DFSR Sysvol invalid msDFSR-Subscriber object data


Recommended Posts

Hi All,

I've been scratching my head for the last few hours trying to resolve an issue with a DC.

First a bit of background, I have 3 DCs, all globe catalogues, the server that is having the following problems doesn't have any of the FSMO roles, it doesn't have DHCP or DNS roles although it did a few months ago. All the other servers appear to be working fine. The domain is windows server 2008 R2.

I have the following error in my error log:


The DFS Replication service detected invalid msDFSR-Subscriber object data while polling for configuration information.

Additional Information:
Object DN: CN=Domain System Volume,CN=DFSR-LocalSettings,CN=**DC NAME**,OU=Domain Controllers,DC=**DOMAIN NAME**,DC=local
Attribute Name: msDFSR-MemberReference
Domain Controller: **DC NAME**.**DOMAIN NAME**
Polling Cycle: 60 minutes[/CODE]

AD replication is fine, running REPADMIN /SHOWREPL * /CSV shows no errors and the last success was within the last few minutes and several tests I've done show that replication is fine.

Everything in ASDI looks ok, does anyone have an suggestions on where to look next?

Is this server a Domain Controller? If it is, you really should have dns on it. TCP/IP properties should have the primary pointing to its static IP address, secondary should be pointing to one of the other domain controllers.

as sc302 said, if that's a DC I would strongly suggest you have DNS installed on it as well. Can you even dcpromo without installing the DNS role? :\ Whens the last time DFS worked as it should? Did it recently stop working or has it been done for a month or two?

http://social.technet.microsoft.com/Forums/en/winserverfiles/thread/0f1a131f-d657-4edd-b5d2-6d61f5ccbed1

Thanks for the replies people, looking at the logs it has been doing it for a few months, should probably have realised sooner but hey.

I've reinstalled DNS on the box, DNS is replicating as it should, but I've still got the issue of sysvol not replicating on that machine.

After running dcdiag /q I have the following output:


Some objects relating to the DC **DC NAME** have problems:
[1] Problem: Missing Expected Value
Base Object:
CN=NTDS Settings,CN=**DC NAME**,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=**DC NAME**,DC=local
Base Object Description: "DSA Object"
Value Object Attribute Name: serverReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862

[1] Problem: Missing Expected Value
Base Object:
CN=**DC NAME**,OU=Domain Controllers,DC=**DC NAME**,DC=local
Base Object Description: "DC Account Object"
Value Object Attribute Name: msDFSR-ComputerReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862

......................... **DC NAME** failed test VerifyReferences[/CODE]

Are normal AD objects replicating then, I.E. User accounts?

If your sure its just sysvol thats broken you can rebuild it from one of the working DC's. In 2000+2003 this was done with the burflags regsitry keys but in 2008 there is a new method using ADSIEdit.

http://technet.microsoft.com/en-us/library/cc816596(v=ws.10).aspx

  Quote
SK[' timestamp=1356613375' post='595417770]

Are normal AD objects replicating then, I.E. User accounts?

If your sure its just sysvol thats broken you can rebuild it from one of the working DC's. In 2000+2003 this was done with the burflags regsitry keys but in 2008 there is a new method using ADSIEdit.

http://technet.micro...6(v=ws.10).aspx

AD objects are replicating correctly, new users account etc. all replicate as expected.

I'll have a look at that technet article, thanks.

You are having an issue with replication. Just because you see your AD objects doesn't mean your file objects are replicating properly. Your replication logs should have errors and possibly some in your ad event logs...these logs should have a ton of errors in them.

  On 27/12/2012 at 15:14, sc302 said:

You are having an issue with replication. Just because you see your AD objects doesn't mean your file objects are replicating properly. Your replication logs should have errors and possibly some in your ad event logs...these logs should have a ton of errors in them.

I am very well aware I am having a problem with replication, I was only answering ]SK[ question about AD object replication. I didn't dismiss your idea to look at he replication logs did I, I was going to have a look at them once I return home.

I'm probably reading to much into it but your post feels like you where attacking me for not replying to you.

This topic is now closed to further replies.
  • Posts

    • Yeah, I've had a Recycle Bin on my taskbar since XP and till last year when I got a new laptop with Windows 11. It was especially useful for touch workflow - I could drag files into Recycle Bin from anywhere because my Taskbar is always visible, unlike desktop icons.
    • Not after SP1. There was a legitimate file copy issue prior.
    • Microsoft 365 security in the spotlight after Washington Post hack by Paul Hill The Washington Post has come under cyberattack which saw Microsoft email accounts of several journalists get compromised. The attack, which was discovered last Thursday, is believed to have been conducted by a foreign government due to the topics the journalists cover, including national security, economic policy, and China. Following the hack, the passwords on the affected accounts were reset to prevent access. The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers. Microsoft's enterprise security offerings and challenges As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe. One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post. Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used. While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security. Lessons for organizations using Microsoft 365 The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner. Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time.
    • Comments like these are genuinely fascinating to me because they're so far from anything I experience as a daily user of Win 11 since the first public beta. AI stuff? Have it turned off completely, never pops up anywhere. Forced MS account? Yes, they strongly recommend it and kinda push it lately during big updates and such, but it's still not forced. Pop up dialogs when you're not using Edge? Yeah, I vaguely remember seeing some reminders about using Edge a long time ago. I just clicked them away and kept using Vivaldi as usual (but frankly, I'd still much rather use Edge than Chrome - which I'm forced to use at work - I've grown to dislike Google a lot more than Microsoft lately, even if I am still deeply rooted in their ecosystem unfortunately). Awful context menus? A single simple tweak will get you the old context menus. Search in Windows using Bing? People use search in Windows for anything else than to search for local files or apps? Why? I just don't get a lot of the complains people have about Win 11.
    • Nice, but if you change the colour, the folder no longer shows image preview on the actual folder icon.
  • Recent Achievements

    • Explorer
      Legend20 went up a rank
      Explorer
    • One Month Later
      jezzzy earned a badge
      One Month Later
    • First Post
      CSpera earned a badge
      First Post
    • One Month Later
      MIR JOHNNY BLAZE earned a badge
      One Month Later
    • Apprentice
      Wireless wookie went up a rank
      Apprentice
  • Popular Contributors

    1. 1
      +primortal
      618
    2. 2
      ATLien_0
      277
    3. 3
      +FloatingFatMan
      179
    4. 4
      Michael Scrip
      151
    5. 5
      Steven P.
      115
  • Tell a friend

    Love Neowin? Tell a friend!