Windows Forum

Ask something
Discussion Locked

Win 2000 Domain Controller FRS Problem

0 helpful
7 replies

by srippey

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a win 2000 dc (HAL) that is the only dc in it's domain. We did an upgrade from win NT dc to 2000, but we used a different machine (claims). We upgraded an NT pdc to win 2000, then we put the new win 2000 (HAL) online as a dc also. Once this was done we took the pdc we had upgraded offline. We never did any replication. We ran into several issues: Domain trusts work fine, as do logins, etc. However, I cannot create new user accounts, and the defualt domain policy is not working. We have tried many ways of getting HAL to be the RID, PDC, and Infrustucture master. For some reason, with the pdc we upgraded online, they couldn't connect to each other, so we seized the roles on HAL. HAL is now the Operations Master for RID, PDC,Infrustructure, Schema, and Domain Master. The other dc is no longer online, per instructions never to put it back online once roles were seized on HAL. I still cannot create new users, and the default domain policy is not working.
Here are some errors in the logs:
Userenv Error None 1000 NT AUTHORITY\SYSTEM HAL The Group Policy client-side extension Security was passed flags (17) and returned a failure status code of (3).
SceCli Error None 1001 N/A HAL "Security policy cannot be propagated. Cannot access the template. Error code = 3.
\\mpc-domain\sysvol\mpc-domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf. "
Another:
SAM Error None 16650 N/A HAL The account-identifier allocator failed to initialize properly. The record data contains the NT error code that caused the failure.
Another:
NtFrs Warning None 13508 N/A HAL The File Replication Service is having trouble enabling replication from CLAIMS to HAL for c:\winnt\sysvol\domain using the DNS name claims.mpc-domain. FRS will keep retrying.

Even with the other dc online, the roles couldn't transfer. We recieved the same errors then also.

7 replies

by jeremy the it guy

Did you ever switch the new computer, HAL, to be the Global Catalog Master? I didn't see it in your description. If that is the case, you are in trouble. The Global Catalog Master stores information regarding all Active Directory Objects. Let meknow if you made HAL the Global Catalog Server and we'll go from there. Email me at jwhitlock@starprecision.com to continue. I've had this problem before.

by srippey

Jeremy was able to fix my problems. Here is a summary of what we did: We were unable to delete the Claims station from the MMC, so we had to use ASDI Edit to edit the active directory. We deleted any reference to the CLAIMS server and then rebooted HAL. All of the errors related to replication and syncing went away. I was still getting the policy errors mentioned above however. To fix this, we went into the Winnt/system32 directory and looked for two files, dcpol.msc and dompol.msc. We did the same thing on both files. Right-Click and chose "Author". Once the console was up, we went to add/remove snapin. We deleted the local computer policy, then added it back in. Then we exited out and saved the changes. This fixed all of the errors that happened when I would try to open "Domain Controller Security Policy" and the "Domain Security Policy" from the Administrative tools menu.

In short, Jeremy knows his stuff. Thanks!

This discussion is closed to new replies.