1. #1
    Deek's Avatar
    Join Date
    Apr 2013
    Sacramento, Ca

    AD Help Request

    Hi, I have a sick server. I Transferred all the FSMO roles to the new server and have verified that they transferred. However, the If the old server is down, AD does not work on the new server. This is a problem because due to hardware issues, the old server will only stay up for a short time.

    I get this error on the new server:
    This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.
    Operations which require contacting a FSMO operation master will fail until this condition is corrected.

    FSMO Role: CN=Infrastructure,DC=YCG,DC=com

    User Action:

    1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476.
    2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors. Correct the error in question. For example there maybe problems with IP connectivity, DNS name resolution, or security authentication that are preventing successful replication.
    3. In the rare event that all replication partners are expected to be offline (for example, because of maintenance or disaster recovery), you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com.

    The following operations may be impacted:
    Schema: You will no longer be able to modify the schema for this forest.
    Domain Naming: You will no longer be able to add or remove domains from this forest.
    PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts.
    RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups.
    Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.

    Before I use NTDSUtil to seize the roles...I was hoping someone could help me make sure I want about to do something stupid.

    Come on, give me a hard one! I can fix anything ;-)

    • Ad Bot



  2. #2
    zcomputerwiz's Avatar
    Join Date
    Jan 2015

    Re: AD Help Request

    Which OS is running on the old server?

    If it will stay on long enough, you should be able to run through the steps to transfer the roles again and then demote the old DC to member server.
    This will remove the old DC from the Domain Controllers group and should clear up the 'could not replicate' and 'cannot be validated' errors.

    Make sure everything is updated to point to the new server for DNS as well.
    I am usually online 1PM - 4PM CST Monday - Friday.
    If your thread has not received a new reply within 3 days, please make a post here: Not Received Help? so another helper can continue to assist you.

Similar Threads

  1. [SOLVED] Request for sfc Help 12-21-16
    By DrJoeSanDiego in forum Windows Update
    Replies: 11
    Last Post: 12-29-2016, 09:27 PM
  2. SQL Guru request
    By Deek in forum General Help & Information
    Replies: 4
    Last Post: 10-21-2013, 01:16 AM

Log in

Log in