Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Cannot change user passwords in SBS 2003

19 views
Skip to first unread message

Stako

unread,
Dec 10, 2009, 3:52:25 AM12/10/09
to
Hello,

I cannot change passwords for any domain user in SBS "Active Directory
Users and Computers".

The steps are:

1. Start/Run
2. dsa.msc
3. Go to mydomain.local\MyBusiness\Users\SBSUsers
4. Right click on any user
5. Select "Reset password"
6. I enter the new password and click on OK
7. I get the error:

Active Directory
Windows cannot complete the password change for "username" because: A
device attached to the system is not functioning.

Same thing happens if I go through Server Management\Users.

dcdiag does not give any errors.

I searched google in any way I could think of but I found nothing on
this...

Please note that until now (about 3 years) the server didn't have any
major problems and everything was setup using the SBS wizards.

Any ideas?

kj [SBS MVP]

unread,
Dec 10, 2009, 11:31:42 AM12/10/09
to
A run of the SBS Best Practices Analyzer is on order as well as examination
of the system and directory services event logs. Can the users change their
own password from the workstations.

--
/kj


Stako

unread,
Dec 11, 2009, 8:48:37 AM12/11/09
to
On Dec 10, 6:31 pm, "kj [SBS MVP]" <KevinJ....@SPAMFREE.gmail.com>
wrote:

The Best Practices Analyzer does not give any critical issues except
that "Task Offloading is enabled". But I do not think this is the
problem...

Users cannot change passwords from their computers either.

Stako

unread,
Dec 11, 2009, 8:56:01 AM12/11/09
to

And also there is no relevant error in the event logs. I get some
errors but they are totally irrelevant. 7515 for example which is a
known issue with exchange intelligent message filtering.

kj [SBS MVP]

unread,
Dec 11, 2009, 11:18:41 AM12/11/09
to


So this says that the problem is more than just a dsa.msc and dependancies
problem. Post the exact error a user recieves when attempting a password
change *and* a complete output from;

dcdiag /c /v /e

...and you should disable task offloading as recommended int he BPA. No, I'd
be surprised if it's the culprit here, but it is not helping either.


--
/kj


Stako

unread,
Dec 21, 2009, 3:46:01 AM12/21/09
to
On Dec 11, 6:18 pm, "kj [SBS MVP]" <KevinJ....@SPAMFREE.gmail.com>

Ok, thank you for the reply. The error message when a user tries to
change his password from his computer is:

"Unable to change the password on this account due to the following
error:

31: A device attached to the system is not functioning

Please consult your system administrator."

Something else came up, I also cannot add a new computer to the
domain. The error message is:

"The following error occurred attempting to join the domain:

An internal error occurred"

Τhe following are the results from dcdiag. I did not run all switches
together because I could not capture the output, it was too big for
cmd to show everything. So I run them separately.

--------------------------------------------------------------------------------------------------------
C:\Documents and Settings\Administrator>dcdiag /c

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Connectivity
......................... MAIN passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Replications
......................... MAIN passed test Replications
Starting test: Topology
......................... MAIN passed test Topology
Starting test: CutoffServers
......................... MAIN passed test CutoffServers
Starting test: NCSecDesc
......................... MAIN passed test NCSecDesc
Starting test: NetLogons
......................... MAIN passed test NetLogons
Starting test: Advertising
......................... MAIN passed test Advertising
Starting test: KnowsOfRoleHolders
......................... MAIN passed test KnowsOfRoleHolders
Starting test: RidManager
......................... MAIN passed test RidManager
Starting test: MachineAccount
......................... MAIN passed test MachineAccount
Starting test: Services
IsmServ Service is stopped on [MAIN]
......................... MAIN failed test Services
Starting test: OutboundSecureChannels
** Did not run Outbound Secure Channels test
because /testdomain: was not entered
......................... MAIN passed test
OutboundSecureChannels
Starting test: ObjectsReplicated
......................... MAIN passed test ObjectsReplicated
Starting test: frssysvol
......................... MAIN passed test frssysvol
Starting test: frsevent
......................... MAIN passed test frsevent
Starting test: kccevent
......................... MAIN passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:02
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:44
(Event String could not be retrieved)
......................... MAIN failed test systemlog
Starting test: VerifyReplicas
......................... MAIN passed test VerifyReplicas
Starting test: VerifyReferences
......................... MAIN passed test VerifyReferences
Starting test: VerifyEnterpriseReferences
......................... MAIN passed test
VerifyEnterpriseReferences
Starting test: CheckSecurityError
[MAIN] No security related replication errors were found on
this DC! T
o target the connection to a specific source DC use /ReplSource:<DC>.
......................... MAIN passed test CheckSecurityError

DNS Tests are running and not hung. Please wait a few minutes...

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... ForestDnsZones passed test
CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test
CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom

Running partition tests on : domainSA
Starting test: CrossRefValidation
......................... domainSA passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... domainSA passed test CheckSDRefDom

Running enterprise tests on : domainSA.local
Starting test: Intersite
......................... domainSA.local passed test
Intersite
Starting test: FsmoCheck
......................... domainSA.local passed test
FsmoCheck
Starting test: DNS
......................... domainSA.local passed test DNS
--------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------
C:\Documents and Settings\Administrator>dcdiag /v

Domain Controller Diagnosis

Performing initial setup:
* Verifying that the local machine main, is a DC.
* Connecting to directory service on server main.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... MAIN passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Replications
* Replications Check
* Replication Latency Check
* Replication Site Latency Check
......................... MAIN passed test Replications
Test omitted by user request: Topology
Test omitted by user request: CutoffServers
Starting test: NCSecDesc
* Security Permissions check for all NC's on DC MAIN.
* Security Permissions Check for
DC=ForestDnsZones,DC=domainSA,DC=local
(NDNC,Version 2)
* Security Permissions Check for
DC=DomainDnsZones,DC=domainSA,DC=local
(NDNC,Version 2)
* Security Permissions Check for
CN=Schema,CN=Configuration,DC=domainSA,DC=local
(Schema,Version 2)
* Security Permissions Check for
CN=Configuration,DC=domainSA,DC=local
(Configuration,Version 2)
* Security Permissions Check for
DC=domainSA,DC=local
(Domain,Version 2)
......................... MAIN passed test NCSecDesc
Starting test: NetLogons
* Network Logons Privileges Check
Verified share \\MAIN\netlogon
Verified share \\MAIN\sysvol
......................... MAIN passed test NetLogons
Starting test: Advertising
The DC MAIN is advertising itself as a DC and having a DS.
The DC MAIN is advertising as an LDAP server
The DC MAIN is advertising as having a writeable directory
The DC MAIN is advertising as a Key Distribution Center
The DC MAIN is advertising as a time server
The DS MAIN is advertising as a GC.
......................... MAIN passed test Advertising
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,CN=Default-Firs
t-Site-Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local
Role Domain Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,CN=Default-Firs
t-Site-Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local
Role PDC Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,CN=Default-First-S
ite-Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local
Role Rid Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,CN=Default-First-S
ite-Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local
Role Infrastructure Update Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,
CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local
......................... MAIN passed test KnowsOfRoleHolders
Starting test: RidManager
* Available RID Pool for the Domain is 2110 to 1073741823
* main.domainSA.local is the RID Master
* DsBind with RID Master was successful
* rIDAllocationPool is 1610 to 2109
* rIDPreviousAllocationPool is 1110 to 1609
* rIDNextRID: 1537
* Warning :There is less than 15% available RIDs in the
current pool
......................... MAIN passed test RidManager
Starting test: MachineAccount
Checking machine account for DC MAIN on DC MAIN.
* SPN found :LDAP/main.domainSA.local/domainSA.local
* SPN found :LDAP/main.domainSA.local
* SPN found :LDAP/MAIN
* SPN found :LDAP/main.domainSA.local/domainSA
* SPN found :LDAP/
593e4473-01e0-4b1d-8bb7-1bdf95904ea7._msdcs.domainSA
.local
* SPN found :E3514235-4B06-11D1-
AB04-00C04FC2DCD2/593e4473-01e0-4b1d-8b
b7-1bdf95904ea7/domainSA.local
* SPN found :HOST/main.domainSA.local/domainSA.local
* SPN found :HOST/main.domainSA.local
* SPN found :HOST/MAIN
* SPN found :HOST/main.domainSA.local/domainSA
* SPN found :GC/main.domainSA.local/domainSA.local
......................... MAIN passed test MachineAccount
Starting test: Services
* Checking Service: Dnscache
* Checking Service: NtFrs
* Checking Service: IsmServ
IsmServ Service is stopped on [MAIN]
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: RpcSs
* Checking Service: w32time
* Checking Service: NETLOGON
......................... MAIN failed test Services
Test omitted by user request: OutboundSecureChannels
Starting test: ObjectsReplicated
MAIN is in domain DC=domainSA,DC=local
Checking for CN=MAIN,OU=Domain
Controllers,DC=domainSA,DC=local in dom
ain DC=domainSA,DC=local on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=MAIN,CN=Servers,CN=Default-
First-Site-
Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local in domain
CN=Configuration,
DC=domainSA,DC=local on 1 servers
Object is up-to-date on all servers.
......................... MAIN passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... MAIN passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
......................... MAIN passed test frsevent
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the
last 15 minut
es.
......................... MAIN passed test kccevent
Starting test: systemlog
* The System Event log test
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:02
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:44
(Event String could not be retrieved)
......................... MAIN failed test systemlog
Test omitted by user request: VerifyReplicas
Starting test: VerifyReferences
The system object reference (serverReference)
CN=MAIN,OU=Domain Controllers,DC=domainSA,DC=local and
backlink on
CN=MAIN,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration
,DC=domainSA,DC=local
are correct.
The system object reference (frsComputerReferenceBL)
CN=MAIN,CN=Domain System Volume (SYSVOL share),CN=File
Replication Serv
ice,CN=System,DC=domainSA,DC=local
and backlink on CN=MAIN,OU=Domain
Controllers,DC=domainSA,DC=local
are correct.
The system object reference (serverReferenceBL)
CN=MAIN,CN=Domain System Volume (SYSVOL share),CN=File
Replication Serv
ice,CN=System,DC=domainSA,DC=local
and backlink on
CN=NTDS Settings,CN=MAIN,CN=Servers,CN=Default-First-Site-
Name,CN=Sites
,CN=Configuration,DC=domainSA,DC=local
are correct.
......................... MAIN passed test VerifyReferences
Test omitted by user request: VerifyEnterpriseReferences
Test omitted by user request: CheckSecurityError

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... ForestDnsZones passed test
CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test
CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom

Running partition tests on : domainSA
Starting test: CrossRefValidation
......................... domainSA passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... domainSA passed test CheckSDRefDom

Running enterprise tests on : domainSA.local
Starting test: Intersite
Skipping site Default-First-Site-Name, this site is outside
the scope
provided by the command line arguments provided.
......................... domainSA.local passed test
Intersite
Starting test: FsmoCheck
GC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
PDC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
Time Server Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
Preferred Time Server Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
KDC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
......................... domainSA.local passed test
FsmoCheck
Test omitted by user request: DNS
Test omitted by user request: DNS
--------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------
C:\Documents and Settings\Administrator>dcdiag /e

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Connectivity
......................... MAIN passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Replications
......................... MAIN passed test Replications
Starting test: NCSecDesc
......................... MAIN passed test NCSecDesc
Starting test: NetLogons
......................... MAIN passed test NetLogons
Starting test: Advertising
......................... MAIN passed test Advertising
Starting test: KnowsOfRoleHolders
......................... MAIN passed test KnowsOfRoleHolders
Starting test: RidManager
......................... MAIN passed test RidManager
Starting test: MachineAccount
......................... MAIN passed test MachineAccount
Starting test: Services
IsmServ Service is stopped on [MAIN]
......................... MAIN failed test Services
Starting test: ObjectsReplicated
......................... MAIN passed test ObjectsReplicated
Starting test: frssysvol
......................... MAIN passed test frssysvol
Starting test: frsevent
......................... MAIN passed test frsevent
Starting test: kccevent
......................... MAIN passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 12/21/2009 09:41:30
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:02
(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719
Time Generated: 12/21/2009 09:50:44
(Event String could not be retrieved)
......................... MAIN failed test systemlog
Starting test: VerifyReferences
......................... MAIN passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
......................... ForestDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... ForestDnsZones passed test
CheckSDRefDom

Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
......................... DomainDnsZones passed test
CrossRefValidation

Starting test: CheckSDRefDom
......................... DomainDnsZones passed test
CheckSDRefDom

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test
CheckSDRefDom

Running partition tests on : domainSA
Starting test: CrossRefValidation
......................... domainSA passed test
CrossRefValidation
Starting test: CheckSDRefDom
......................... domainSA passed test CheckSDRefDom

Running enterprise tests on : domainSA.local
Starting test: Intersite
......................... domainSA.local passed test
Intersite
Starting test: FsmoCheck
......................... domainSA.local passed test
FsmoCheck
--------------------------------------------------------------------------------------------------------

kj [SBS MVP]

unread,
Dec 21, 2009, 11:51:45 AM12/21/09
to
> ?he following are the results from dcdiag. I did not run all switches

> together because I could not capture the output, it was too big for
> cmd to show everything. So I run them separately.

you can use dcdiag /c /v /e >dcdiag.log

to redirect the output, then locate failures and errors.

It would appear that your AD database has issues perhaps with the log files.
Was any sort of a restore operation attempted, and if so, elaborate on how
this was performed and why please.

--
/kj


Message has been deleted

Stako

unread,
Dec 22, 2009, 2:37:33 AM12/22/09
to
Do you mean some kind of restore of the AD?

In any case, no restore of the AD was attempted. Also no restore of
any files was attempted.

The only thing I restored about two months ago was a single email
message to test if Backup Exec was working ok. But apart from that
nothing...

Stako

unread,
Dec 22, 2009, 3:36:42 AM12/22/09
to
And here is the full dcdiag results (using dcdiag /c /v /e
>dcdiag.log)...:

--------------------------------------------------------------------------------------------
Domain Controller Diagnosis

Performing initial setup:
* Verifying that the local machine main, is a DC.
* Connecting to directory service on server main.
* Collecting site info.
* Identifying all servers.
* Identifying all NC cross-refs.
* Found 1 DC(s). Testing 1 of them.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Connectivity
* Active Directory LDAP Services Check
* Active Directory RPC Services Check
......................... MAIN passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\MAIN
Starting test: Replications
* Replications Check
* Replication Latency Check
* Replication Site Latency Check
......................... MAIN passed test Replications

Starting test: Topology
* Configuration Topology Integrity Check
* Analyzing the connection topology for
DC=ForestDnsZones,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for
DC=DomainDnsZones,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for
CN=Schema,CN=Configuration,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for
CN=Configuration,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the connection topology for DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.


......................... MAIN passed test Topology
Starting test: CutoffServers

* Configuration Topology Aliveness Check
* Analyzing the alive system replication topology for
DC=ForestDnsZones,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for
DC=DomainDnsZones,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for
CN=Schema,CN=Configuration,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for
CN=Configuration,DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.
* Analyzing the alive system replication topology for
DC=domainSA,DC=local.
* Performing upstream (of target) analysis.
* Performing downstream (of target) analysis.


......................... MAIN passed test CutoffServers
Starting test: NCSecDesc

Role Infrastructure Update Owner = CN=NTDS
Settings,CN=MAIN,CN=Servers,CN=Default-First-Site-

Starting test: OutboundSecureChannels
* The Outbound Secure Channels test


** Did not run Outbound Secure Channels test
because /testdomain: was not entered
......................... MAIN passed test
OutboundSecureChannels
Starting test: ObjectsReplicated

MAIN is in domain DC=domainSA,DC=local
Checking for CN=MAIN,OU=Domain

Controllers,DC=domainSA,DC=local in domain DC=domainSA,DC=local on 1


servers
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=MAIN,CN=Servers,CN=Default-
First-Site-Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local in

domain CN=Configuration,DC=domainSA,DC=local on 1 servers


Object is up-to-date on all servers.
......................... MAIN passed test ObjectsReplicated
Starting test: frssysvol
* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... MAIN passed test frssysvol
Starting test: frsevent
* The File Replication Service Event log test
......................... MAIN passed test frsevent
Starting test: kccevent
* The KCC Event log test
Found no KCC errors in Directory Service Event log in the
last 15 minutes.
......................... MAIN passed test kccevent
Starting test: systemlog
* The System Event log test

An Error Event occured. EventID: 0xC0002719
Time Generated: 12/22/2009 09:32:57


(Event String could not be retrieved)
An Error Event occured. EventID: 0xC0002719

Time Generated: 12/22/2009 09:33:39


(Event String could not be retrieved)
......................... MAIN failed test systemlog
Starting test: VerifyReplicas
......................... MAIN passed test VerifyReplicas
Starting test: VerifyReferences

The system object reference (serverReference)

CN=MAIN,OU=Domain Controllers,DC=domainSA,DC=local and
backlink on

CN=MAIN,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local

are correct.
The system object reference (frsComputerReferenceBL)

CN=MAIN,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domainSA,DC=local

and backlink on CN=MAIN,OU=Domain
Controllers,DC=domainSA,DC=local

are correct.
The system object reference (serverReferenceBL)

CN=MAIN,CN=Domain System Volume (SYSVOL share),CN=File
Replication Service,CN=System,DC=domainSA,DC=local

and backlink on

CN=NTDS Settings,CN=MAIN,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=domainSA,DC=local

are correct.
......................... MAIN passed test VerifyReferences

Starting test: VerifyEnterpriseReferences
......................... MAIN passed test
VerifyEnterpriseReferences
Starting test: CheckSecurityError

* Dr Auth: Beginning security errors check!
Found KDC MAIN for domain domainSA.local in site Default-
First-Site-Name


Checking machine account for DC MAIN on DC MAIN.
* SPN found :LDAP/main.domainSA.local/domainSA.local
* SPN found :LDAP/main.domainSA.local
* SPN found :LDAP/MAIN
* SPN found :LDAP/main.domainSA.local/domainSA
* SPN found :LDAP/
593e4473-01e0-4b1d-8bb7-1bdf95904ea7._msdcs.domainSA.local
* SPN found :E3514235-4B06-11D1-
AB04-00C04FC2DCD2/593e4473-01e0-4b1d-8bb7-1bdf95904ea7/domainSA.local
* SPN found :HOST/main.domainSA.local/domainSA.local
* SPN found :HOST/main.domainSA.local
* SPN found :HOST/MAIN
* SPN found :HOST/main.domainSA.local/domainSA
* SPN found :GC/main.domainSA.local/domainSA.local

[MAIN] No security related replication errors were found on

this DC! To target the connection to a specific source DC use /

Skipping site Default-First-Site-Name, this site is outside
the scope

provided by the command line arguments provided.
......................... domainSA.local passed test
Intersite
Starting test: FsmoCheck
GC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
PDC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
Time Server Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
Preferred Time Server Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
KDC Name: \\main.domainSA.local
Locator Flags: 0xe00001fd
......................... domainSA.local passed test
FsmoCheck

Starting test: DNS
Test results for domain controllers:

DC: main.domainSA.local
Domain: domainSA.local


TEST: Authentication (Auth)
Authentication test: Successfully completed

TEST: Basic (Basc)
Microsoft(R) Windows(R) Server 2003 for Small
Business Server (Service Pack level: 2.0) is supported
NETLOGON service is running
kdc service is running
DNSCACHE service is running
DNS service is running
DC is a DNS server
Network adapters information:
Adapter [00000008] Realtek RTL8169/8110 Family
Gigabit Ethernet NIC:
MAC address is 00:1D:60:3F:CE:19
IP address is static
IP address: 192.168.16.2
DNS servers:
192.168.16.2 (main.domainsa.local.) [Valid]
Adapter [00000009] Marvell Yukon 88E8056 PCI-E
Gigabit Ethernet Controller:
MAC address is 00:1D:60:3F:D9:0A
IP address is static
IP address: 192.168.10.187
DNS servers:
192.168.16.2 (main.domainsa.local.) [Valid]
The A record for this DC was found
The SOA record for the Active Directory zone was
found
The Active Directory zone on this DC/DNS server was
found (primary)
Root zone on this DC/DNS server was not found

TEST: Forwarders/Root hints (Forw)
Recursion is enabled
Forwarders Information:
195.170.0.1 (<name unavailable>) [Valid]
195.170.2.2 (<name unavailable>) [Valid]

TEST: Delegations (Del)
Delegation information for the zone: domainSA.local.
Delegated domain name: _msdcs.domainSA.local.
DNS server: main.domainsa.local. IP:
192.168.16.2 [Valid]

TEST: Dynamic update (Dyn)
Dynamic update is enabled on the zone
domainSA.local.
Test record _dcdiag_test_record added successfully
in zone domainSA.local.
Test record _dcdiag_test_record deleted successfully
in zone domainSA.local.

TEST: Records registration (RReg)
Network Adapter [00000008] Realtek RTL8169/8110
Family Gigabit Ethernet NIC:
Matching A record found at DNS server
192.168.16.2:
main.domainSA.local

Matching CNAME record found at DNS server
192.168.16.2:

593e4473-01e0-4b1d-8bb7-1bdf95904ea7._msdcs.domainSA.local

Matching DC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.dc._msdcs.domainSA.local

Matching GC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.gc._msdcs.domainSA.local

Matching PDC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.pdc._msdcs.domainSA.local

Network Adapter [00000009] Marvell Yukon 88E8056 PCI-
E Gigabit Ethernet Controller:
Matching A record found at DNS server
192.168.16.2:
main.domainSA.local

Matching CNAME record found at DNS server
192.168.16.2:

593e4473-01e0-4b1d-8bb7-1bdf95904ea7._msdcs.domainSA.local

Matching DC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.dc._msdcs.domainSA.local

Matching GC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.gc._msdcs.domainSA.local

Matching PDC SRV record found at DNS server
192.168.16.2:
_ldap._tcp.pdc._msdcs.domainSA.local


Summary of test results for DNS servers used by the above
domain controllers:

DNS server: 192.168.16.2 (main.domainsa.local.)
All tests passed on this DNS server
This is a valid DNS server.
Name resolution is funtional. _ldap._tcp SRV record for
the forest root domain is registered
Delegation to the domain _msdcs.domainSA.local. is
operational

DNS server: 195.170.0.1 (<name unavailable>)
All tests passed on this DNS server
This is a valid DNS server.

DNS server: 195.170.2.2 (<name unavailable>)
All tests passed on this DNS server
This is a valid DNS server.

Summary of DNS test results:

Auth Basc Forw Del Dyn
RReg Ext

________________________________________________________________
Domain: domainSA.local
main PASS PASS PASS PASS PASS
PASS n/a

Stako

unread,
Dec 22, 2009, 8:50:29 AM12/22/09
to
After a reboot I got these errors in Directory Service Event Viewer:

-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: NTDS ISAM
Event Category: Database Page Cache
Event ID: 475
Date: 22/12/2009
Time: 1:23:23 μμ
User: N/A
Computer: MAIN
Description:
NTDS (496) NTDSA: The database page read from the file "C:\WINDOWS\NTDS
\ntds.dit" at offset 688128 (0x00000000000a8000) for 8192 (0x00002000)
bytes failed verification due to a page number mismatch. The expected
page number was 83 (0x00000053) and the actual page number was 406
(0x00000196). The read operation will fail with error -1018
(0xfffffc06). If this condition persists then please restore the
database from a previous backup. This problem is likely due to faulty
hardware. Please contact your hardware vendor for further assistance
diagnosing the problem.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: NTDS General
Event Category: DS Schema
Event ID: 1207
Date: 22/12/2009
Time: 1:23:23 μμ
User: N/A
Computer: MAIN
Description:
Internal event: An internal asynchronous attempt to update the schema
cache failed with an error.

Active Directory will automatically retry the operation after 5
minutes. The following number of retries will be attempted.

Retries:
4
Current update attempt:
1

Additional Data
Error value:
e0010004

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: NTDS ISAM
Event Category: Database Page Cache
Event ID: 475
Date: 22/12/2009
Time: 1:25:22 μμ
User: N/A
Computer: MAIN
Description:
NTDS (496) NTDSA: The database page read from the file "C:\WINDOWS\NTDS
\ntds.dit" at offset 11460608 (0x0000000000aee000) for 8192
(0x00002000) bytes failed verification due to a page number mismatch.
The expected page number was 1398 (0x00000576) and the actual page
number was 1530 (0x000005fa). The read operation will fail with error
-1018 (0xfffffc06). If this condition persists then please restore
the database from a previous backup. This problem is likely due to
faulty hardware. Please contact your hardware vendor for further
assistance diagnosing the problem.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------------


-------------------------------------------------------------------------------------------
Event Type: Error
Event Source: NTDS General
Event Category: DS Schema
Event ID: 1207
Date: 22/12/2009
Time: 1:28:23 μμ
User: N/A
Computer: MAIN
Description:
Internal event: An internal asynchronous attempt to update the schema
cache failed with an error.

Active Directory will automatically retry the operation after 5
minutes. The following number of retries will be attempted.

Retries:
4
Current update attempt:
2

Additional Data
Error value:
e0010004

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------------------------------------------------------

So I guess that since ntds.dit is the database for AD this is what I
was looking for...

The backup is a few days old, if I restore this DB from a backup,
exactly what will it replace?

Stako

unread,
Dec 22, 2009, 11:21:27 AM12/22/09
to
Ok, removed one drive from the RAID1 array and the errors about
ntds.dit did not appear again. So this is not the issue.....

kj [SBS MVP]

unread,
Dec 22, 2009, 11:52:47 AM12/22/09
to
Stako wrote:
> Ok, removed one drive from the RAID1 array and the errors about
> ntds.dit did not appear again. So this is not the issue.....

I'm not following that logic. It seems, at least with your original RAID
configuration, that you have a AD database integrity problem. If it isn't
presented in with the second drive and you are able to make AD
modifications, then an AD backup and RAID repair would seem to be indicated.

If your AD still has integrity issues then a restore would be indicated.
What data might be lost would be the difference between now and the backup
time, assuming that AD had made some changes along the way.

--
/kj


Stako

unread,
Dec 23, 2009, 9:01:46 AM12/23/09
to
I removed the second RAID disk so that I could image it and then
convert the image to a VMWare VM. Also I saw some indications in the
'net that it could also be a hardware problem (the ntds.dit errors).
Anyway, after booting with one hdd the errors went away. Could have
been related but I think it was by chance.

Anyway, I created the vmware VM, used that to do a test restoring the
System State (AD etc), this went well, it succeded without errors and
all problems were fixed, I could change user passwords, add new users
etc. So then I did the same to the live SBS machine and all problems
were fixed! :)

The backup was a few days back but that wasn't a problem.

Some minor issues came up in the event log after the AD restore but
nothing serious, fixed those in 1-2 hours.

So thanks for the advise to restore AD from the backup. It was indeed
a problem with AD.

kj [SBS MVP]

unread,
Dec 23, 2009, 10:18:42 AM12/23/09
to

Pleased that you ultimately got to a good working state and thanks for
posting back.

--
/kj


0 new messages