The replication operation encountered a database error

Troubleshoot common Active Directory replication errors

This article contains information and links to help you troubleshoot Active Directory Replication errors. It is intended to provide Active Directory administrators with a method to diagnose replication failures and to determine where those failures are occurring.

Applies to: В Windows Server 2019, Windows Server 2016, Windows Server 2012 R2
Original KB number: В 3108513

Home users: This article is only intended for technical support agents and IT professionals. If you’re looking for help with a problem, ask the Microsoft Community.

Error codes

To troubleshoot specific errors, refer to the following table.

Event IDs

To troubleshoot specific event IDs, refer to the following table:

Источник

Устранение распространенных ошибок репликации Active Directory

В этой статье содержатся сведения и ссылки, которые помогут устранить ошибки репликации Active Directory. Он предназначен для предоставления администраторам Active Directory метода диагностики сбоев репликации и определения места возникновения этих сбоев.

Применимо к: Windows Server 2019, Windows Server 2016, Windows Server 2012 R2
Исходный номер базы знаний: 3108513

Домашние пользователи: эта статья предназначена только для агентов технической поддержки и ИТ-специалистов. Если вам нужна помощь в устранении проблемы, обратитесь к сообществу Майкрософт.

Коды ошибок

Сведения об устранении определенных ошибок см. в следующей таблице.

ИД событий

Сведения об устранении неполадок с определенными идентификаторами событий см. в следующей таблице:

Источник

Issue:
———

DC1 and DC2 are two domain controllers for the domain Domain.com.

DC1 -> DC2 replication working fine but the reverse DC2 -> DC1 doesn’t seem to work. Below are the commands and event ids which generated for the replication.

============================
C:Windowsntds>repadmin /replicate DC2 DC1 DC=Domain,DC=com
Sync from DC1 to DC2 completed successfully.

C:Windowsntds>repadmin /replicate DC1 DC2 DC=Domain,DC=om
DsReplicaSync() failed with status 8451 (0x2103):
The replication operation encountered a database error.
============================

Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Event ID: 2108
Task Category: Replication
Level: Error
Computer: DC1.Domain.com
Description:
This event contains REPAIR PROCEDURES for the 1084 event which has previously been logged. This message indicates a specific issue with the consistency of the Active Directory Domain Services database on this replication destination. A database error occurred while applying replicated changes to the following object. The database had unexpected contents, preventing the change from being made.

Object:
DC=DC1,DC=Domain.com,CN=MicrosoftDNS,CN=System,DC=barrylevin,DC=com
Object GUID:
27709216-a6eb-4e13-a614-36becd89756b
Source domain controller:
cfaf2018-03a3-441c-834e-4d86f8c8c7ba._msdcs.barrylevin.com

User Action

Please consult KB article 837932, http://support.microsoft.com/?id=837932. A subset of its repair procedures are listed here.
1. Confirm that sufficient free disk space resides on the volumes hosting the Active Directory Domain Services database then retry the operation. Confirm that the physical drives hosting the NTDS.DIT and log files do not reside on drives where NTFS compression is enabled. Also check for anti-virus software accessing these volumes.
2. It may be of benefit to force the Security Descriptor Propagator to rebuild the object container ancestry in the database. This may be done by following the instructions in KB article 251343, http://support.microsoft.com/?id=251343.
3. The problem may be related to the object’s parent on this domain controller. On the source domain controller, move the object to have a different parent.
4. If this machine is a global catalog and the error occurs in one of the read-only partitions, you should demote the machine as a global catalog using the Global Catalog checkbox in the Sites & Services user interface. If the error is occurring in an application partition, you can stop the application partition from being hosted on this replica. This may be changed using the ntdsutil.exe command.
5. Obtain the most recent ntdsutil.exe by installing the latest service pack for your operating system. Prior to booting into Directory Services Restore Mode (DSRM), verify that the DSRM password is known. Otherwise reset it prior to restarting the system.
6. In DSRM, run the NT CMD prompt, run “ntdsutil files integrity”. If corruption is found and other replicas exist, then demote replica and check your hardware. If no replicas are present, restore a system state backup and repeat this verification.
7. Perform an offline defragmentation using the “ntdsutil files compact” function.
8. The “ntdsutil semantic database analysis” should also be performed. If errors are found, they may be corrected using the “go fixup” function. Note that this should not be confused with the database maintenance function called “ESE repair”, which should not be used, since it causes data loss for Active Directory Domain Services Databases.

If none of these actions succeed and the replication error continues, you should demote this domain controller and promote it again.

Additional Data
Primary Error value:
8451 The replication operation encountered a database error.
Secondary Error value:
-1414 JET_errSecondaryIndexCorrupted, Secondary index is corrupt. The database must be defragmented

============================

Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Event ID: 1084
Task Category: Replication
Level: Error
Computer: DC1.Domain.com
Description:
Internal event: Active Directory Domain Services could not update the following object with changes received from the following source directory service. This is because an error occurred during the application of the changes to Active Directory Domain Services on the directory service.

Object:
DC=DC1,DC=Domain.com,CN=MicrosoftDNS,CN=System,DC=barrylevin,DC=com
Object GUID:
27709216-a6eb-4e13-a614-36becd89756b
Source directory service:
cfaf2018-03a3-441c-834e-4d86f8c8c7ba._msdcs.barrylevin.com

Synchronization of the directory service with the source directory service is blocked until this update problem is corrected.

This operation will be tried again at the next scheduled replication.

User Action
Restart the local computer if this condition appears to be related to low system resources (for example, low physical or virtual memory).

Additional Data
Error value:
8451 The replication operation encountered a database error.

============================

Cause:
———

Additional Data
Primary Error value:
8451 The replication operation encountered a database error.
Secondary Error value:
-1414 JET_errSecondaryIndexCorrupted, Secondary index is corrupt. The database must be defragmented

Above details indicate that the database should be defragemented on DC1..

Resolution:
—————-

Take a backup of ntds.dit file under c:windowsntds if anything goes wrong. If ntds.dit file is not available under default location, you should take backup from where you published the NTDS Database.

Open command prompt and navigate to c:windowsntds and perform below sequence of commands.

1. net stop ntds
2. Physical consistency check by using below command and it is passed. Go to Step 4 if its failed.
   esentutl /K ntds.dit
3. Logical consistency check by using below command and it failed.
   ntds>esentutl /G ntds.dit

   ============================
   Checking database integrity.
   Scanning Status (% complete)

   0 10 20 30 40 50 60 70 80 90 100
   |—-|—-|—-|—-|—-|—-|—-|—-|—-|—-|
   …………………………………………
   Integrity check completed.
   Database is CORRUPTED, the last full backup of this database was on 10/25/2014 14:00:22

   Operation terminated with error -1206 (JET_errDatabaseCorrupted, Non database file or corrupted db) after 13.712 seconds.
   ============================

4. Performed offline Defrag by using below command. Contact Microsoft if in case it is failed.
   esentutl /D ntds.dit
5. Again performed Logical consistency check by using below command and it was successful..
   ntds>esentutl /G ntds.dit
6. net start ntds

Replication start working again. Thats it.

Reference:
—————

http://support2.microsoft.com/kb/837932
http://support2.microsoft.com/kb/2645996/en-gb

One of the domain controllers in the network was failing and was reporting numerous errors with replication, active directory object updates and several other problems. The SYSVOL replication was encountering problems as well.

The event log for Active Directory Domain Services was loaded with errors. The DC was logging event IDs 467, 1173, 1084, 2108, 2042, 1925, 1645, and several others.

These logged errors included several issues. Event ID 467 clearly showed that the NTDS database was corrupt.

Event ID 467:

NTDS (584) NTDSA: Database C:WindowsNTDSntds.dit: Index DRA_USN_index of table datatable is corrupted (0).

The event ID 1645 indicated that the SPN for the DC in question was not registered on the Key Distribution Center.

Event ID 1645:

Active Directory Domain Services did not perform an authenticated remote procedure call (RPC) to another directory server because the desired service principal name (SPN) for the destination directory server is not registered on the Key Distribution Center (KDC) domain controller that resolves the SPN.

Destination directory server:
60dcff58-4d57-4da6-9be1-33c4c3604d39._msdcs.domain
SPN:
E3514235-4B06-11D1-AB04-00C04FC2DCD2/60dcff58-4d57-4da6-9be1-33c4c3604d39/domain@domain

User Action
Verify that the names of the destination directory server and domain are correct. Also, verify that the SPN is registered on the KDC domain controller. If the destination directory server has been recently promoted, it will be necessary for the local directory server’s account data to replicate to the KDC before this directory server can be authenticated.

The error 1084 showed that the server was unable to replicate AD objects.

Event ID 1084:

Internal event: Active Directory Domain Services could not update the following object with changes received from the following source directory service. This is because an error occurred during the application of the changes to Active Directory Domain Services on the directory service.

Object:
CN=%OBJNAME%,OU=%OU1%,OU=%OU2%,OU=%OU3%,DC=%DC1%,DC=%DC2%,DC=%DC3%
Object GUID:
396a9042-be32-4aa2-a6b7-255fb3f67348
Source directory service:
d33dce76-e290-4c8e-85cb-57a9f18ddcde._msdcs.domain

Synchronization of the directory service with the source directory service is blocked until this update problem is corrected.

This operation will be tried again at the next scheduled replication.

User Action
Restart the local computer if this condition appears to be related to low system resources (for example, low physical or virtual memory).

Additional Data
Error value:
8451 The replication operation encountered a database error.

Attempting to replicate the server using repadmin fails as well.

And a lengthy logged event that ultimately provided the solution. Event ID 2108 shows repair procedures that can be attempted to resolve the issues at hand.

Event ID 2108:

This event contains REPAIR PROCEDURES for the 1084 event which has previously been logged. This message indicates a specific issue with the consistency of the Active Directory Domain Services database on this replication destination. A database error occurred while applying replicated changes to the following object. The database had unexpected contents, preventing the change from being made.

Object:
CN=%OBJNAME%,OU=%OU1%,OU=%OU2%,OU=%OU3%,DC=%DC1%,DC=%DC2%,DC=%DC3%
Object GUID:
396a9042-be32-4aa2-a6b7-255fb3f67348
Source domain controller:
d33dce76-e290-4c8e-85cb-57a9f18ddcde._msdcs.domain

User Action

Please consult KB article 837932. A subset of its repair procedures are listed here.
1. Confirm that sufficient free disk space resides on the volumes hosting the Active Directory Domain Services database then retry the operation. Confirm that the physical drives hosting the NTDS.DIT and log files do not reside on drives where NTFS compression is enabled. Also check for anti-virus software accessing these volumes.
2. It may be of benefit to force the Security Descriptor Propagator to rebuild the object container ancestry in the database. This may be done by following the instructions in KB article 251343.
3. The problem may be related to the object’s parent on this domain controller. On the source domain controller, move the object to have a different parent.
4. If this machine is a global catalog and the error occurs in one of the read-only partitions, you should demote the machine as a global catalog using the Global Catalog checkbox in the Sites & Services user interface.   If the error is occurring in an application partition, you can stop the application partition from being hosted on this replica. This may be changed using the ntdsutil.exe command.
5. Obtain the most recent ntdsutil.exe by installing the latest service pack for your operating system. Prior to booting into Directory Services Restore Mode (DSRM), verify that the DSRM password is known. Otherwise reset it prior to restarting the system.
6. In DSRM, run the NT CMD prompt, run “ntdsutil files integrity”. If corruption is found and other replicas exist, then demote replica and check your hardware. If no replicas are present, restore a system state backup and repeat this verification.
7. Perform an offline defragmentation using the “ntdsutil files compact” function.
8. The “ntdsutil semantic database analysis” should also be performed. If errors are found, they may be corrected using the “go fixup” function.  Note that this should not be confused with the database maintenance function called “ESE repair”, which should not be used, since it causes data loss for Active Directory Domain Services Databases.

If none of these actions succeed and the replication error continues, you should demote this domain controller and promote it again.

Additional Data
Primary Error value:
8451 The replication operation encountered a database error.
Secondary Error value:
-1414 JET_errSecondaryIndexCorrupted, Secondary index is corrupt. The database must be defragmented

The final lines of this event ID showed the problem this DC was facing. The server was having database errors with indexes being corrupted and indicating that it must be defragmented. Step number 8 was attempted first to check for errors though none were found. The operation needs to be performed when the AD DS service is not running so the first step is to stop the service. Doing so will automatically stop its dependents which are the Kerberos KDC, DFS Replication, DNS Server and Intersite Messaging services . The semantic database analysis was then ran by starting ntdsutil, activating instance NTDS, entering semantic database analysis and issuing go.

With no errors being shown with the analysis, the offline defragmentation was executed and a new NTDS.dit file was generated. A full backup was taken and the current NTDS DB was replaced with the newly defragmented file.

All the stopped services were restarted. Following the defragmentation, the DC recovered from all the errors and was able to resume normal operations.

The SYSVOL DFSR replication was also in an error state. Event IDs 2212, 2213 and 6804 were being logged. ID 2213 provided the solution as well to resume the DFS replication by running the following command from an elevated prompt. Take care of the notice in this Microsoft KB when resuming DFS replication.

wmic /namespace:\rootmicrosoftdfs path dfsrVolumeConfig where volumeGuid=”GUID” call ResumeReplication

DFS replication resumed, however, additional errors were soon logged, most notably event ID 6016.

Event ID 6016:

The DFS Replication service failed to update configuration in Active Directory Domain Services. The service will retry this operation periodically.

Additional Information:
Object Category: msDFSR-Subscription
Object DN: CN=56c779af-e088-4cdf-a87e-afaf34c8daa2,CN=0c3e30a1-22f5-4d82-b5f1-39a610bfef89,CN=DFSR-LocalSettings,CN=DC,OU=Domain Controllers,DC=domain
Error: 5 (Access is denied.)
Domain Controller: dc.domain
Polling Cycle: 60

The DC was unable to update its configuration in ADDS due to an access denied error. ADSIEdit was launched to check the permissions settings for this configuration entry. The permissions for the computer object belonging to this domain controller were missing. Full control permissions were added back for the computer object.

The DFS Replication service was restarted and the server was able to successfully resume replication.

Isn’t it great when the logged events themselves provide the needed solutions !

repadmin /syncall /AePdq

Error issuing replication : 8451 (0x2103)

The replication operation encountered a database error.

Press F8 on Boot.  (If its on VMware enter bios menu . Then exit and press F8)

Check if Database is corrupted. if its corrupted . please proceed with next steps.

C:WindowsNTDS>

C:WindowsNTDS>ESENTUTL /g C:windowsNTDSntds.dit /!10240 /8 /o

Initiating INTEGRITY mode...

Database: C:windowsNTDSntds.dit

Temp. Database: .TEMPINTEG4820.EDB

Checking database integrity.

The database is not up-to-date. This operation may find that

this database is corrupt because data from the log files has

yet to be placed in the database.

To ensure the database is up-to-date please use the 'Recovery' operation.

Scanning Status (% complete)

0    10   20   30   40   50   60   70   80   90  100

|----|----|----|----|----|----|----|----|----|----|

...................................................

Integrity check completed.

Database is CORRUPTED, the last full backup of this database was on 04/20/2019 1

2:31:03

Operation terminated with error -1206 (JET_errDatabaseCorrupted, Non database fi

le or corrupted db) after 7.93 seconds.

C:WindowsNTDS>NTDSUTIL

NTDSUTIL: active instance ntds

Error parsing Input - Invalid Syntax.

NTDSUTIL: activate instance ntds

Active instance set to "ntds".

NTDSUTIL: files

file maintenance: info

Drive Information:

C: NTFS (Fixed Drive  ) free(40.5 Gb) total(59.6 Gb)

DS Path Information:

Database   : C:WindowsNTDSntds.dit - 314.1 Mb

Backup dir : C:WindowsNTDSdsadata.bak

Working dir: C:WindowsNTDS

Log dir    : C:WindowsNTDS - 80.0 Mb total

edbtmp.log - 10.0 Mb

edbres00002.jrs - 10.0 Mb

edbres00001.jrs - 10.0 Mb

edb07737.log - 10.0 Mb

edb07736.log - 10.0 Mb

edb07735.log - 10.0 Mb

edb07734.log - 10.0 Mb

edb.log - 10.0 Mb

file maintenance: Recover

Initiating RECOVERY mode...

Log files: C:WindowsNTDS.

System files: C:WindowsNTDS.

Performing soft recovery...

Database recovery is successful.

It is recommended you run semantic database analysis

to ensure semantic database consistency as well.

file maintenance: quit

NTDSUTIL: ESENTUTL /ml c:windowsntdsedb

C:WindowsNTDS>

C:WindowsNTDS>ESENTUTL /ml c:windowsntdsedb

Extensible Storage Engine Utilities for Microsoft(R) Windows(R)

Version 6.3

Copyright (C) Microsoft Corporation. All Rights Reserved.

Initiating FILE DUMP mode...

Verifying log files...

Base name: edb

Log file: c:windowsntdsedb07734.log - OK

Log file: c:windowsntdsedb07735.log - OK

Log file: c:windowsntdsedb07736.log - OK

Log file: c:windowsntdsedb07737.log - OK

Log file: c:windowsntdsedb.log - OK

No damaged log files were found.

Operation completed successfully in 0.453 seconds.

C:WindowsNTDS>ESENTUTL /g C:windowsNTDSntds.dit /!10240 /8 /o

Initiating INTEGRITY mode...

Database: C:windowsNTDSntds.dit

Temp. Database: .TEMPINTEG3496.EDB

Checking database integrity.

Scanning Status (% complete)

0    10   20   30   40   50   60   70   80   90  100

|----|----|----|----|----|----|----|----|----|----|

...................................................

Integrity check successful.

Operation completed successfully in 20.156 seconds.

C:WindowsNTDS>ntdsutil

ntdsutil: activate instance ntds

Active instance set to "ntds".

ntdsutil: semantic database analysis

semantic checker: go

Fixup mode is turned off

......Done.

Writing summary into log file dsdit.dmp.0

SDs scanned:           3475

Records scanned:      27034

Processing records..Done. Elapsed time 7 seconds.

semantic checker: quit

ntdsutil: quit

C:WindowsNTDS>

if semantic database find any errors. you can use go fix.