Ldap error 82 local error win32 err 8341 - Исправление ошибок и поиск оптимальных решений проблем

Есть домен domainOne.ru. Есть два контроллера домена:

dc1.domainOne.ru — в питере AD+DNS+DHCP

dc3.tver.domainOne.ru — в твери. AD+DNS+DHCP

Работало всё хорошо после установки всей системы уже месяца 4, и тут в пятницу ещё ухожу домой — всё ОК. в субботу утром, то бишь 1 ноября получаю:

пользователи с тверского домена не авторизуються на питерском терминальном сервере. Смотрю дальше. по логам не идёт репликация dc1 c dc3.

с dc1 не могу попасть на dc3 через AD Users and Computers — нет доступа, не прошёл аутентификацию.

вот логи с netdiag и dcdiag с обоих контроллер домена + перекрёстый опрос (вывел только ошибки, что бы не заграмождать):

На DC3:

Netdiag

Computer Name: DC3

DNS Host Name: dc3.tver.domainOne.ru

Host Name. . . . . . . . . : dc3

IP Address . . . . . . . . : 10.2.0.31

Subnet Mask. . . . . . . . : 255.255.0.0

Default Gateway. . . . . . : 10.2.0.1

Dns Servers. . . . . . . . : 10.2.0.31

Winsock test . . . . . . . . . . . : Passed

DNS test . . . . . . . . . . . . . : Passed

PASS — All the DNS entries for DC are registered on DNS server ‘10.2.0.31’ a

nd other DCs also have some of the names registered.

Redir and Browser test . . . . . . : Failed

List of NetBt transports currently bound to the Redir

NetBT_Tcpip_{FBC5505E-9A1E-459F-A6E7-92E000FB66B6}

The redir is bound to 1 NetBt transport.

List of NetBt transports currently bound to the browser

NetBT_Tcpip_{FBC5505E-9A1E-459F-A6E7-92E000FB66B6}

The browser is bound to 1 NetBt transport.

[FATAL] Cannot send mailslot message to ‘\DOMAINONE*MAILSLOTNETNETLO

GON’ via redir. [ERROR_BAD_NETPATH]

DC list test . . . . . . . . . . . : Failed

Failed to enumerate DCs by using the browser. [ERROR_NO_BROWSER_SERVERS_

FOUND]

Dcdiag

Starting test: NCSecDesc

[DC3] LDAP bind failed with error 8341,

Win32 Error 8341.

……………………. DC3 failed test NCSecDesc

Starting test: KnowsOfRoleHolders

[DC1] DsBindWithSpnEx() failed with error -2146892976,

Win32 Error -2146892976.

Warning: DC1 is the Schema Owner, but is not responding to DS RPC Bind.

[DC1] LDAP bind failed with error 8341,

Win32 Error 8341.

Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.

[DC2] DsBindWithSpnEx() failed with error -2146892976,

Win32 Error -2146892976.

Warning: DC2 is the Domain Owner, but is not responding to DS RPC Bind.

[DC2] LDAP bind failed with error 8341,

Win32 Error 8341.

Warning: DC2 is the Domain Owner, but is not responding to LDAP Bind.

……………………. DC3 failed test KnowsOfRoleHolders

На DC1

netdiag

Computer Name: DC1

DNS Host Name: dc1.domainOne.ru

Host Name. . . . . . . . . : dc1

IP Address . . . . . . . . : 10.1.0.31

Subnet Mask. . . . . . . . : 255.255.0.0

Default Gateway. . . . . . : 10.1.0.1

Dns Servers. . . . . . . . : 10.1.0.31

10.1.0.32

Прошёл без ошибок

Dcdiag

Прошёл без ошибок

Хотя ранее выдавал:

Testing server: Spb-SiteDC1

Starting test: Replications

что тут ошибка, не может сделать репликацию с dc3

Далее перекрестную провёрку решил попробовать:

На DC3:

dcdiag /sc1

Testing server: Spb-SiteDC1
      Starting test: Replications
         [DC2] DsBindWithSpnEx() failed with error -2146892976,
         Win32 Error -2146892976.
         ……………………. DC1 passed test Replications
      Starting test: NCSecDesc
         [DC1] LDAP bind failed with error 8341,
         Win32 Error 8341.
         ……………………. DC1 failed test NCSecDesc
      Starting test: NetLogons
         ……………………. DC1 passed test NetLogons
      Starting test: Advertising
         ……………………. DC1 passed test Advertising
      Starting test: KnowsOfRoleHolders
         Warning: DC2 is the Domain Owner, but is not responding to DS RPC Bind.

         [DC2] LDAP bind failed with error 8341,
         Win32 Error 8341.
         Warning: DC2 is the Domain Owner, but is not responding to LDAP Bind.
         Warning: DC2 is the Infrastructure Update Owner, but is not responding
to DS RPC Bind.
         Warning: DC2 is the Infrastructure Update Owner, but is not responding
to LDAP Bind.
         ……………………. DC1 failed test KnowsOfRoleHolders

На DC1:

dcdiag /sc3

Domain Controller Diagnosis

Performing initial setup:

Done gathering initial info.

Doing initial required tests

Testing server: Tver-SiteDC3

Starting test: Connectivity

……………………. DC3 passed test Connectivity

Doing primary tests

Testing server: Tver-SiteDC3

Starting test: Replications

……………………. DC3 passed test Replications

Starting test: NCSecDesc

……………………. DC3 passed test NCSecDesc

Starting test: NetLogons

……………………. DC3 passed test NetLogons

Starting test: Advertising

……………………. DC3 passed test Advertising

Starting test: KnowsOfRoleHolders

……………………. DC3 passed test KnowsOfRoleHolders

Starting test: RidManager

……………………. DC3 passed test RidManager

Starting test: MachineAccount

……………………. DC3 passed test MachineAccount

Starting test: Services

……………………. DC3 passed test Services

Starting test: ObjectsReplicated

……………………. DC3 passed test ObjectsReplicated

Starting test: frssysvol

……………………. DC3 passed test frssysvol

Starting test: frsevent

……………………. DC3 passed test frsevent

Starting test: kccevent

……………………. DC3 passed test kccevent

Starting test: systemlog

……………………. DC3 passed test systemlog

Starting test: VerifyReferences

……………………. DC3 passed test VerifyReferences

Running partition tests on : DomainDnsZones