When running: «DCDiag /test:NCSecDesc» I get the following.
Doing primary tests
Testing server: DomainDC1
Starting test: NCSecDesc
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=Domain,DC=com
……………………. <DC1> failed test NCSecDesc
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : Domain
Running enterprise tests on : Domain.com
I recently just added two windows 2012 R2 DC’s into the environment, one of thoses holds the FSMO roles as well as the NTP server information, below is the ADPREP change information taken from ADSI.
Schema Version
69
ForestPrep Version
15
RODCPrep Version
2
DomainPrep Version
10
So besides running «ADPrep /rodcprep» is there any other way to fix this issue? What am I missing?
Note: Replication, DNS, sysvol, etc. all come back good, this is the only error. Also the «enterprise domain controllers» group has full control set for «this object only»
-
Edited by
Thursday, June 18, 2015 4:53 PM
Added more information
When running: «DCDiag /test:NCSecDesc» I get the following.
Doing primary tests
Testing server: DomainDC1
Starting test: NCSecDesc
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=Domain,DC=com
……………………. <DC1> failed test NCSecDesc
Running partition tests on : ForestDnsZones
Running partition tests on : DomainDnsZones
Running partition tests on : Schema
Running partition tests on : Configuration
Running partition tests on : Domain
Running enterprise tests on : Domain.com
I recently just added two windows 2012 R2 DC’s into the environment, one of thoses holds the FSMO roles as well as the NTP server information, below is the ADPREP change information taken from ADSI.
Schema Version
69
ForestPrep Version
15
RODCPrep Version
2
DomainPrep Version
10
So besides running «ADPrep /rodcprep» is there any other way to fix this issue? What am I missing?
Note: Replication, DNS, sysvol, etc. all come back good, this is the only error. Also the «enterprise domain controllers» group has full control set for «this object only»
- Edited by
Thursday, June 18, 2015 4:53 PM
Added more information
Запуск проверки: NCSecDesc
* Security Permissions check for all NC’s on DC PDC.
The forest is not ready for RODC. Will skip checking ERODC ACEs.
* Проверка разрешений безопасности для
DC=ForestDnsZones,DC=DOMAIN,DC=Local
(NDNC,Version 3)
Ошибка — NT AUTHORITYКОНТРОЛЛЕРЫ ДОМЕНА ПРЕДПРИЯТИЯ не имеет
Replicating Directory Changes In Filtered Set
прав доступа для контекста именования:
DC=ForestDnsZones,DC=DOMAIN,DC=Local
* Проверка разрешений безопасности для
DC=DomainDnsZones,DC=DOMAIN,DC=Local
(NDNC,Version 3)
Ошибка — NT AUTHORITYКОНТРОЛЛЕРЫ ДОМЕНА ПРЕДПРИЯТИЯ не имеет
Replicating Directory Changes In Filtered Set
прав доступа для контекста именования:
DC=DomainDnsZones,DC=DOMAIN,DC=Local
* Проверка разрешений безопасности для
CN=Schema,CN=Configuration,DC=DOMAIN,DC=Local
(Schema,Version 3)
* Проверка разрешений безопасности для
CN=Configuration,DC=DOMAIN,DC=Local
(Configuration,Version 3)
* Проверка разрешений безопасности для
DC=DOMAIN,DC=Local
(Domain,Version 3)
……………………. PDC — не пройдена проверка NCSecDesc
This was a real pain and we ended up having to call Microsoft and spend several hours to resolve what seem to be a simple issue. When running dcdiag you get an error that the NCSecDesc test failed with:
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=cosgro,DC=com
Normally running adprep /rodcprep at the command line would correct the issues but in this case we kept getting the same response when running adprep.
Adprep detected the operation on partition DC=ForestDnsZones,DC=cosgro,DC=com has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=DomainDnsZones,DC=cosgro,DC=com has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=cosgro,DC=com has been performe d. Skipping to next partition. ============================================================================== Adprep completed without errors. All partitions are updated. See the ADPrep.log in directory C:Windowsdebugadpreplogs20130213141646 for more information.
And when we re ran DCDiag we would still get the same error. All the online documents say this should of resolved the issues but it had not.
The problem was not the ADPrep /rodcprep but the permissions were seen to be to “open” for the Enterprise Domain Controllers Group. The security permissions for this group was set to “full” on the main domain partition. This set of permissions needed to be more restrictive for the group. To fix we needed to open ADSI Edit and reset the permissions on the domain partition.
The picture below shows you where the domain partition resides, right click the partition and select properties.
Then on the pop up windows select the security tab. In the Groups and Users box find the “Enterprise Domain Controllers” group and then uncheck all permissions.
Now re-add only the list below to the allow column.
- Manage replication topology
- Replicating Directory Changes
- Replicating Directory Changes All
- Replicating Directory Changes In Filtered Set
- Replication Synchronization
Apply the changes and rerun DCDiag to verify that the changes are working.
Thats it.
Enjoy Cubert 😎
Запуск проверки: NCSecDesc
* Security Permissions check for all NC’s on DC PDC.
The forest is not ready for RODC. Will skip checking ERODC ACEs.
* Проверка разрешений безопасности для
DC=ForestDnsZones,DC=DOMAIN,DC=Local
(NDNC,Version 3)
Ошибка — NT AUTHORITYКОНТРОЛЛЕРЫ ДОМЕНА ПРЕДПРИЯТИЯ не имеет
Replicating Directory Changes In Filtered Set
прав доступа для контекста именования:
DC=ForestDnsZones,DC=DOMAIN,DC=Local
* Проверка разрешений безопасности для
DC=DomainDnsZones,DC=DOMAIN,DC=Local
(NDNC,Version 3)
Ошибка — NT AUTHORITYКОНТРОЛЛЕРЫ ДОМЕНА ПРЕДПРИЯТИЯ не имеет
Replicating Directory Changes In Filtered Set
прав доступа для контекста именования:
DC=DomainDnsZones,DC=DOMAIN,DC=Local
* Проверка разрешений безопасности для
CN=Schema,CN=Configuration,DC=DOMAIN,DC=Local
(Schema,Version 3)
* Проверка разрешений безопасности для
CN=Configuration,DC=DOMAIN,DC=Local
(Configuration,Version 3)
* Проверка разрешений безопасности для
DC=DOMAIN,DC=Local
(Domain,Version 3)
……………………. PDC — не пройдена проверка NCSecDesc
This was a real pain and we ended up having to call Microsoft and spend several hours to resolve what seem to be a simple issue. When running dcdiag you get an error that the NCSecDesc test failed with:
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=cosgro,DC=com
Normally running adprep /rodcprep at the command line would correct the issues but in this case we kept getting the same response when running adprep.
Adprep detected the operation on partition DC=ForestDnsZones,DC=cosgro,DC=com has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=DomainDnsZones,DC=cosgro,DC=com has been performed. Skipping to next partition. ============================================================================== Adprep detected the operation on partition DC=cosgro,DC=com has been performe d. Skipping to next partition. ============================================================================== Adprep completed without errors. All partitions are updated. See the ADPrep.log in directory C:Windowsdebugadpreplogs20130213141646 for more information.
And when we re ran DCDiag we would still get the same error. All the online documents say this should of resolved the issues but it had not.
The problem was not the ADPrep /rodcprep but the permissions were seen to be to “open” for the Enterprise Domain Controllers Group. The security permissions for this group was set to “full” on the main domain partition. This set of permissions needed to be more restrictive for the group. To fix we needed to open ADSI Edit and reset the permissions on the domain partition.
The picture below shows you where the domain partition resides, right click the partition and select properties.
Then on the pop up windows select the security tab. In the Groups and Users box find the “Enterprise Domain Controllers” group and then uncheck all permissions.
Now re-add only the list below to the allow column.
- Manage replication topology
- Replicating Directory Changes
- Replicating Directory Changes All
- Replicating Directory Changes In Filtered Set
- Replication Synchronization
Apply the changes and rerun DCDiag to verify that the changes are working.
Thats it.
Enjoy Cubert 😎
The other day I came across an error while troubeshooting a problem I had from a run of dcdiag:
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=my,DC=domain
Error NT AUTHORITYENTERPRISE DOMAIN CONTROLLERS doesn’t have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=my,DC=domain
This indicates a permission problem with the ENTERPRISE DOMAIN CONTROLLERS security group and it’s ability to replicate directorty changes in a filtered set.
To resolve this issue we go to adsiedit on our PDC >> Action >> «Connect to…» >> «Select a type or a Distinguished Name or Naming Context» and enter (replacing the obvious):
DC=ForestDnsZones,DC=my,DC=domain
Expand the new tree node and right hand-click on «DC=ForestDnsZones,DC=my,DC=domain» >> Properties >> Security
and identify the security group «ENTERPRISE DOMAIN CONTROLLERS» and ensure that the «Replicating Directory Changes In Filtered Set» is ticked / set to allowed.
We should then do exactly the same for the «DC=DomainDnsZones,DC=my,DC=domain» partition.
Ensure dcdiag now returns OK and then….
We then proceed by going onto the DC with the permission issues and syncing the changes while specifying the source sever as our PDC:
repadmin /syncall myPDC /APed