After going thru stages (FRS to DFS-R) reaching stable Eliminated - now seeing Eliminating, last 4 -5 days?

Domain consisted of DC's running Server 2003, which were upgraded to Server
2003 R2. I then upgraded member server to Server 2008, just to test
compatiblity. Eventually decided to bring Domain and Forest to Server 2008,
allowing full use/observation of new 2008 features.

Once all servers were at 2008 (yes, ADprep - both forest and Domain were
run). last step was to move from Sysvol to DFS-r replication. Took each step
seriously, waited until each completed, then used tools to confirm each
stage was stable before moving to next. After a couple of days, we
progressed to state "eliminated" to clean up the last vestiges of Sysvol.

Everything seemed to be stable. Can't figure out why it keeps reporting
"Eliminating"? Replication is working.

It appears to be a permissions problem: I have checked firewall (both DC).
anyone have experience with this error? Nest troubleshooting step?

......................... ZSRV passed test Advertising
Starting test: FrsEvent
......................... ZSRV passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after
the
SYSVOL has been shared. Failing SYSVOL replication problems may
cause
Group Policy problems.
......................... ZSRV failed test DFSREvent
Starting test: SysVolCheck
......................... ZSRV passed test SysVolCheck
Starting test: KccEvent
......................... ZSRV passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... ZSRV passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... ZSRV passed test MachineAccount
Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=zen-ad,DC=local
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=zen-ad,DC=local
......................... ZSRV failed test NCSecDesc
Starting test: NetLogons
[ZSRV] User credentials does not have permission to perform this
operation.
The account used for this test must have network logon privileges
for this machine's domain.
......................... ZSRV failed test NetLogons
Starting test: ObjectsReplicated
......................... ZSRV passed test ObjectsReplicated
Starting test: Replications
......................... ZSRV passed test Replications

Hello

Why did you have to move sysvol to dfsr..I can seem to understand that
part..How many DCs do you have in your network> are all of them having same
issue ror just one?

"Beoweolf .com>" <beoweolf@<spamalot> wrote in message
news:F2621A98-0FC8-481E-903E-...
> Domain consisted of DC's running Server 2003, which were upgraded to
> Server 2003 R2. I then upgraded member server to Server 2008, just to test
> compatiblity. Eventually decided to bring Domain and Forest to Server
> 2008, allowing full use/observation of new 2008 features.
>
> Once all servers were at 2008 (yes, ADprep - both forest and Domain were
> run). last step was to move from Sysvol to DFS-r replication. Took each
> step seriously, waited until each completed, then used tools to confirm
> each stage was stable before moving to next. After a couple of days, we
> progressed to state "eliminated" to clean up the last vestiges of Sysvol.
>
> Everything seemed to be stable. Can't figure out why it keeps reporting
> "Eliminating"? Replication is working.
>
> It appears to be a permissions problem: I have checked firewall (both DC).
> anyone have experience with this error? Nest troubleshooting step?
>
> ......................... ZSRV passed test Advertising
> Starting test: FrsEvent
> ......................... ZSRV passed test FrsEvent
> Starting test: DFSREvent
> There are warning or error events within the last 24 hours after
> the
> SYSVOL has been shared. Failing SYSVOL replication problems may
> cause
> Group Policy problems.
> ......................... ZSRV failed test DFSREvent
> Starting test: SysVolCheck
> ......................... ZSRV passed test SysVolCheck
> Starting test: KccEvent
> ......................... ZSRV passed test KccEvent
> Starting test: KnowsOfRoleHolders
> ......................... ZSRV passed test KnowsOfRoleHolders
> Starting test: MachineAccount
> ......................... ZSRV passed test MachineAccount
> Starting test: NCSecDesc
> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
> Replicating Directory Changes In Filtered Set
> access rights for the naming context:
> DC=DomainDnsZones,DC=zen-ad,DC=local
> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
> Replicating Directory Changes In Filtered Set
> access rights for the naming context:
> DC=ForestDnsZones,DC=zen-ad,DC=local
> ......................... ZSRV failed test NCSecDesc
> Starting test: NetLogons
> [ZSRV] User credentials does not have permission to perform this
> operation.
> The account used for this test must have network logon privileges
> for this machine's domain.
> ......................... ZSRV failed test NetLogons
> Starting test: ObjectsReplicated
> ......................... ZSRV passed test ObjectsReplicated
> Starting test: Replications
> ......................... ZSRV passed test Replications

Replication is taking place, that has been confirmed by Repadmin, in both
directions. The status of DFSR migration is in a state that does not match
any of the expected states (start, prepared, redirected ,eliminated). As it
progressed through each state, it was confirmed, allowed to stabilize,
before continuing to the next step. Once at the final step; the move to
Eliminated was delayed overnight and confirmed after a re-boot/re-start. So,
I had expected everything to have completed successfully (which was reported
/ confirmed) by the program before initiating the final stage. The next time
it was check, another follow-up. The status had changed to what is listed
below:

************************************************** ********************

" The following Domain Controllers are not in sync with Global state
('Eliminated'):
Domain Controller (Local Migration State) - DC Type
================================================== =

ZSRV1 ('Eliminating') - Primary DC
ZSRV ('Eliminating') - Writable DC

Migration has not yet reached a consistent state on all Domain Controllers.
State information might be stale due to AD latency. "

************************************************** ********************

As mentioned; I didn't need to change to DFS. DFS is a feature of 2008
server forest function level, the basis of building this network is to test
the features of an Upgraded server 2008 network. In the attached DC diag
partial listing it shows 2 DC's - the errors in the list are the problem

************************************************** ********************
" Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=zen-ad,DC=local
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=zen-ad,DC=local
......................... ZSRV failed test NCSecDesc "
************************************************** ********************

The message following seems to indicate a permission problem (not sure if
its complaining about the ID used to invoke the test or the ID service ID
used to logon to the server).

************************************************** ********************
" [ZSRV] User credentials does not have permission to perform this
operation.
The account used for this test must have network logon privileges
for this machine's domain. "
************************************************** *********************

"Isaac Oben [MCITP:EA, MCSE]" <> wrote in message
news:%...
> Hello
>
> Why did you have to move sysvol to dfsr..I can seem to understand that
> part..How many DCs do you have in your network> are all of them having
> same issue ror just one?
>
> "Beoweolf .com>" <beoweolf@<spamalot> wrote in message
> news:F2621A98-0FC8-481E-903E-...
>> Domain consisted of DC's running Server 2003, which were upgraded to
>> Server 2003 R2. I then upgraded member server to Server 2008, just to
>> test compatiblity. Eventually decided to bring Domain and Forest to
>> Server 2008, allowing full use/observation of new 2008 features.
>>
>> Once all servers were at 2008 (yes, ADprep - both forest and Domain were
>> run). last step was to move from Sysvol to DFS-r replication. Took each
>> step seriously, waited until each completed, then used tools to confirm
>> each stage was stable before moving to next. After a couple of days, we
>> progressed to state "eliminated" to clean up the last vestiges of Sysvol.
>>
>> Everything seemed to be stable. Can't figure out why it keeps reporting
>> "Eliminating"? Replication is working.
>>
>> It appears to be a permissions problem: I have checked firewall (both
>> DC). anyone have experience with this error? Nest troubleshooting step?
>>
>> ......................... ZSRV passed test Advertising
>> Starting test: FrsEvent
>> ......................... ZSRV passed test FrsEvent
>> Starting test: DFSREvent
>> There are warning or error events within the last 24 hours after
>> the
>> SYSVOL has been shared. Failing SYSVOL replication problems may
>> cause
>> Group Policy problems.
>> ......................... ZSRV failed test DFSREvent
>> Starting test: SysVolCheck
>> ......................... ZSRV passed test SysVolCheck
>> Starting test: KccEvent
>> ......................... ZSRV passed test KccEvent
>> Starting test: KnowsOfRoleHolders
>> ......................... ZSRV passed test KnowsOfRoleHolders
>> Starting test: MachineAccount
>> ......................... ZSRV passed test MachineAccount
>> Starting test: NCSecDesc
>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>> Replicating Directory Changes In Filtered Set
>> access rights for the naming context:
>> DC=DomainDnsZones,DC=zen-ad,DC=local
>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>> Replicating Directory Changes In Filtered Set
>> access rights for the naming context:
>> DC=ForestDnsZones,DC=zen-ad,DC=local
>> ......................... ZSRV failed test NCSecDesc
>> Starting test: NetLogons
>> [ZSRV] User credentials does not have permission to perform this
>> operation.
>> The account used for this test must have network logon privileges
>> for this machine's domain.
>> ......................... ZSRV failed test NetLogons
>> Starting test: ObjectsReplicated
>> ......................... ZSRV passed test ObjectsReplicated
>> Starting test: Replications
>> ......................... ZSRV passed test Replications
>
>

As far as I understand, the error mesage you are referring to indicates that
you haven't run adprep /rodcprep in your domain(s). However, I'm not sure to
what extent this is related to the issue you are experiencing.
Have you tried recommendations listed in
http://technet.microsoft.com/en-us/l...dAtEliminating

hth
Marcin

"Beoweolf .com>" <beoweolf@<spamalot> wrote in message
news:76246BDE-A3C0-4BDF-BDAC-...
> Replication is taking place, that has been confirmed by Repadmin, in both
> directions. The status of DFSR migration is in a state that does not match
> any of the expected states (start, prepared, redirected ,eliminated). As
> it progressed through each state, it was confirmed, allowed to stabilize,
> before continuing to the next step. Once at the final step; the move to
> Eliminated was delayed overnight and confirmed after a re-boot/re-start.
> So, I had expected everything to have completed successfully (which was
> reported / confirmed) by the program before initiating the final stage.
> The next time it was check, another follow-up. The status had changed to
> what is listed below:
>
> ************************************************** ********************
>
> " The following Domain Controllers are not in sync with Global state
> ('Eliminated'):
> Domain Controller (Local Migration State) - DC Type
> ================================================== =
>
> ZSRV1 ('Eliminating') - Primary DC
> ZSRV ('Eliminating') - Writable DC
>
> Migration has not yet reached a consistent state on all Domain
> Controllers.
> State information might be stale due to AD latency. "
>
> ************************************************** ********************
>
> As mentioned; I didn't need to change to DFS. DFS is a feature of 2008
> server forest function level, the basis of building this network is to
> test the features of an Upgraded server 2008 network. In the attached DC
> diag partial listing it shows 2 DC's - the errors in the list are the
> problem
>
> ************************************************** ********************
> " Starting test: NCSecDesc
> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
> Replicating Directory Changes In Filtered Set
> access rights for the naming context:
> DC=DomainDnsZones,DC=zen-ad,DC=local
> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
> Replicating Directory Changes In Filtered Set
> access rights for the naming context:
> DC=ForestDnsZones,DC=zen-ad,DC=local
> ......................... ZSRV failed test NCSecDesc "
> ************************************************** ********************
>
> The message following seems to indicate a permission problem (not sure if
> its complaining about the ID used to invoke the test or the ID service ID
> used to logon to the server).
>
> ************************************************** ********************
> " [ZSRV] User credentials does not have permission to perform this
> operation.
> The account used for this test must have network logon privileges
> for this machine's domain. "
> ************************************************** *********************
>
> "Isaac Oben [MCITP:EA, MCSE]" <> wrote in
> message news:%...
>> Hello
>>
>> Why did you have to move sysvol to dfsr..I can seem to understand that
>> part..How many DCs do you have in your network> are all of them having
>> same issue ror just one?
>>
>> "Beoweolf .com>" <beoweolf@<spamalot> wrote in message
>> news:F2621A98-0FC8-481E-903E-...
>>> Domain consisted of DC's running Server 2003, which were upgraded to
>>> Server 2003 R2. I then upgraded member server to Server 2008, just to
>>> test compatiblity. Eventually decided to bring Domain and Forest to
>>> Server 2008, allowing full use/observation of new 2008 features.
>>>
>>> Once all servers were at 2008 (yes, ADprep - both forest and Domain were
>>> run). last step was to move from Sysvol to DFS-r replication. Took each
>>> step seriously, waited until each completed, then used tools to confirm
>>> each stage was stable before moving to next. After a couple of days, we
>>> progressed to state "eliminated" to clean up the last vestiges of
>>> Sysvol.
>>>
>>> Everything seemed to be stable. Can't figure out why it keeps reporting
>>> "Eliminating"? Replication is working.
>>>
>>> It appears to be a permissions problem: I have checked firewall (both
>>> DC). anyone have experience with this error? Nest troubleshooting step?
>>>
>>> ......................... ZSRV passed test Advertising
>>> Starting test: FrsEvent
>>> ......................... ZSRV passed test FrsEvent
>>> Starting test: DFSREvent
>>> There are warning or error events within the last 24 hours after
>>> the
>>> SYSVOL has been shared. Failing SYSVOL replication problems may
>>> cause
>>> Group Policy problems.
>>> ......................... ZSRV failed test DFSREvent
>>> Starting test: SysVolCheck
>>> ......................... ZSRV passed test SysVolCheck
>>> Starting test: KccEvent
>>> ......................... ZSRV passed test KccEvent
>>> Starting test: KnowsOfRoleHolders
>>> ......................... ZSRV passed test KnowsOfRoleHolders
>>> Starting test: MachineAccount
>>> ......................... ZSRV passed test MachineAccount
>>> Starting test: NCSecDesc
>>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>>> Replicating Directory Changes In Filtered Set
>>> access rights for the naming context:
>>> DC=DomainDnsZones,DC=zen-ad,DC=local
>>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>>> Replicating Directory Changes In Filtered Set
>>> access rights for the naming context:
>>> DC=ForestDnsZones,DC=zen-ad,DC=local
>>> ......................... ZSRV failed test NCSecDesc
>>> Starting test: NetLogons
>>> [ZSRV] User credentials does not have permission to perform this
>>> operation.
>>> The account used for this test must have network logon
>>> privileges
>>> for this machine's domain.
>>> ......................... ZSRV failed test NetLogons
>>> Starting test: ObjectsReplicated
>>> ......................... ZSRV passed test ObjectsReplicated
>>> Starting test: Replications
>>> ......................... ZSRV passed test Replications
>>
>>
>

Yes, that was tried during the first couple of days. except for manually
removing any files/folders. was holding the drastic actions until I
exhausted other possibilities. No need for premature actions, at least
wanted to consult with peers first.

As far as the possibility of Not running adprep I have no idea where that is
even possible, the system would be spitting out a lot more errors, if it was
replicating at all. Besides, there are no RODC's on the network, so that
seems not a likely consideration either way.

Looks like I am either going to wait it out, see if it self corrects or
learn to live with the error messages. I hate when that happens!

My traditional response to lingering, chronic error messages on an active
system considers it as a sign of a lazy administrator or worse - probable
incompetence. So this is not something which gives me a "warm 'n fuzzy"
feeling.



"Marcin" <> wrote in message
news:...
> As far as I understand, the error mesage you are referring to indicates
> that you haven't run adprep /rodcprep in your domain(s). However, I'm not
> sure to what extent this is related to the issue you are experiencing.
> Have you tried recommendations listed in
> http://technet.microsoft.com/en-us/l...dAtEliminating
>
> hth
> Marcin
>
> "Beoweolf .com>" <beoweolf@<spamalot> wrote in message
> news:76246BDE-A3C0-4BDF-BDAC-...
>> Replication is taking place, that has been confirmed by Repadmin, in both
>> directions. The status of DFSR migration is in a state that does not
>> match any of the expected states (start, prepared, redirected
>> ,eliminated). As it progressed through each state, it was confirmed,
>> allowed to stabilize, before continuing to the next step. Once at the
>> final step; the move to Eliminated was delayed overnight and confirmed
>> after a re-boot/re-start. So, I had expected everything to have completed
>> successfully (which was reported / confirmed) by the program before
>> initiating the final stage. The next time it was check, another
>> follow-up. The status had changed to what is listed below:
>>
>> ************************************************** ********************
>>
>> " The following Domain Controllers are not in sync with Global state
>> ('Eliminated'):
>> Domain Controller (Local Migration State) - DC Type
>> ================================================== =
>>
>> ZSRV1 ('Eliminating') - Primary DC
>> ZSRV ('Eliminating') - Writable DC
>>
>> Migration has not yet reached a consistent state on all Domain
>> Controllers.
>> State information might be stale due to AD latency. "
>>
>> ************************************************** ********************
>>
>> As mentioned; I didn't need to change to DFS. DFS is a feature of 2008
>> server forest function level, the basis of building this network is to
>> test the features of an Upgraded server 2008 network. In the attached DC
>> diag partial listing it shows 2 DC's - the errors in the list are the
>> problem
>>
>> ************************************************** ********************
>> " Starting test: NCSecDesc
>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>> Replicating Directory Changes In Filtered Set
>> access rights for the naming context:
>> DC=DomainDnsZones,DC=zen-ad,DC=local
>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>> Replicating Directory Changes In Filtered Set
>> access rights for the naming context:
>> DC=ForestDnsZones,DC=zen-ad,DC=local
>> ......................... ZSRV failed test NCSecDesc "
>> ************************************************** ********************
>>
>> The message following seems to indicate a permission problem (not sure if
>> its complaining about the ID used to invoke the test or the ID service ID
>> used to logon to the server).
>>
>> ************************************************** ********************
>> " [ZSRV] User credentials does not have permission to perform this
>> operation.
>> The account used for this test must have network logon privileges
>> for this machine's domain. "
>> ************************************************** *********************
>>
>> "Isaac Oben [MCITP:EA, MCSE]" <> wrote in
>> message news:%...
>>> Hello
>>>
>>> Why did you have to move sysvol to dfsr..I can seem to understand that
>>> part..How many DCs do you have in your network> are all of them having
>>> same issue ror just one?
>>>
>>> "Beoweolf .com>" <beoweolf@<spamalot> wrote in message
>>> news:F2621A98-0FC8-481E-903E-...
>>>> Domain consisted of DC's running Server 2003, which were upgraded to
>>>> Server 2003 R2. I then upgraded member server to Server 2008, just to
>>>> test compatiblity. Eventually decided to bring Domain and Forest to
>>>> Server 2008, allowing full use/observation of new 2008 features.
>>>>
>>>> Once all servers were at 2008 (yes, ADprep - both forest and Domain
>>>> were run). last step was to move from Sysvol to DFS-r replication. Took
>>>> each step seriously, waited until each completed, then used tools to
>>>> confirm each stage was stable before moving to next. After a couple of
>>>> days, we progressed to state "eliminated" to clean up the last vestiges
>>>> of Sysvol.
>>>>
>>>> Everything seemed to be stable. Can't figure out why it keeps
>>>> reporting "Eliminating"? Replication is working.
>>>>
>>>> It appears to be a permissions problem: I have checked firewall (both
>>>> DC). anyone have experience with this error? Nest troubleshooting step?
>>>>
>>>> ......................... ZSRV passed test Advertising
>>>> Starting test: FrsEvent
>>>> ......................... ZSRV passed test FrsEvent
>>>> Starting test: DFSREvent
>>>> There are warning or error events within the last 24 hours
>>>> after the
>>>> SYSVOL has been shared. Failing SYSVOL replication problems
>>>> may cause
>>>> Group Policy problems.
>>>> ......................... ZSRV failed test DFSREvent
>>>> Starting test: SysVolCheck
>>>> ......................... ZSRV passed test SysVolCheck
>>>> Starting test: KccEvent
>>>> ......................... ZSRV passed test KccEvent
>>>> Starting test: KnowsOfRoleHolders
>>>> ......................... ZSRV passed test KnowsOfRoleHolders
>>>> Starting test: MachineAccount
>>>> ......................... ZSRV passed test MachineAccount
>>>> Starting test: NCSecDesc
>>>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>>>> Replicating Directory Changes In Filtered Set
>>>> access rights for the naming context:
>>>> DC=DomainDnsZones,DC=zen-ad,DC=local
>>>> Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
>>>> Replicating Directory Changes In Filtered Set
>>>> access rights for the naming context:
>>>> DC=ForestDnsZones,DC=zen-ad,DC=local
>>>> ......................... ZSRV failed test NCSecDesc
>>>> Starting test: NetLogons
>>>> [ZSRV] User credentials does not have permission to perform
>>>> this
>>>> operation.
>>>> The account used for this test must have network logon
>>>> privileges
>>>> for this machine's domain.
>>>> ......................... ZSRV failed test NetLogons
>>>> Starting test: ObjectsReplicated
>>>> ......................... ZSRV passed test ObjectsReplicated
>>>> Starting test: Replications
>>>> ......................... ZSRV passed test Replications
>>>
>>>
>>
>
>