=IOS-SEA-A1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=ios
domain,DC=local",
"ComputerReference": "CN=IOS-SEA-A1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOS-SEA-A1,OU=Domain Controllers,DC=iosdomain
,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "3ec9a4c7-fec3-4e51-bf4c-77324b26fbb6",
"ObjectClass": "msDFSR-Member",
"Name": "IOSLA-DCFS",
"DistinguishedName": "CN=IOSLA-DCFS,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=ios
domain,DC=local",
"ComputerReference": "CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=IOSLA-DCFS,OU=Domain Controllers,DC=iosdomain
,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "806d1444-4493-4adf-8a0f-da75bbdf6fa9",
"ObjectClass": "msDFSR-Member",
"Name": "OR-VM-1",
"DistinguishedName": "CN=OR-VM-1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdom
ain,DC=local",
"ComputerReference": "CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=OR-VM-1,OU=Domain Controllers,DC=iosdomain,DC
=local"
},
{
"Status": "Okay",
"ObjectGUID": "9e8b3739-6c0a-4a39-b357-b4191f4c558c",
"ObjectClass": "msDFSR-Member",
"Name": "PS-BAY-AD1",
"DistinguishedName": "CN=PS-BAY-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=ios
domain,DC=local",
"ComputerReference": "CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-BAY-AD1,OU=Domain Controllers,DC=iosdomain
,DC=local"
},
{
"Status": "Okay",
"ObjectGUID": "2d0c5853-367f-4de4-b325-b62102f74b2e",
"ObjectClass": "msDFSR-Member",
"Name": "PS-I-AD1",
"DistinguishedName": "CN=PS-I-AD1,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdo
main,DC=local",
"ComputerReference": "CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD1,OU=Domain Controllers,DC=iosdomain,D
C=local"
},
{
"Status": "Okay",
"ObjectGUID": "95b66f35-e63c-4167-b68b-b3196b210742",
"ObjectClass": "msDFSR-Member",
"Name": "PS-I-AD2",
"DistinguishedName": "CN=PS-I-AD2,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=iosdo
main,DC=local",
"ComputerReference": "CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,DC=local",
"MembershipBL": "CN=Domain System Volume,CN=DFSR-LocalSettings,CN=PS-I-AD2,OU=Domain Controllers,DC=iosdomain,D
C=local"
}
]
PS C:\>
so running the command you requested gives this
objectGUID : 1ffd2aa4-ef52-4095-b964-5adfcb50df9f
cn : IOS-SEA-A1
dNSHostName : IOS-SEA-A1.iosdomain.local
primaryGroupID : 516
lastLogonTimestamp : 2022-06-09 18:02:56Z
but I still have this error
PS C:\Users\administrator.IOSDOMAIN> dcdiag
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = IOS-SEA-A1
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: SEATTLE\IOS-SEA-A1
Starting test: Connectivity
......................... IOS-SEA-A1 passed test Connectivity
Doing primary tests
Testing server: SEATTLE\IOS-SEA-A1
Starting test: Advertising
......................... IOS-SEA-A1 passed test Advertising
Starting test: FrsEvent
......................... IOS-SEA-A1 passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SY
replication problems may cause Group Policy problems.
......................... IOS-SEA-A1 failed test DFSREvent
Starting test: SysVolCheck
......................... IOS-SEA-A1 passed test SysVolCheck
Starting test: KccEvent
......................... IOS-SEA-A1 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... IOS-SEA-A1 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... IOS-SEA-A1 passed test MachineAccount
Starting test: NCSecDesc
......................... IOS-SEA-A1 passed test NCSecDesc
Starting test: NetLogons
......................... IOS-SEA-A1 passed test NetLogons
Starting test: ObjectsReplicated
......................... IOS-SEA-A1 passed test ObjectsReplicated
Starting test: Replications
......................... IOS-SEA-A1 passed test Replications
Starting test: RidManager
......................... IOS-SEA-A1 passed test RidManager
Starting test: Services
......................... IOS-SEA-A1 passed test Services
Starting test: SystemLog
......................... IOS-SEA-A1 passed test SystemLog
Starting test: VerifyReferences
Some objects relating to the DC IOS-SEA-A1 have problems:
[1] Problem: Missing Expected Value
Base Object:
CN=NTDS Settings,CN=IOS-SEA-A1,CN=Servers,CN=SEATTLE,CN=Sites,CN=Configuration,DC=iosdomain,DC=local
Base Object Description: "DSA Object"
Value Object Attribute Name: serverReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862
......................... IOS-SEA-A1 failed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : iosdomain
Starting test: CheckSDRefDom
......................... iosdomain passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... iosdomain passed test CrossRefValidation
Running enterprise tests on : iosdomain.local
Starting test: LocatorCheck
......................... iosdomain.local passed test LocatorCheck
Starting test: Intersite
......................... iosdomain.local passed test Intersite
PS C:\Users\administrator.IOSDOMAIN>
Apr 19 2022 11:13 PM
Solution
Thanks, Nikita. That helped a great deal and saved a lot of time.
I'll start at the end and work backwards.
You want to run these commands to clean up what is a very broken DFS-R configuration. I'll provide an in-depth explanation after the commands
Remove-ADObject -Identity "CN=45d9316b-1098-408e-a65d-8ce8449f0aaa,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=a7297769-fdcd-4490-ae1c-c80808f44d36,CN=DFSR-LocalSettings,CN=UZTASSRV01,OU=Domain Controllers,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=DFS,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=DFS_IT,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Remove-ADObject -Identity "CN=UZTASSVR02,CN=Topology,CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=System,DC=sm,DC=local" -Recursive -Confirm:$false;
Overview
What the JSON output you provided showed is:
Approach
There were two options I could have pursued:
I have chosen option 2 since:
Explanation of each command
Line | Comment |
1 | Removes the orphaned subscription to the "DFS" replication group from UZTASSRV01. |
2 | Removes the orphaned subscription to the "DFS_IT" replication group from UZTASSRV01. |
3 | Removes the "DFS" replication group. |
4 | Removes the "DFS_IT" replication group. |
5 | Removes the orphaned UZTASSVR02 reference from the "Domain System Volume" replication group. |
Once you have removed these objects, it will take DFS-R a little while to recognise the changes.
If you want to hurry the process up, you can do any one of the following:
dfsdiag pollad
Anyhow, once you've either waited a bit or hurried things up, you should find the Event Viewer errors stop.
Cheers,
Lain