Ошибка 0x2105 доступ к репликации отвергнут

Друзья, подскажите в чем проблема? Есть два dc: 1 — DC (Win2003), 2 — PDC (Win2008R2). Глобальный каталог поднят на всех, днс тоже. DC — primary DNS, PDC — secondary DNS. Репликация не проходит, ниже результат dcdiag на PDC. Ошибка 0x2105 «Доступ к
репликации отвергнут.» В чем проблема? В чем проблема и куда копать? Также ниже указал repadmin. На принтеры внимания не обращайте, не до них сейчас. И еще: на DC никаких проблем нет: dcdiag и netdiag  в порядке, repadmin тоже выполняется удачно.
Заранее всем благодарен за ответы.

Hi folks,

I know this error has already been posted a few times here, and I went through all the posts and tried a few suggestions but I am still stuck.

We have 2 domain controllers. They worked fine until they lost the replication functionality this week. We noticed the issue the last time we created user accounts: They were not replicated to the secondary DC. Strangely though, when we tried to create them
manually on the second DC, an error message was saying that they were already there, but we can’t see them in the users list.

I checked the DFS replication log and found errors (http://pastebin.com/fgEQtM4v), but I don’t think the root cause is there.

I checked the system log and found a kerberos error (http://pastebin.com/mmFuMbAc)

«The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server cr-amz-dc$. The target name used was DNS/dc.company.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target
server principal name (SPN) is registered on an account other than the account the target service is using.»

I suspect a Kerberos issue here which refrains the controllers from replicating.. It’s the first time I am troubleshooting a ADDS replication issue and I am not quite sure what to do with that error message.

I checked my spn settings on the primary domain controller (http://pastebin.com/wNiTgbe7) and on the secondary domain controller (pasting here cause pastebin isn’t working) :

setspn -L DC2

Registered ServicePrincipalNames for CN=DC2,OU=Domain Controllers,DC=company,DC=local:

        NtFrs-88f5d2bd-b646-11d2-a6d3-00c04fc9b232/DC2.company.local

        TERMSRV/DC2.company.local

        TERMSRV/DC2

        Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/DC2.company.local

        DNS/DC2.company.local

        GC/DC2.company.local/company.local

        HOST/DC2.company.local/company.local

        HOST/DC2.company.local/company

        ldap/3967f85a-8781-498c-b86e-134fa02165a5._msdcs.company.local

        ldap/DC2.company.local/company

        ldap/DC2

        ldap/DC2.company.local

        ldap/DC2.company.local/ForestDnsZones.company.local

        ldap/DC2.company.local/DomainDnsZones.company.local

        ldap/DC2.company.local/company.local

        E3514235-4B06-11D1-AB04-00C04FC2DCD2/3967f85a-8781-498c-b86e-134fa02165a5/company.local

        HOST/DC2

        HOST/DC2.company.local

==========================================================================================

I’ve tried to run repadmin to get more information :

repadmin /showrep

===========================

Any help would be greatly appreciated

Cheers

Replication Access Was Denied is an Active Directory Error that a user faces. The error is basically an active directory replication error. Users have encountered this in a number of scenarios, which includes using the repadmin /showreps command to check the status of ADC. The error has also been seen while using the Sharepoint 2010 or the Synchroziation service manager. There are multiple causes of this issue, which include issues related to required permission; that is, if your destination domain controller doesn’t have sufficient permissions in order to replicate context/partition, you get this error. Furthermore, the error may also occur if the administrator itself doesn’t have permission to initiate the replication. Let’s go through more of its causes.

Causes of Replication Access Was Denied Error Problem:

In the introductory part, we have already seen a few of its causes. The Error 0x2105 Replication Access Was Denied Sharepoint 2010 error occurs if your destination domain controller has only read-only permission for a period or scheduled replication. Furthermore, it can also happen if you are executing any command without the administrator privileges.

• The domain controller has only read-only permission
• Lack of Administrator privileges
• Administrator itself doesn’t have permission to initiate the replication
• Domain controller doesn’t have sufficient permissions

Similar Types of Replication Access Was Denied Error Issue:

• 8453 replication access was denied 2016
• 0x2105
• Active Directory replication error 8453
• Dfs replication access is denied
• Rpc error 8453
• 8453 fim
• Dcdiag replication error 0x2105
• Get-adreplaccount

To fix Error 0x2105 Replication Access Was Denied Sharepoint 2010 Error we have gathered some troubleshooting method that has been found to be working. The following are the method that we will be demonstrating. In the first method, we will make sure that you are using the admin account for executing any sort of command or making any changes.

1. Use the Administrator Account –

Most of the users get this Error 0x2105 Replication Access Was Denied Sharepoint 2010 error because while executing any important command or making any changes to the active directory or similar, they do not use the administrator account or forget to use the admin account. The first thing you can do is to execute the important command.

• STEP 1. In the Start menu type cmd, right-click on cmd and choose Run as Administrator
• STEP 2. Now type the following command followed by an Enter

repadmin /showreps 

2. Providing Access Rights to the Service Account –

In this method, we will allow the Replicating Directory Changes Permission to the Service account. This is one of the major causes of this error. Follow the steps to fix the Error 0x2105 Replication Access Was Denied SharePoint 2010 issue.

• STEP 1. The first thing you need to do is to log in to your Active Directory Server
• STEP 2. Now Navigate to the following Path on My Computer

C:\WINDOWS\system32\dsa.msc

• STEP 3. Here Open up the Active Directory Users and Computers console
• STEP 4. Now open up the Properties by Right-clicking on to the Domain
• STEP 5. In the Properties window, move to the  Security tab
• STEP 6. Select the specific service account user.
• STEP 7. If you are unable to see the user, click on the “Add” button
• STEP 8. Finally Below the Permissions for Remote Admin
• STEP 9. Locate Replicate Directory Changes permission and Tick on Allow Checkbox

3. Giving Important Rights to Replicate Now Function –

In this method, we will fix the repadmin Replication Access was Denied Sharepoint 2010 issue when using the ‘replicate now’ function or Delegation of Control wizard in the Active Directory. Follow the steps.

• STEP 1. Firstly Open up Adsiedit

• STEP 2. Now make sure to Connect to the following five partitions
  • DC=ForestDnsZones,DC=domain,DC=tld
  • DC=DomainDnsZones,DC=domain,DC=tld
  • CN=Schema,CN=Configuration,DC=domain,DC=tld
  • CN=Configuration,DC=domain,DC=tld
  • DC=domain,DC=tld

**NOTE: Kindly use an account that has Administrator right for Domain, Enterprise & Schema

• STEP 3. Open up the Properties for each Partition, by Right-Clicking on The root directory
• STEP 4. Go the Security tab then click on the Advanced button > Add
• STEP 5. Put the name of the  group that you want to be delegated then click OK
• STEP 6. Make sure that Apply to is set for This object and all descendant objects
• STEP 7. Now Locate Replication synchronization from the list and select it
• STEP 8. Save all the changes

4. Using Command –

If you are still getting this Error run, a health check command to fix the Error 0x2105 Replication Access Was Denied Sharepoint 2010 issue.

• STEP 1. Open the command prompt, make sure that it is running with the Administrator Privileges.
• STEP 2. Now in the command window enter the following command

**NOTE: Make sure to run the command on both Source & Destination Domain Controller

DCDIAG /test:CheckSecurityError

• STEP 3. After executing the command, your error should be fixed

Conclusion:

With this being the end of the article on Error 0x2105 Replication Access Was Denied Sharepoint 2010 Error. We can conclude that following this troubleshooting, and you will surely get rid of this issue. Furthermore, this article tells us briefly about all the causes of this issue. If you still face any problems, tell us in the comments.

We hope this Error 0x2105 Replication Access Was Denied Sharepoint 2010 article solves your issue. For more troubleshooting guides like this. Follow us. Thank you!

Здравствуйте!

Поднял резервный DC сутки назад и заметил, что sysvol не реплицировалась на него
NTP прописан

Логи с владельца FSMO:

Ошибка в журнале —

Служба репликации DFS не обнаружила настроенных подключений для группы репликации Domain System Volume. Данные для этой группы репликации не реплицируются. 
 
Дополнительные сведения: 
Идентификатор группы репликации: C4C4781F-3AD3-41B0-9835-F5A389DCAAF0 
Идентификатор члена: 1F29C088-9083-4E4F-A<code></code>832-C922B42B75D4

dcdiag /q —

За последние 24 часа после предоставления SYSVOL в общий доступ зафиксированы предупреждения или сообщения  об
         ошибках.  Сбои при репликации SYSVOL могут стать причиной проблем групповой политики.
         ......................... MPADSERV - не пройдена проверка DFSREvent

DFSR c каким-то неопределенным членом репликации (видимо когда-то насильно убитый DC)

net share Нужные папки среди прочих присутствуют —

NETLOGON     C:\Windows\SYSVOL\sysvol\MPAD.local\SCRIPTS
SYSVOL       C:\Windows\SYSVOL\sysvol

Логи с резервного DC:

Вот такое есть в журнале —

Служба репликации DFS успешно установила входящее подключение  с партнером MPADSERV для группы репликации Domain System Volume.

dcdiag /q

Внимание: DsGetDcName вернул сведения для \\MPADSERV.MPAD.local при попытке получения доступа к DCSERV2.
         СЕРВЕР НЕ ОТВЕЧАЕТ или НЕ СЧИТАЕТСЯ ПРИЕМЛЕМЫМ.
         ......................... DCSERV2 - не пройдена проверка Advertising
         За последние 24 часа после предоставления SYSVOL в общий доступ зафиксированы предупреждения или сообщения  об ошибках.  Сбои при репликации SYSVOL могут стать причиной проблем групповой политики.
         ......................... DCSERV2 - не пройдена проверка DFSREvent
         Не удается подключиться к общему ресурсу NETLOGON. (\\DCSERV2\netlogon)
         [DCSERV2] Сбой операции net use или LsaPolicy с ошибкой 67, Не найдено сетевое имя..
         ......................... DCSERV2 - не пройдена проверка NetLogons
         [Проверка репликации,DCSERV2] Сбой функции DsReplicaGetInfo(PENDING_OPS, NULL), ошибка 0x2105 "Доступ к репликации отвергнут."
         ......................... DCSERV2 - не пройдена проверка Replications
         Возникла ошибка. Код события (EventID): 0x00000051
            Время создания: 08/05/2020   13:04:00
            Строка события: LogExtendedErrorInformation (974): Extended RPC error information:
         ......................... DCSERV2 - не пройдена проверка SystemLog

DFSR — тоже самое

net share — Нужные папки отсутствуют

В какую сторону курить?