Event ID 1925 NTDS Replication : Attempt to establish a replication link failed due to DNS lookup problem.

Event ID 1925: Attempt to establish a replication link failed due to DNS lookup problem.

 

Event Type:Warning
Event Source:NTDS Replication
Event Category:DS RPC Client
Event ID:2088
Date:3/21/2005
Time:2:29:34 PM
User:NT AUTHORITY\ANONYMOUS LOGON
Computer:DC3
Description:
Active Directory could not use DNS to resolve the IP address of the
source domain controller listed below. To maintain the consistency
of Security groups, group policy, users and computers and their passwords,
Active Directory successfully replicated using the NetBIOS or fully
qualified computer name of the source domain controller.

 

Invalid DNS configuration may be affecting other essential operations on
member computers, domain controllers or application servers in this
Active Directory forest, including logon authentication or access to network
resources.

 

You should immediately resolve this DNS configuration error so that
this domain controller can resolve the IP address of the source
domain controller using DNS.

 

Alternate server name:
dc1
Failing DNS host name:
4a8717eb-8e58-456c-995a-c92e4add7e8e._msdcs.contoso.com

 

NOTE: By default, only up to 10 DNS failures are shown for any given
12 hour period, even if more than 10 failures occur.  To log all
individual failure events, set the following diagnostics registry
value to 1:

 

Registry Path:
HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics\22 DS RPC Client

 

User Action:

 

1) If the source domain controller is no longer functioning or its
operating system has been reinstalled with a different computer
name or NTDSDSA object GUID, remove the source domain controller's
metadata with ntdsutil.exe, using the steps outlined in MSKB article 216498.

 

2) Confirm that the source domain controller is running Active Directory
and is accessible on the network by typing "net view \\<source DC name>"
or "ping <source DC name>".

 

3) Verify that the source domain controller is using a valid DNS server
for DNS services, and that the source domain controller's host record
and CNAME record are correctly registered, using the DNS Enhanced
version of DCDIAG.EXE available on http://www.microsoft.com/dns

 

dcdiag /test:dns

 

4) Verify that that this destination domain controller is using a
valid DNS server for DNS services, by running the DNS Enhanced
version of DCDIAG.EXE command on the console of the destination
domain controller, as follows:

 

dcdiag /test:dns

 

5) For further analysis of DNS error failures see KB 824449

 

Cause:

 

Failure to resolve the current CNAME resource record of the source domain controller to an IP address can have the following causes:

 

The source domain controller is powered off, is offline, or resides on an isolated network, and Active Directory and Domain Name System (DNS) data for the offline domain controller has not been deleted to indicate that the domain controller is inaccessible.

 

One of the following conditions exists:

 

The source domain controller has not registered its resource records in DNS.

 

The destination domain controller is configured to use an invalid DNS server.

 

The source domain controller is configured to use an invalid DNS server.

 

The DNS server that is used by the source domain controller does not host the correct zones or the zones are not configured to accept dynamic updates.

 

The direct DNS servers that are queried by the destination domain controller cannot resolve the IP address of the source domain controller as a result of nonexistent or invalid forwarders or delegations.

 

Active Directory has been removed on the source domain controller and then reinstalled with the same IP address, but knowledge of the new NTDS Settings GUID has not reached the destination domain controller.

 

Active Directory has been removed on the source domain controller and then reinstalled with a different IP address, but the current host address (A) resource record for the IP address of the source domain controller is either not registered or does not exist on the DNS servers that are queried by the destination domain controller as a result of replication latency or replication error.

 

The operating system of the source domain controller has been reinstalled with a different computer name, but its metadata either has not been removed or has been removed and not yet inbound-replicated by the destination domain controller.

 

Solution:

 

First, determine whether the source domain controller is functioning. If the source domain controller is not functioning, remove its remaining metadata from Active Directory.

 

If the source domain controller is functioning, continue with procedures to diagnose and solve the DNS problem, as needed:

 

Use Dcdiag to diagnose DNS problems.

 

Register DNS SRV resource records plus host records.

 

Synchronize replication between the source and destination domain controllers.

 

Verify consistency of the NTDS Settings GUID.

 

Determine Whether a Domain Controller Is Functioning
To determine whether the source domain controller is functioning, use the following test.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Domain Users group in the domain of the domain controller.

 

Tools: Net view

 

To determine whether a domain controller is functioning
To confirm that the domain controller is running Active Directory and is accessible on the network, at a command prompt type the following command, and then press ENTER:

 

net view \\SourceDomainControllerName

 

where SourceDomainControllerName is the NetBIOS name of the domain controller.

 

This command displays the Netlogon and SYSVOL shares, indicating that the server is functioning as a domain controller. If this test shows that the domain controller is not functioning on the network, determine the nature of the disconnection and whether the domain controller can be recovered or whether its metadata must be removed from Active Directory manually. If the domain controller is not functioning and cannot be restored, use the procedure in the following section, "Clean Up Domain Controller Metadata," to delete the data from Active Directory that is associated with that server.

 

Clean Up Domain Controller Metadata
If tests show that the domain controller is no longer functioning but you still see objects representing the domain controller in Active Directory Sites and Services, replication will continue to be attempted, and you must remove these objects from Active Directory manually. You must use Ntdsutil to clean up (delete) the metadata for the defunct domain controller.

 

If the defunct domain controller is the last domain controller in the domain, you should also remove the metadata for the domain. Allow sufficient time for all global catalog servers in the forest to inbound-replicate the domain deletion before promoting a new domain with the same name.

 

The process for cleaning up metadata is improved in the version of Ntdsutil that is included with Windows Server 2003 SP1. Instructions for cleaning up metadata with the Windows Server 2003 version of Ntdsutil and the Windows Server 2003 SP1 version of Ntdsutil are provided in the following procedure.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Enterprise Admins group.

 

Tools: Ntdsutil (System32 command-line tool)

 

To clean up server metadata
Open a Command Prompt.

 

Type the following command, and then press ENTER:

 

ntdsutil

 

At the ntdsutil: command prompt, type the following command, and then press ENTER:

 

metadata cleanup

 

Perform metadata cleanup as follows:

 

If you are performing server metadata cleanup only and you are using the version of Ntdsutil.exe that is included with Windows Server 2003 SP1, at the metadata cleanup: command prompt, type the following, and then press ENTER:
remove selected server ServerName
Or
remove selected server ServerName1onServerName2

 

 
Value  Description 
ServerName, ServerName1
 The distinguished name of the domain controller whose metadata you want to remove, in the form cn=ServerName,cn=Servers,cn=SiteName, cn=Sites,cn=Configuration,dc=ForestRootDomain
 
ServerName2
 The DNS name of the domain controller to which you want to connect and from which you want to remove server metadata
 

 

If you are performing metadata cleanup by using the version of Ntdsutil.exe that is included with Windows Server 2003 with no service pack, or if you are performing both domain metadata cleanup and server metadata cleanup, perform metadata cleanup as follows:

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
connection

 

At the server connections: command prompt, type the following command, and then press ENTER:
connect to server Server

 

At the connection: command prompt, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
select operation target

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list sites

 

A numbered list of sites appears. Type the following command, and then press ENTER:
select site SiteNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list domains in site

 

A numbered list of domains in the selected site appears. Type the following command, and then press ENTER:
select domain DomainNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list servers in site

 

A numbered list of servers in a domain and site is displayed. Type the following command, and then press ENTER:
select server ServerNumber

 

At the select operation target: command, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command, type the following command, and then press ENTER:
remove selected server

 

If the server whose metadata you have removed is the last domain controller in the domain and you want to remove the domain metadata, at the metadata cleanup: command prompt, type the following command, and then press ENTER:
remove selected domain
Metadata for the domain that you selected in step h is removed.

 

At the metadata cleanup: and ntdsutil: command prompts, type quit, and then press ENTER.

 

 

Event ID 1925 NTDS KCC: Attempt to establish a replication link failed due to DNS lookup problem.

Event ID 1925: Attempt to establish a replication link failed due to DNS lookup problem.

 

Event Type:Warning
Event Source:NTDS KCC
Event Category:Knowledge Consistency Checker
Event ID:1925
Date:3/24/2005
Time:9:15:46 AM
User:NT AUTHORITY\ANONYMOUS LOGON
Computer:DC3
Description:
The attempt to establish a replication link for the following
writable directory partition failed.

 

Directory partition:
CN=Configuration,DC=contoso,DC=com
Source domain controller:
CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=contoso,DC=com
Source domain controller address:
f8786828-ecf5-4b7d-ad12-8ab60178f7cd._msdcs.contoso.com
Intersite transport (if any):

 

This domain controller will be unable to replicate with the
source domain controller until this problem is corrected. 

 

User Action
Verify if the source domain controller is accessible or
network connectivity is available.

 

Cause:

Failure to resolve the current CNAME resource record of the source domain controller to an IP address can have the following causes:

 

The source domain controller is powered off, is offline, or resides on an isolated network, and Active Directory and Domain Name System (DNS) data for the offline domain controller has not been deleted to indicate that the domain controller is inaccessible.

 

One of the following conditions exists:

 

The source domain controller has not registered its resource records in DNS.

 

The destination domain controller is configured to use an invalid DNS server.

 

The source domain controller is configured to use an invalid DNS server.

 

The DNS server that is used by the source domain controller does not host the correct zones or the zones are not configured to accept dynamic updates.

 

The direct DNS servers that are queried by the destination domain controller cannot resolve the IP address of the source domain controller as a result of nonexistent or invalid forwarders or delegations.

 

Active Directory has been removed on the source domain controller and then reinstalled with the same IP address, but knowledge of the new NTDS Settings GUID has not reached the destination domain controller.

 

Active Directory has been removed on the source domain controller and then reinstalled with a different IP address, but the current host address (A) resource record for the IP address of the source domain controller is either not registered or does not exist on the DNS servers that are queried by the destination domain controller as a result of replication latency or replication error.

 

The operating system of the source domain controller has been reinstalled with a different computer name, but its metadata either has not been removed or has been removed and not yet inbound-replicated by the destination domain controller.

 

Solution:

 

Use Dcdiag to Diagnose DNS Problems
If the domain controller is functioning online, continue by using Dcdiag to diagnose and fix DNS problems that might be interfering with Active Directory replication.

 

Use the following procedures to complete this process:

 

Verify connectivity and basic DNS functionality.

 

Verify registration of the CNAME resource record in DNS.

 

Verify and enable secure dynamic updates.

 

Before you begin these procedures, gather the following information, which is contained in the event ID 2087 message text:

 

The FQDN of the source domain controller and destination domain controller

 

The IP address of the source domain controller

 

The updated version of Dcdiag that is included in Windows Support Tools in Windows Server 2003 SP1 contains tests that provide consolidated and improved testing of basic and advanced DNS features. You can use this tool to diagnose basic DNS functionality and dynamic updates.

 

First, determine whether the source domain controller is functioning. If the source domain controller is not functioning, remove its remaining metadata from Active Directory.

 

If the source domain controller is functioning, continue with procedures to diagnose and solve the DNS problem, as needed:

 

Use Dcdiag to diagnose DNS problems.

 

Register DNS SRV resource records plus host records.

 

Synchronize replication between the source and destination domain controllers.

 

Verify consistency of the NTDS Settings GUID.

 

Determine Whether a Domain Controller Is Functioning
To determine whether the source domain controller is functioning, use the following test.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Domain Users group in the domain of the domain controller.

 

Tools: Net view

 

To determine whether a domain controller is functioning
To confirm that the domain controller is running Active Directory and is accessible on the network, at a command prompt type the following command, and then press ENTER:

 

net view \\SourceDomainControllerName

 

where SourceDomainControllerName is the NetBIOS name of the domain controller.

 

This command displays the Netlogon and SYSVOL shares, indicating that the server is functioning as a domain controller. If this test shows that the domain controller is not functioning on the network, determine the nature of the disconnection and whether the domain controller can be recovered or whether its metadata must be removed from Active Directory manually. If the domain controller is not functioning and cannot be restored, use the procedure in the following section, "Clean Up Domain Controller Metadata," to delete the data from Active Directory that is associated with that server.

 

Clean Up Domain Controller Metadata
If tests show that the domain controller is no longer functioning but you still see objects representing the domain controller in Active Directory Sites and Services, replication will continue to be attempted, and you must remove these objects from Active Directory manually. You must use Ntdsutil to clean up (delete) the metadata for the defunct domain controller.

 

If the defunct domain controller is the last domain controller in the domain, you should also remove the metadata for the domain. Allow sufficient time for all global catalog servers in the forest to inbound-replicate the domain deletion before promoting a new domain with the same name.

 

The process for cleaning up metadata is improved in the version of Ntdsutil that is included with Windows Server 2003 SP1. Instructions for cleaning up metadata with the Windows Server 2003 version of Ntdsutil and the Windows Server 2003 SP1 version of Ntdsutil are provided in the following procedure.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Enterprise Admins group.

 

Tools: Ntdsutil (System32 command-line tool)

 

To clean up server metadata
Open a Command Prompt.

 

Type the following command, and then press ENTER:

 

ntdsutil

 

At the ntdsutil: command prompt, type the following command, and then press ENTER:

 

metadata cleanup

 

Perform metadata cleanup as follows:

 

If you are performing server metadata cleanup only and you are using the version of Ntdsutil.exe that is included with Windows Server 2003 SP1, at the metadata cleanup: command prompt, type the following, and then press ENTER:
remove selected server ServerName
Or
remove selected server ServerName1onServerName2

 

 
Value  Description 
ServerName, ServerName1
 The distinguished name of the domain controller whose metadata you want to remove, in the form cn=ServerName,cn=Servers,cn=SiteName, cn=Sites,cn=Configuration,dc=ForestRootDomain
 
ServerName2
 The DNS name of the domain controller to which you want to connect and from which you want to remove server metadata
 

 

If you are performing metadata cleanup by using the version of Ntdsutil.exe that is included with Windows Server 2003 with no service pack, or if you are performing both domain metadata cleanup and server metadata cleanup, perform metadata cleanup as follows:

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
connection

 

At the server connections: command prompt, type the following command, and then press ENTER:
connect to server Server

 

At the connection: command prompt, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
select operation target

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list sites

 

A numbered list of sites appears. Type the following command, and then press ENTER:
select site SiteNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list domains in site

 

A numbered list of domains in the selected site appears. Type the following command, and then press ENTER:
select domain DomainNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list servers in site

 

A numbered list of servers in a domain and site is displayed. Type the following command, and then press ENTER:
select server ServerNumber

 

At the select operation target: command, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command, type the following command, and then press ENTER:
remove selected server

 

If the server whose metadata you have removed is the last domain controller in the domain and you want to remove the domain metadata, at the metadata cleanup: command prompt, type the following command, and then press ENTER:
remove selected domain
Metadata for the domain that you selected in step h is removed.

 

At the metadata cleanup: and ntdsutil: command prompts, type quit, and then press ENTER.

 

 

Event ID 2087 NTDS Replication : DNS lookup failure caused replication to fail

Event ID 2087: DNS lookup failure caused replication to fail

 

Event Type:Error
Event Source:NTDS Replication
Event Category:DS RPC Client
Event ID:2087
Date:3/9/2005
Time:11:00:21 AM
User:NT AUTHORITY\ANONYMOUS LOGON
Computer:DC3
Description:
Active Directory could not resolve the following DNS host name of
the source domain controller to an IP address. This error prevents
additions, deletions and changes in Active Directory from replicating
between one or more domain controllers in the forest. Security
groups, group policy, users and computers and their passwords will
be inconsistent between domain controllers until this error is
resolved, potentially affecting logon authentication and access
to network resources.

 

Source domain controller:
dc2
Failing DNS host name:
b0069e56-b19c-438a-8a1f-64866374dd6e._msdcs.contoso.com

 

NOTE: By default, only up to 10 DNS failures are shown for any
given 12 hour period, even if more than 10 failures occur.  To
log all individual failure events, set the following diagnostics
registry value to 1:

 

Registry Path:
HKLM\System\CurrentControlSet\Services\NTDS\Diagnostics\22 DS RPC Client

 

User Action:

 

1) If the source domain controller is no longer functioning or
its operating system has been reinstalled with a different
computer name or NTDSDSA object GUID, remove the source domain
controller's metadata with ntdsutil.exe, using the steps outlined
in MSKB article 216498.

 

2) Confirm that the source domain controller is running Active
Directory and is accessible on the network by typing
"net view \\<source DC name>" or "ping <source DC name>".

 

3) Verify that the source domain controller is using a valid
DNS server for DNS services, and that the source domain
controller's host record and CNAME record are correctly
registered, using the DNS Enhanced version of DCDIAG.EXE
available on http://www.microsoft.com/dns

 

dcdiag /test:dns

 

4) Verify that that this destination domain controller is using
a valid DNS server for DNS services, by running the DNS Enhanced
version of DCDIAG.EXE command on the console of the destination
domain controller, as follows:

 

dcdiag /test:dns

 

5) For further analysis of DNS error failures.
 824449

 

Cause:

Failure to resolve the current CNAME resource record of the source domain controller to an IP address can have the following causes:

 

The source domain controller is powered off, is offline, or resides on an isolated network, and Active Directory and Domain Name System (DNS) data for the offline domain controller has not been deleted to indicate that the domain controller is inaccessible.

 

One of the following conditions exists:

 

The source domain controller has not registered its resource records in DNS.

 

The destination domain controller is configured to use an invalid DNS server.

 

The source domain controller is configured to use an invalid DNS server.

 

The DNS server that is used by the source domain controller does not host the correct zones or the zones are not configured to accept dynamic updates.

 

The direct DNS servers that are queried by the destination domain controller cannot resolve the IP address of the source domain controller as a result of nonexistent or invalid forwarders or delegations.

 

Active Directory has been removed on the source domain controller and then reinstalled with the same IP address, but knowledge of the new NTDS Settings GUID has not reached the destination domain controller.

 

Active Directory has been removed on the source domain controller and then reinstalled with a different IP address, but the current host address (A) resource record for the IP address of the source domain controller is either not registered or does not exist on the DNS servers that are queried by the destination domain controller as a result of replication latency or replication error.

 

The operating system of the source domain controller has been reinstalled with a different computer name, but its metadata either has not been removed or has been removed and not yet inbound-replicated by the destination domain controller.

 

Resolution:

First, determine whether the source domain controller is functioning. If the source domain controller is not functioning, remove its remaining metadata from Active Directory.

 

If the source domain controller is functioning, continue with procedures to diagnose and solve the DNS problem, as needed:

 

Use Dcdiag to diagnose DNS problems.

 

Register DNS SRV resource records plus host records.

 

Synchronize replication between the source and destination domain controllers.

 

Verify consistency of the NTDS Settings GUID.

 

Determine Whether a Domain Controller Is Functioning
To determine whether the source domain controller is functioning, use the following test.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Domain Users group in the domain of the domain controller.

 

Tools: Net view

 

To determine whether a domain controller is functioning
To confirm that the domain controller is running Active Directory and is accessible on the network, at a command prompt type the following command, and then press ENTER:

 

net view \\SourceDomainControllerName

 

where SourceDomainControllerName is the NetBIOS name of the domain controller.

 

This command displays the Netlogon and SYSVOL shares, indicating that the server is functioning as a domain controller. If this test shows that the domain controller is not functioning on the network, determine the nature of the disconnection and whether the domain controller can be recovered or whether its metadata must be removed from Active Directory manually. If the domain controller is not functioning and cannot be restored, use the procedure in the following section, "Clean Up Domain Controller Metadata," to delete the data from Active Directory that is associated with that server.

 

Clean Up Domain Controller Metadata
If tests show that the domain controller is no longer functioning but you still see objects representing the domain controller in Active Directory Sites and Services, replication will continue to be attempted, and you must remove these objects from Active Directory manually. You must use Ntdsutil to clean up (delete) the metadata for the defunct domain controller.

 

If the defunct domain controller is the last domain controller in the domain, you should also remove the metadata for the domain. Allow sufficient time for all global catalog servers in the forest to inbound-replicate the domain deletion before promoting a new domain with the same name.

 

The process for cleaning up metadata is improved in the version of Ntdsutil that is included with Windows Server 2003 SP1. Instructions for cleaning up metadata with the Windows Server 2003 version of Ntdsutil and the Windows Server 2003 SP1 version of Ntdsutil are provided in the following procedure.

 

Requirements

 

Administrative credentials: To complete this procedure, you must be a member of the Enterprise Admins group.

 

Tools: Ntdsutil (System32 command-line tool)

 

To clean up server metadata
Open a Command Prompt.

 

Type the following command, and then press ENTER:

 

ntdsutil

 

At the ntdsutil: command prompt, type the following command, and then press ENTER:

 

metadata cleanup

 

Perform metadata cleanup as follows:

 

If you are performing server metadata cleanup only and you are using the version of Ntdsutil.exe that is included with Windows Server 2003 SP1, at the metadata cleanup: command prompt, type the following, and then press ENTER:
remove selected server ServerName
Or
remove selected server ServerName1onServerName2

 

 
Value  Description 
ServerName, ServerName1
 The distinguished name of the domain controller whose metadata you want to remove, in the form cn=ServerName,cn=Servers,cn=SiteName, cn=Sites,cn=Configuration,dc=ForestRootDomain
 
ServerName2
 The DNS name of the domain controller to which you want to connect and from which you want to remove server metadata
 

 

If you are performing metadata cleanup by using the version of Ntdsutil.exe that is included with Windows Server 2003 with no service pack, or if you are performing both domain metadata cleanup and server metadata cleanup, perform metadata cleanup as follows:

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
connection

 

At the server connections: command prompt, type the following command, and then press ENTER:
connect to server Server

 

At the connection: command prompt, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command prompt, type the following command, and then press ENTER:
select operation target

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list sites

 

A numbered list of sites appears. Type the following command, and then press ENTER:
select site SiteNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list domains in site

 

A numbered list of domains in the selected site appears. Type the following command, and then press ENTER:
select domain DomainNumber

 

At the select operation target: command prompt, type the following command, and then press ENTER:
list servers in site

 

A numbered list of servers in a domain and site is displayed. Type the following command, and then press ENTER:
select server ServerNumber

 

At the select operation target: command, type the following command, and then press ENTER:
quit

 

At the metadata cleanup: command, type the following command, and then press ENTER:
remove selected server

 

If the server whose metadata you have removed is the last domain controller in the domain and you want to remove the domain metadata, at the metadata cleanup: command prompt, type the following command, and then press ENTER:
remove selected domain
Metadata for the domain that you selected in step h is removed.

 

At the metadata cleanup: and ntdsutil: command prompts, type quit, and then press ENTER.

 

 

Event ID 1792 NTDS Database: A transaction lasts minutes and seconds, much longer than expected. (The caller is SAM.) Long-running transactions contribute to the depletion of version store.

Event ID: 1792
Source NTDS Database 
Type Warning 
Description A transaction lasts <number> minutes and <number> seconds, much
longer than expected. (The caller is SAM.) Long-running transactions
contribute to the depletion of version store. When version store is exhausted
all directory operations will fail. Please contact Microsoft Product Support
Services for assistance. 

 

This has kept coming for some days in the Directory-eventlog. Also got some
of these in the DNS-log:
Event ID: 4016
Source DNS 
Type Error 
Description The DNS server timed out attempting an Active Directory service
operation on ---.  Check Active Directory to see that it is functioning
properly. The event data contains the error. 

 

There are 2 DC`s in the domain, 1 Win 2000 and 1 Win 2003.

 

The only hit I found on some quick searching was to check id the RAID is
healthy. This is checked ok.

 

For the error 4016.
- If you're having this error at system startup you can safely ignore it,
the DNS service is starting before AD and fails to contact.
However if you want you can rebuild the DNS follow the following steps:

 

- Make sure that every domain controller has its DNS properties under NIC
configuration pointing to itself. (If DC IP Address is 10.0.0.1 then Dns
should be 10.0.0.1).

 

- Make sure that every DNS server can resolve all domains in the forest.
(Use Forwarding, Stub Zones or Secondary Zones).

 

- Make sure that all clients Only uses the local(s) Dns Server.

 

* Delete the forward zone and the reverse lookup zone on server:

 

*delete the files netlogon.dnb and netlogon.dns from
%systemroot%\system32\config

 

*uninstall DNS, remove DNS directory.

 

*Install DNS.

 

*create the forward lookup zone and the reverse lookup zone make them AD
integrated, for security purposes make sure that the zones only accept
secure only - updates.

 

*restart the netlogon service, confirm the creation of the files
netlogon.dnb and netlogon.dns on %systemroot%\system32\config

 

*run ipconfig /registerdns

 

*run netdiag /fix

 

Refer: 221790

Event ID 1016 NTDS General : How To Reset the Directory Services Restore Mode Administrator Account Password in Windows Server 2003.

Event ID: 1016
Source: NTDS General
Type: Error
Description: The schema could not be loaded, and the directory updates could not be made. Stop and restart this Windows Domain Controller and try again
 
According to the Microsoft article "Event ID 1016 — Schema Operations", this event may be recorded when there certain conditions such as low memory or schema corruption. The article contains information on how to correct these type of problems.
 
Message: AD_TERM could not be initialized because the schema could not be loaded.
 
User Action
Restart the directory service and try this task again. If this error continues to occur, restore the directory service from backup media.
 
Solution:
 
Add memory or correct schema corruption
Event IDs 1016, 1135, 1140, 1141, 1208, and 1315 indicate there may be a low memory condition or schema corruption. Determining whether the issue is related to low memory is the least intrusive operation. Therefore, first determine if low memory is the cause of the issue.
 
To determine how much memory is available, click Start. In Start Search, type winver, and then press ENTER. The physical memory appears at the bottom of the dialog box. Click OK.
You can check memory usage in Task Manager. To check memory usage, click Start. In Start Search, type taskmgr, and then press ENTER. Click Performance.
You can also check virtual memory usage. To check virtual memory usage, click Start. In Start Search, type sysdm.cpl, click Advanced, and in Virtual memory click Change.
In Total paging file size for all drives, compare the numbers from Recommended with the numbers from Currently allocated. If the numbers are the same, the server may be running low on virtual memory.
You can resolve memory issues by adding more physical memory or reducing the number of applications that are running on the computer. If the memory is operating within normal parameters, the server may have a corrupt schema. If you are unsure about the type of memory or the maximum physical memory capacity of the server, visit the manufacturer's web site or contact their support number for further information.
 
If the available memory is not low, then there is likely schema corruption. Perform the following procedures on the domain controller reporting the issue. After each procedure, check Event Viewer to see if this event continues to be reported. If the event continues to be reported, try the next procedure in the list.
 
Enable diagnostic logging for the schema.
Update the schema cache.
Restart the directory service.
Restore the Active Directory database from backup media.
To perform these procedures, you must have membership in Domain Admins, or you must have been delegated the appropriate authority.
 
Enable diagnostic logging for the schema
To verify a successful update of the schema, you can enable diagnostic logging for the schema. When diagnostic logging is enabled, a schema update produces Event ID 1582 in the Directory Service log of Event Viewer. To enable diagnostic logging for the schema, you must edit the registry.
 
To enable diagnostic logging for the schema:
 
Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.
 
Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
In the registry location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics, in the left pane, right-click the 24 DS Schema value, and then click Modify.
Type 1 or higher (up to 5) for Value data to enable diagnostic logging for the schema. The higher the value, the more information is reported to the Directory Service log.
Click OK.
Update the schema cache
To update the schema cache:
 
Create a file to force a schema cache update using Ldifde.exe. Create a new text file named SchemaUp (SchemaUp.txt, if you are viewing file extensions) in a folder location that is convenient for you to access.
Copy the following five lines of text, and then paste them as the contents of the SchemaUp.txt file.
dn:
 
changetype: modify
 
add: schemaUpdateNow
 
schemaUpdateNow: 1
 
-
 
After you paste the text to the file, ensure that there are no line breaks (carriage returns) between each line of text. If there are line breaks, delete the empty lines. Ensure that you have a hyphen as the last line of text in the file.
Save the file.
Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start Menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
Type ldif -i -f SchemaUp.txt, and then press ENTER. If necessary, type the file path to the text file that you saved. For example, if you saved the file in the Documents folder of an account named Administrator, type ldifde -i -f "c:\users\administrator\documents\schemaUp.txt", and then press ENTER.
Open Event Viewer. To open Event Viewer, click Start. In Start Search, type eventvwr.msc, and then press ENTER.
Expand Applications and Services Logs, and then click Directory Service.
Look for Event ID 1582, which confirms that the schema cache was reloaded successfully. If you do not see this event, click Find, type 1582, and then click Find Now. Event ID 1582 confirms that the schema cache was updated.
Confirm that there are no Critical, Error, or Warning events related to the schema after the schema cache update. To locate events that are related to the schema, click Find, type DS Schema, and then click Find Next.
Continue to click Find Next and review each event until you have verified that there are no Critical, Error, or Warning events that occured after the schema cache update.
Note: When you confirm that the schema cache was updated, you can set the 24 DS Schema value to 0 if you no longer need diagnostic logging for schema events. You can use the Reg command to modify the 24 DS Schema registry value. For example, to set the value of 24 DS Schema to 0, at a command prompt, type the following command, and then press ENTER:
 
Reg Add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "24 DS Schema" /t REG_DWORD /d 0.
 
The number after /d indicates the value, in this case, of the logging level. For example, to set the logging level to 1, change /d 0 to /d 1 in the previous command. To learn more about the Reg command syntax and options, at a command prompt, type Reg /?, and then press ENTER.
 
Restart the directory service
To restart the directory service:
 
Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
At the command prompt, type net stop ntds & net start ntds, and then press ENTER.
If the event continues to appear in Event Viewer, restart the domain controller, and then check Event Viewer again.
 
You may have to increase virtual memory or physical memory.
 
To restore the Active Directory database from backup media, you need the Directory Services Restore Mode password. If you do not know the Directory Services Restore Mode password, you can reset it by using the Ntdsutil tool and the instructions in article 322672 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=95915).
 
Restore the Active Directory database from backup media
To restore the Active Directory database from backup media, you need the Directory Services Restore Mode password. If you do not know the Directory Services Restore Mode password, you can reset it by using the Ntdsutil tool and the steps in article 322672 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=95915).
 
To restore the Active Directory database from backup media:
 
At a command prompt that you opened as administrator, type bcdedit /set safeboot dsrepair, and then press ENTER.
Restart the domain controller.
At the Windows logon screen, click Switch User.
Click Other User.
Type .\administrator as the user name, type the Directory Services Restore Mode password for the server, and then press ENTER.
Click Start. In Start Search, type cmd, and then press ENTER.
At the command prompt, type wbadmin get versions -backuptarget:targetDrive:, and then press ENTER. Substitute the location of the backup that you want to restore for targetDrive.
Identify the version of the backup that you want to restore. You must enter this version exactly in the next step.
Type wbadmin start systemstaterecovery -version:dateTime -backuptarget:targetDrive:-quiet, and then press ENTER. Substitute the version of the backup that you want to restore for dateTime and the volume that contains the backup for targetDrive.
Open a command prompt, type bcdedit /deletevalue safeboot, and then press ENTER.
After the recovery operation completes, restart the domain controller.
Note: There is no need to attempt an authoritative restore because the schema cannot be restored by using an authoritative restore.
 
Verification :

 

To verify that the schema is in a consistent state, complete the following procedures:
 
Ensure that the domain controllers synchronize their directory data by starting Active Directory replication.
Enable diagnostic logging for the schema.
Update the schema cache.
Verify that the schema was updated successfully by using Event Viewer.
To perform these procedures, you must have membership in Domain Admins, or you must have been delegated the appropriate authority.
 
Start Active Directory replication
To start Active Directory replication:
 
Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
Run the command repadmin /syncall /user:domain\user /pw:password. Substitute the appropriate domain name, user name, and password for domain, user, and password, respectively. The command output indicates whether synchronization started successfully.
Enable diagnostic logging for the schema
To verify a successful update of the schema, you can enable diagnostic logging for the schema. When you enable diagnostic logging, a schema update produces Event ID 1582 in the Directory Service log of Event Viewer. To enable diagnostic logging for the schema, you must edit the registry.
 
To enable diagnostic logging for the schema:
 
Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.
 
Open Registry Editor. To open Registry Editor, click Start. In Start Search, type regedit, and then press ENTER. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
In the registry location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics, in the left pane, right-click the 24 DS Schema value, and then click Modify.
Type 1 or higher (up to 5) for Value data to enable diagnostic logging for the schema. The higher the value, the more information is reported to the Directory Service log.
Click OK.
Update the schema cache
To update the schema cache:
 
Create a file to force a schema cache update using Ldifde.exe. Create a new text file named SchemaUp (SchemaUp.txt, if you are viewing file extensions) in a folder location that is convenient for you to access.
Copy the following five lines of text and paste them as the contents of the SchemaUp.txt file.
dn:
 
changetype: modify
 
add: schemaUpdateNow
 
schemaUpdateNow: 1
 
-
 
After you paste the text into the file, ensure that there are no line breaks (carriage returns) between each line of text. If there are, delete the empty lines. Ensure that you have a hyphen as the last line of text in the file.
Save the file.
Open a command prompt as an administrator. To open a command prompt as an administrator, click Start. In Start Search, type Command Prompt. At the top of the Start Menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
At the command prompt, type ldif -i -f SchemaUp.txt, and then press ENTER. If necessary, type the file path to the text file that you saved. For example, if you saved the file in the Documents folder of an account named Administrator, type ldifde -i -f "c:\users\administrator\documents\schemaUp.txt", and then press ENTER.
Verify that the schema cache was updated successfully by using Event Viewer
To verify that the schema cache was updated successfully by using Event Viewer:
 
Open Event Viewer. To open Event Viewer, click Start. In Start Search, type eventvwr.msc, and then press ENTER.
Expand Applications and Services Logs, and then click Directory Service.
Look for Event ID 1582, which confirms that the schema cache was reloaded successfully. If you do not see the event, click Find, type 1582, and then click Find Now. Event 1582 confirms that the schema cache was updated.
Confirm that there are no Critical, Error, or Warning events that are related to the schema that occurred after the schema cache update. To locate events that are related to the schema, click Find, type DS Schema, and then click Find Next.
Continue to click the Find Next button and review each event until you have verified that there are no Critical, Error, or Warning events that occurred after the schema cache update.
When you confirm that the schema cache was updated, you may no longer need diagnostic logging for schema events. To disable diagnostic logging for schema events, use the Reg command to set the 24 DS Schema value to 0. To set the value of 24 DS Schema to 0, at a command prompt, type the following command, and then press ENTER:
 
Reg Add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "24 DS Schema" /t REG_DWORD /d 0
 
The number after /d indicates the value, in this case, the logging level. For example, to set the logging level to 1, change /d 0 to /d 1 in the previous command. 
 

 

 

Event ID 1168 NTDS General : "Directory Services cannot start" error message when you start your Windows-based or SBS-based domain controller

Event ID 1168 NTDS General :
 
Event ID :  1168
Source  :   NTDS General

Type :   Error 

Description :Error <error code>(<hex error code>) has occurred (Internal ID <hex code>). Please contact Microsoft Product Support Services for assistance. 
   
 
Solution:

- Error: 1032 - See "JSI Tip 2599".
- Error: -1073741823 - See 930850 for a hotfix applicable to Microsoft Windows Server 2003.


In my case, this event occurred while trying to add a new domain controller. I had two errors: -1073741823(c0000001) and 183(b7). Article 232070 helped me solve the problem.


- Error: 1053(41d) - This event can be ignored if it occurred when Windows was started in Active Directory Restore mode or some other form of Safe Mode. Otherwise, investigate further.


Error 6(6)- This log entry appears after a failed attempt to move a user from one child domain to another in the same forest using the ADMT version 2.


- Error: 8352(20a0) - See 826892.
- Error: 8430(20ee) - See 827531.
- Error: 997(3e5) - See 305837.
- Error: 49(31) - See 305837.
- Error: 131174 - See 303077.
- Error: -550 - See 295932.
- Error: 1032 - See 258062.
- Error: 1004(3ec) - See 838419.
- Error: 8374(20b6) - See 830574.

- Error: -11073741823 - See 826927 for a hotfix applicable to Microsoft Windows 2000. Also, check 298601 for additional information.
- Error: 1747(6d3) - See 322267.
- Error: 8(8) - See 884591 for a hotfix applicable to Microsoft Windows 2000.

Also, check 240147, 240362, 839880, 842394, and the link to "EventID 1168 from source Active Directory" for more details.


Error: 1712(6b0) - "The type universal unique identifier (UUID) has already been registered." See 311874

Error 1032 - See 265089.

 

Error -1811 - See 280364.

 

Directory Services cannot start  error message when you start your Windows-based or SBS-based domain controller

SUMMARY

This article leads you through a series of steps that may help you diagnose the cause of the "Directory Services cannot start" system error. These steps may include:

• Verifying that the Active Directory directory service files exist
• Verifying that the file system permissions are correct
• Checking the integrity of the Active Directory database
• Performing a semantic database analysis
• Repairing the Active Directory database
• Removing and recreating the Active Directory database

This article also tells you how to use Ntdsutil or Esentutl to perform a lossy repair of the Active Directory database. Because a lossy repair deletes data and may introduce new problems, only perform a lossy repair if it is the only available option.

 

SYMPTOMS

When you start your domain controller, the screen may go blank, and you may receive the following error message:

LSASS.EXE - System Error, security accounts manager initialization failed because of the following error: Directory Services cannot start. Error status 0xc00002e1.

Please click OK to shutdown this system and reboot into directory services restore mode, check the event log for more detailed information.

Additionally, the following event ID messages may appear in the event log:

Event ID: 700
Description: "NTDS (260) Online defragmentation is beginning a pass on database NTDS.DIT."

Event ID: 701
Description: "NTDS (268) Online defragmentation has completed a full pass on database 'C:\WINNT\NTDS\ntds.dit'."

Event ID: 101
Description: "NTDS (260) the database engine stopped."

Event ID: 1004
Description: "The directory was shut down successfully."

Event ID: 1168
Description: "Error: 1032 (fffffbf8) has occurred. (internal ID 4042b). Please contact Microsoft product support services for assistance."

Event ID: 1103
Description: "The windows directory services database could not be initialized and returned error 1032. Unrecoverable error, the directory can't continue."

 

CAUSE

This problem occurs because one or more of the following conditions are true:

• The NTFS file system permissions on the root of the drive are too restrictive.
• The NTFS file system permissions on the NTDS folder are too restrictive.
• The drive letter of the volume that contains the Active Directory database has changed.
• The Active Directory database (Ntds.dit) is corrupted.
• The NTDS folder is compressed.

 

RESOLUTION

To resolve this problem, follow these steps:

1. Restart the domain controller.
2. When the BIOS information appears, press F8.
3. Select Directory Services Restore Mode, and then press ENTER.
4. Log on by using the Directory Services Restore Mode password.
   
   
    
5. Click Start, select Run, type cmd in the Open box, and then click OK.
6. At the command prompt, type ntdsutil files info.
   
   Output that is similar to the following appears:
   

   Drive Information:          C:\ NTFS (Fixed Drive  ) free(533.3 Mb) total(4.1 Gb)  DS Path Information:          Database   : C:\WINDOWS\NTDS\ntds.dit - 10.1 Mb         Backup dir : C:\WINDOWS\NTDS\dsadata.bak         Working dir: C:\WINDOWS\NTDS         Log dir    : C:\WINDOWS\NTDS - 42.1 Mb total                         temp.edb - 2.1 Mb                         res2.log - 10.0 Mb                         res1.log - 10.0 Mb                         edb00001.log - 10.0 Mb                         edb.log - 10.0 Mb

   
   Note The file locations that are included in this output are also found in the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters
   The following entries in this key contain the file locations
   • Database Backup path
   • Database Log files path
   • DSA Working Directory
7. Verify that the files that are listed in the output in step 6 exist. If the files do not exist, follow the steps in the following Microsoft Knowledge Base article:
   240362
8. Verify that the folders in the Ntdsutil output have the correct permissions. The correct permissions are specified in the following tables.
    

   Windows Server 2003

   Collapse this tableExpand this table

   Account	Permissions	Inheritance
   System	Full Control	This folder, subfolders and files
   Administrators	Full Control	This folder, subfolders and files
   Creator Owner	Full Control	Subfolders and Files only
   Local Service	Create Folders / Append Data	This folder and subfolders

    

   Windows 2000

   Collapse this tableExpand this table

   Account	Permissions	Inheritance
   Administrators	Full Control	This folder, subfolders and files
   System	Full Control	This folder, subfolders and files

   Note Additionally, the System account requires Full Control permissions on the following folders:
   • The root of the drive that contains the Ntds folder
   • The %WINDIR% folder
   In Windows Server 2003, the default location of the %WINDIR% folder is C:\WINDOWS. In Windows 2000, the default location of the %WINDIR% folder is C:\WINNT.
9. Check the integrity of the Active Directory database. To do this, type ntdsutil files integrity at the command prompt.
   
   If the integrity check indicates no errors, restart the domain controller in normal mode. If the integrity check does not finish without errors, continue to the following steps.
10. Perform a semantic database analysis. To do this, type the following command at the command prompt, including the quotation marks:
    ntdsutil "sem d a" go
11. If the semantic database analysis indicates no errors, continue to the following steps. If the analysis reports any errors, type the following command at the command prompt, including the quotation marks:
    ntdsutil "sem d a" "go f"
12. Follow the steps in the following Microsoft Knowledge Base article to perform an offline defragmentation of the Active Directory database:
    232122 Performing offline defragmentation of the Active Directory database
13. If the problem still exists after the offline defragmentation, and there are other functional domain controllers in the same domain, remove Active Directory from the server, and then reinstall Active Directory. To do this, follow the steps in the "Workaround" section in the following Microsoft Knowledge Base article:
    332199 Domain controllers do not demote gracefully when you use the Active Directory Installation Wizard to force demotion in Windows Server 2003 and in Windows 2000 Server
    Note If your domain controller is running Microsoft Small Business Server, you cannot perform this step, because Small Business Server cannot be added to an existing domain as an additional domain controller (replica). If you have a system state backup that is newer than the tombstone lifetime, restore that system state backup instead of removing Active Directory from the server. By default, the tombstone lifetime is 60 days.
    
    For more information about how to restore a system state backup, click the following article number to view the article in the Microsoft Knowledge Base:
    240363 How to use the Backup program to back up and restore the system state
14. If no system state backup is available, and there are no other healthy domain controllers in the domain, we recommend that you rebuild the domain by removing Active Directory and then reinstalling Active Directory on the server, creating a new domain. You can use the old domain name again or use a new domain name. You can also rebuild the domain by reformatting and reinstalling Windows on the server. However, removing Active Directory is quicker, and effectively removes the corrupted Active Directory database.
    
    If no system state backup is available, there are no other healthy domain controllers in the domain, and you must have the domain controller working immediately, perform a lossy repair by using either Ntdsutil or Esentutl.
    
    Note Microsoft does not support domain controllers after Ntdsutil or Esentutl is used to recover from Active Directory database corruption. If you perform this kind of repair, you must rebuild the domain controller for Active Directory to be in a supported configuration. The repair command in Ntdsutil uses the Esentutl utility to perform a lossy repair of the database. This kind of repair fixes corruption by deleting data from the database. Only use this kind of repair as a last resort.
    
    Although the domain controller may start and may appear to function correctly after the repair, its state is unsupported because the data that is deleted from the database can cause any number of problems that may not surface until later. There is no way to determine what data was deleted when the database was repaired. As soon as possible after the repair, you must rebuild the domain to return Active Directory to a supported configuration. If you only use the offline defragmentation or semantic database analysis methods that are referenced in this article, you do not have to rebuild the domain controller afterward.
15. Before you perform a lossy repair, contact Microsoft Product Support Services to confirm that you have reviewed all possible recovery options and to verify that the database truly is in an unrecoverable state. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS (http://support.microsoft.com/default.aspx?scid=fh;en-us;cntactms)
    On a Windows 2000 Server-based domain controller, use Ntdsutil to recover the Active Directory database. To do this, type ntdsutil files repair at a command prompt in Directory Service Restore Mode.
    
    To perform a lossy repair of a Windows Server 2003-based domain controller, use the Esentutl.exe tool to recover the Active Directory database. To do this, type esentutl /p at a command prompt on the Windows Server 2003-based domain controller.
    
16. After the repair operation is complete, rename the .log files in the NTDS folder by using a different extension such as .bak, and try to start the domain controller in normal mode.
17. If you can start the domain controller in normal mode after the repair, migrate relevant Active Directory objects to a new forest as soon as possible. Because this lossy repair method fixes corruption by deleting data, it can cause later problems that are extremely difficult to troubleshoot. At the first opportunity after the repair, you must rebuild the domain to bring Active Directory back to a supported configuration.
    
    You can migrate users, computers, and groups by using the Active Directory Migration Tool (ADMT), Ldifde, or a non-Microsoft migration tool. ADMT can migrate user accounts, computer accounts and security groups with or without the security identifier (SID) history. ADMT also migrates user profiles. To use ADMT in a Small Business Server environment, review the "Migrating from Small Business Server 2000 or Windows 2000 Server" white paper. To obtain this white paper, visit the following Microsoft Web site:
    http://technet.microsoft.com/en-us/library/cc719892.aspx (http://technet.microsoft.com/en-us/library/cc719892.aspx)
    You can use Ldifde to export and import many types of objects from the damaged domain to the new domain. These objects include user accounts, computer accounts, security groups, organization units, Active Directory sites, subnets, and site links. Ldifde cannot migrate the SID history. Ldifde is part of Windows 2000 Server and Windows Server 2003. For more information about how to use Ldifde, click the following article number to view the article in the Microsoft Knowledge Base: You can use the Group Policy Management Console (GPMC) to export the file system and the Active Directory part of the group policy object from the damaged domain to the new domain.
    
    To obtain the GPMC, visit the following Microsoft Web site:
    http://www.microsoft.com/windowsserver2003/gpmc/default.mspx (http://www.microsoft.com/windowsserver2003/gpmc/default.mspx)
    For information about how to migrate group policy objects by using the GPMC, review the "Migrate GPOs across domains with GPMC" white paper. To obtain this white paper, visit the following Microsoft Web site:
    http://www.microsoft.com/windowsserver2003/gpmc/migrgpo.mspx (http://www.microsoft.com/windowsserver2003/gpmc/migrgpo.mspx)
18. After the recovery, evaluate your current backup plan to make sure that you have scheduled system state backups frequently enough. Schedule system state backups at least every day, or after every significant change. System state backups must contain the required level of fault tolerance. For example, do not store backups on the same drive as the computer that you are backing up. Whenever possible, use more than one domain controller to avoid a single point of failure. Store backups in an off-site location so that site disaster (fire, theft, flood, computer theft) does not affect your ability to recover. The following Microsoft Web sites can help you develop a backup plan.
    • Windows Server 2003:
      http://technet2.microsoft.com/windowsserver/en/library/BC401E10-2243-4A4F-9708-2021EA14A7D91033.mspx (http://technet2.microsoft.com/windowsserver/en/library/BC401E10-2243-4A4F-9708-2021EA14A7D91033.mspx)
    • Windows 2000:
      http://technet.microsoft.com/en-us/library/bb727106.aspx (http://technet.microsoft.com/en-us/library/bb727106.aspx)
    • Windows Small Business Server:
      http://technet.microsoft.com/en-us/library/cc514417.aspx (http://technet.microsoft.com/en-us/library/cc514417.aspx)
    • Windows Small Business Server 2003: http://www.microsoft.com/downloads/details.aspx?FamilyID=487736f8-f6f5-436d-a82d-0c8d66e2a634&DisplayLang=en (http://www.microsoft.com/downloads/details.aspx?FamilyID=487736f8-f6f5-436d-a82d-0c8d66e2a634&DisplayLang=en)
    For more information about Active Directory disaster recovery, visit the following Microsoft Web site:
    http://www.microsoft.com/downloads/details.aspx?familyid=4A82ECCC-76D6-4431-AAC4-1EF1BA11DBEA&amp;displaylang=en (http://www.microsoft.com/downloads/details.aspx?familyid=4A82ECCC-76D6-4431-AAC4-1EF1BA11DBEA&displaylang=en)

 

Event ID 1925 NTDS KCC: Attempt to establish a replication link failed due to DNS lookup problem

Event ID 1925 Source NTDS KCC :

Description:

Event Type:Warning
Event Source:NTDS KCC
Event Category:Knowledge Consistency Checker
Event ID:1925
Date:3/24/2005
Time:9:15:46 AM
User:NT AUTHORITY\ANONYMOUS LOGON
Computer:DC3
Description:
The attempt to establish a replication link for the following
writable directory partition failed.

Directory partition:
CN=Configuration,DC=contoso,DC=com
Source domain controller:
CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=contoso,DC=com
Source domain controller address:
f8786828-ecf5-4b7d-ad12-8ab60178f7cd._msdcs.contoso.com
Intersite transport (if any):

This domain controller will be unable to replicate with the
source domain controller until this problem is corrected. 

User Action
Verify if the source domain controller is accessible or
network connectivity is available.

Additional Data
Error value:
8524 The DSA operation is unable to proceed because of a DNS
lookup failure.

 

Solution :

Proceed with DNS testing as described in "Event ID 2087: DNS lookup failure caused replication to fail."

***

- Error code: 1396 - See 939820 for a hotfix applicable to Microsoft Windows Server 2003.
- Error code: 8439 - See 948925.
- Error code: 5 (Error code 5) - See 938702.
- Error code: 1727 (Error code 1727) - See 911799.

***

This is a generic message saying that the replication failed for the specified reason. The useful information is the one found in the "Additional data" as it provides a clue about the reason why the replication failed. Of course, another important detail is the actual partition that failed to replicate. As a result, any attempt to troubleshoot this problem should consider the specific error code, not just the event id itself.

***

Error 1908 (Could not find the domain controller for this domain.) - The "Event ID 1925: Attempt to establish a replication link failed due to connectivity problem" link provides suggestions on how to troubleshoot this connectivity problem.

Error 8524 The DSA operation is unable to proceed because of a DNS lookup failure. - Proceed with DNS testing as described in the "Event ID 2087: DNS lookup failure caused replication to fail." link.

This error can also occur if there is a missing or corrupted SYSVOL folder on the destination DC that this DC is trying to replicate to. First do a <CMD> net share to see if the SYSVOL shares are present. If you don't see the SYSVOL shares or you get errors, see article 257338 for help in tracking down this problem.

This signifies errors between site replication. This is normally attributed to DNS configuration errors.

 

More Ref:

 

http://technet.microsoft.com/en-us/library/cc778061.aspx

http://technet.microsoft.com/en-us/library/cc738415.aspx

http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/ccabfcc4-a99e-46af-8404-a2af55612a2a