Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » Re: Event ID 404 Errors
Re: Event ID 404 Errors [message #159067] Thu, 23 July 2009 14:23 Go to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
Does anyone have any ideas on this?

"Zachary Dundore" <zdundore@agraind.com> wrote in message
news:eFcNaxjBKHA.1492@TK2MSFTNGP03.phx.gbl...
> You are correct, this is happening to our domain controller, not our
> exchange server. I haven't seen this error on any other DCs. Through my
> research on this error i have found that first link you gave me, i just
> haven't been 100% sure where to start solving this issue. I have
> inherited this server from the previous IT staff here and it is riddled
> with errors. Here are a few others may this will help determine the source
> of these errors. With the huge variety of errors, i just don't know where
> to start.
>
> Event Type: Error
> Event Source: DNS
> Event Category: None
> Event ID: 4011
> Date: 7/16/2009
> Time: 12:23:00 PM
> User: N/A
> Computer: AGRADC
> Description:
> The DNS server was unable to add or write an update of domain name
> dmarcott-d620 in zone agraind.com to the Active Directory. Check that the
> Active Directory is functioning properly and add or update this domain
> name using the DNS console. The event data contains the error.
> Data:
> 0000: 2a 23 00 00 *#..
>
> Event Type: Error
> Event Source: NTDS Replication
> Event Category: Replication
> Event ID: 1084
> Date: 7/16/2009
> Time: 12:37:25 PM
> User: Everyone
> Computer: AGRADC
> Description:
> Replication error: The directory replication agent (DRA) couldn't update
> object DC=agraind,DC=com (GUID 58e7cb75-97ed-4d02-b290-ca7aa44a7c3e) on
> this system with changes which have been received from source server
> 3767b967-35ba-4cd3-a1c9-a1665dcf6f45._msdcs.agraind.com. An error occurred
> during the application of the changes to the directory database on this
> system.
>
> The error message is:
> The replication operation encountered a database error.
>
> The directory will try to update the object later on the next replication
> cycle. Synchronization of this server with the source is effectively
> blocked until the update problem is corrected.
> If this condition appears to be related to a resource shortage, please
> stop and restart this Windows Domain Controller.
> If this condition is an internal error, a database error, or an object
> relationship or constraint error, manual intervention will be required to
> correct the database and allow the update to proceed. It is valuable to
> note that the problem is caused by the fact that the change on the remote
> system cannot be applied locally. Manually updating the objects on the
> local system in not recommended. Instead, on the source system (which has
> the changes already), try to reverse or back out the change. Then, on the
> next replication cycle, observe whether the change can now be applied
> locally.
> The record data is the status code.
> Data:
> 0000: 03 21 00 00 .!..
>
> Event Type: Error
> Event Source: Wins
> Event Category: None
> Event ID: 4224
> Date: 7/16/2009
> Time: 12:37:10 PM
> User: N/A
> Computer: AGRADC
> Description:
> WINS encountered a database error. This may or may not be a serious error.
> WINS will try to recover from it. You can check the database error events
> under 'Application Log' category of the Event Viewer for the Exchange
> Component, ESENT, source to find out more details about database errors.
> If you continue to see a large number of these errors consistently over
> time (a span of few hours), you may want to restore the WINS database from
> a backup. The error number is in the second DWORD of the data section.
> Data:
> 0000: 1a 0c 00 00 02 fe ff ff .....
>
> "Anderson Lacruz" <AndersonLacruz@discussions.microsoft.com> wrote in
> message news:9A91CFD2-7C1A-4E81-AE12-3A97080C1338@microsoft.com...
>> Hi Zachary
>>
>> According with your info this situation is happening in one of your
>> domain
>> controllers. The problems and events are persisting?
>> I have seen this error with Microsoft Exchange as well. For that reason I
>> want to be sure.
>>
>> If this situation is related with AD I will recommend you first to try to
>> do
>> a maintenance off line with NTDSUtil. Here a link:
>> http://support.microsoft.com/kb/232122/
>> probably is gonna recommend you a integrety check and semantic analysis
>>
>> Another option is to disjoin the domain controller and making dcpromo
>> again.
>> Of course, verify is this situation isn't happening in the rest of domain
>> controllers
>>
>> Some extra links:
>> http://technet.microsoft.com/en-us/library/bb217671.aspx
>> http://www.eventid.net/display.asp?eventid=404&eventno=1 267&source=ESENT&phase=1
>>
>> I hope this can be helpful
>> Regards
>> Anderson Lacruz
>>
>> "Zachary Dundore" wrote:
>>
>>> On our primary domain controller running windows 2000 server we are
>>> recieving hundreds of Event 404 errors from ESENT. Here is the error:
>>>
>>> Event Type: Error
>>> Event Source: ESENT
>>> Event Category: Database Page Cache
>>> Event ID: 404
>>> Date: 7/16/2009
>>> Time: 7:48:30 AM
>>> User: N/A
>>> Computer: AGRADC
>>> Description:
>>> services (356) Synchronous read page checksum error -1018 ((1:101 1:101)
>>> (0-2269837) (0-2270709)) occurred. Please restore the databases from a
>>> previous backup.
>>>
>>> Is this telling me there is an error with the active directory database?
>>>
>>>
>>>
>
>
Re: Event ID 404 Errors [message #159080 is a reply to message #159067] Thu, 23 July 2009 17:58 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message news:Og2f1K8CKHA.1492@TK2MSFTNGP03.phx.gbl...
> Does anyone have any ideas on this?


Appears to me that AGRADC possibly has hard drive problems, corruption, etc, due to the fact it's indicating there are database errors with AD and WINS. That seems the common thread and correlation among the errors.

What other eventIDs do you see in the system log?
Are there any delay read/write errors?
What vendor and model is the server?
What controller is in it? IDE, SATA or SCSI? Using RAID? If so, What level?

Is there any type of Controller or drive management pack or tool that came with it from the system vendor or controller vendor? For example, Dell uses Open Manage System Administrator to view system hardware health and events. LSI and Adaptec come with their own management tools, if installed after the fact.

More info on the eventIDs you are seeing:

404
http://eventid.net/display.asp?eventid=404&eventno=1267& amp;source=ESENT&phase=1

4011 (possibly due to AD database corruption)
http://eventid.net/display.asp?eventid=4011&eventno=483& amp;source=DNS&phase=1

1084 (also possibly due to AD database corruption)
http://eventid.net/display.asp?eventid=1084&eventno=980& amp;source=NTDS Replication&phase=1

4224 - WINS corruption.
http://eventid.net/display.asp?eventid=4224&eventno=1052 &source=wins&phase=1

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.

Please reply back to the newsgroup or forum to benefit from collaboration among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Messaging, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org
http://twitter.com/acefekay

For urgent issues, you may want to contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers.
Re: Event ID 404 Errors [message #159119 is a reply to message #159080] Fri, 24 July 2009 11:48 Go to previous messageGo to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
So i went to the server room and found that one of the drives has failed.
We have 11 HDs in the server with two arrays a 5 drive and 6 drive array.
We no longer want this server in our system. We have been moving to
demoting this server. Would it be unwise for us to run a demotion with all
of these errors going on?

"Ace Fekay [MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
news:uVSNrC%23CKHA.3732@TK2MSFTNGP02.phx.gbl...
"Zachary" <zdundore@agraind.com> wrote in message
news:Og2f1K8CKHA.1492@TK2MSFTNGP03.phx.gbl...
> Does anyone have any ideas on this?


Appears to me that AGRADC possibly has hard drive problems, corruption, etc,
due to the fact it's indicating there are database errors with AD and WINS.
That seems the common thread and correlation among the errors.

What other eventIDs do you see in the system log?
Are there any delay read/write errors?
What vendor and model is the server?
What controller is in it? IDE, SATA or SCSI? Using RAID? If so, What level?

Is there any type of Controller or drive management pack or tool that came
with it from the system vendor or controller vendor? For example, Dell uses
Open Manage System Administrator to view system hardware health and events.
LSI and Adaptec come with their own management tools, if installed after the
fact.

More info on the eventIDs you are seeing:

404
http://eventid.net/display.asp?eventid=404&eventno=1267& amp;source=ESENT&phase=1

4011 (possibly due to AD database corruption)
http://eventid.net/display.asp?eventid=4011&eventno=483& amp;source=DNS&phase=1

1084 (also possibly due to AD database corruption)
http://eventid.net/display.asp?eventid=1084&eventno=980& amp;source=NTDS
Replication&phase=1

4224 - WINS corruption.
http://eventid.net/display.asp?eventid=4224&eventno=1052 &source=wins&phase=1

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum to benefit from collaboration
among responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Messaging, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org
http://twitter.com/acefekay

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Re: Event ID 404 Errors [message #159136 is a reply to message #159119] Fri, 24 July 2009 15:17 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message news:uN5M1YHDKHA.4432@TK2MSFTNGP05.phx.gbl...
> So i went to the server room and found that one of the drives has failed.
> We have 11 HDs in the server with two arrays a 5 drive and 6 drive array.
> We no longer want this server in our system. We have been moving to
> demoting this server. Would it be unwise for us to run a demotion with all
> of these errors going on?

As I suspected.

I would go ahead and demote it. If it won't demote, you can use:
dcpromo /forceremoval

Then make sure the FSMO roles, if any, are transferred or seized to another DC in the domain.

In either instances, if it demotes, make sure you delete the Sites and Services computer object.

If that doesn't work, you will simply unplug it, and run the Metadata Cleanup procedure in:
http://support.microsoft.com/kb/216498

Then delete the server object in Sites and Services.

Ace
Re: Event ID 404 Errors [message #159144 is a reply to message #159136] Fri, 24 July 2009 16:20 Go to previous messageGo to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
We are planning on rebuilding the server after we demote it so i am going to
wait for the new hard drive and then demote the server.
"Ace Fekay [MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
news:%23Cw9VNJDKHA.4168@TK2MSFTNGP05.phx.gbl...
"Zachary" <zdundore@agraind.com> wrote in message
news:uN5M1YHDKHA.4432@TK2MSFTNGP05.phx.gbl...
> So i went to the server room and found that one of the drives has failed.
> We have 11 HDs in the server with two arrays a 5 drive and 6 drive array.
> We no longer want this server in our system. We have been moving to
> demoting this server. Would it be unwise for us to run a demotion with all
> of these errors going on?

As I suspected.

I would go ahead and demote it. If it won't demote, you can use:
dcpromo /forceremoval

Then make sure the FSMO roles, if any, are transferred or seized to another
DC in the domain.

In either instances, if it demotes, make sure you delete the Sites and
Services computer object.

If that doesn't work, you will simply unplug it, and run the Metadata
Cleanup procedure in:
http://support.microsoft.com/kb/216498

Then delete the server object in Sites and Services.

Ace
Re: Event ID 404 Errors [message #159155 is a reply to message #159144] Fri, 24 July 2009 19:16 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message news:uptfAxJDKHA.5040@TK2MSFTNGP04.phx.gbl...
> We are planning on rebuilding the server after we demote it so i am going to
> wait for the new hard drive and then demote the server.

Sounds good. Keep us updated, please.

Good luck!

Ace
Re: Event ID 404 Errors [message #159156 is a reply to message #159144] Fri, 24 July 2009 19:18 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message
news:uptfAxJDKHA.5040@TK2MSFTNGP04.phx.gbl...
> We are planning on rebuilding the server after we demote it so i am going
> to wait for the new hard drive and then demote the server.

Also let us know if it demoted easily, or if you had to force it.

Ace
Re: Event ID 404 Errors [message #159379 is a reply to message #159156] Wed, 29 July 2009 09:27 Go to previous messageGo to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
Update:

I tried demoting the server last night and found i can't yet. Certificate
services are running on the server and i am unable to run dcpromo because of
this. I am unsure as to what exactly certificate services are doing on this
server right now. After i find out what this is doing for us i hope to
remove it and then demote the server.

"Ace Fekay [MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
news:Osl%23%23TLDKHA.5040@TK2MSFTNGP04.phx.gbl...
> "Zachary" <zdundore@agraind.com> wrote in message
> news:uptfAxJDKHA.5040@TK2MSFTNGP04.phx.gbl...
>> We are planning on rebuilding the server after we demote it so i am going
>> to wait for the new hard drive and then demote the server.
>
> Also let us know if it demoted easily, or if you had to force it.
>
> Ace
>
>
Re: Event ID 404 Errors [message #159398 is a reply to message #159379] Wed, 29 July 2009 13:23 Go to previous messageGo to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
After futher reasearch i found this website and another error inbetween the
404 errors. I think they are related and the demotion would be overkill.
Any opinions?

http://support.microsoft.com/default.aspx?scid=kb;en-us;278316

Event Type: Warning
Event Source: SceCli
Event Category: None
Event ID: 1202
Date: 7/29/2009
Time: 12:16:45 PM
User: N/A
Computer: AGRADC
Description:
Security policies are propagated with warning. 0x4b8 : An extended error has
occurred.

For best results in resolving this event, log on with a non-administrative
account and search http://support.microsoft.com for "Troubleshooting Event
1202s".

"Zachary" <zdundore@agraind.com> wrote in message
news:e5nhRBFEKHA.1492@TK2MSFTNGP03.phx.gbl...
> Update:
>
> I tried demoting the server last night and found i can't yet. Certificate
> services are running on the server and i am unable to run dcpromo because
> of this. I am unsure as to what exactly certificate services are doing on
> this server right now. After i find out what this is doing for us i hope
> to remove it and then demote the server.
>
> "Ace Fekay [MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
> news:Osl%23%23TLDKHA.5040@TK2MSFTNGP04.phx.gbl...
>> "Zachary" <zdundore@agraind.com> wrote in message
>> news:uptfAxJDKHA.5040@TK2MSFTNGP04.phx.gbl...
>>> We are planning on rebuilding the server after we demote it so i am
>>> going to wait for the new hard drive and then demote the server.
>>
>> Also let us know if it demoted easily, or if you had to force it.
>>
>> Ace
>>
>>
>
>
Re: Event ID 404 Errors [message #159452 is a reply to message #159398] Wed, 29 July 2009 20:35 Go to previous messageGo to next message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message
news:OqBsJFHEKHA.1492@TK2MSFTNGP03.phx.gbl...
> After futher reasearch i found this website and another error inbetween
> the 404 errors. I think they are related and the demotion would be
> overkill. Any opinions?
>
> http://support.microsoft.com/default.aspx?scid=kb;en-us;278316
>

Hmm, I must have missed that in your previous posts, unless it was not
posted?

Sure, give it a shot. If it works, no problem, if not, you were facing a
demotion anyway, right?

Ace
Re: Event ID 404 Errors [message #159510 is a reply to message #159452] Thu, 30 July 2009 14:16 Go to previous messageGo to next message
Zachary Dundore  is currently offline Zachary Dundore  United States
Messages: 61
Registered: July 2009
Member
Yeah we were going to anyway, we just need to find out what certificate
services are doing on the server first. Don't want to disable a server if
it still is running a valid service for our network. I inherited this
network about three weeks ago.

"Ace Fekay [MCT]" <aceman@mvps.RemoveThisPart.org> wrote in message
news:OEFPx2KEKHA.1340@TK2MSFTNGP05.phx.gbl...
> "Zachary" <zdundore@agraind.com> wrote in message
> news:OqBsJFHEKHA.1492@TK2MSFTNGP03.phx.gbl...
>> After futher reasearch i found this website and another error inbetween
>> the 404 errors. I think they are related and the demotion would be
>> overkill. Any opinions?
>>
>> http://support.microsoft.com/default.aspx?scid=kb;en-us;278316
>>
>
> Hmm, I must have missed that in your previous posts, unless it was not
> posted?
>
> Sure, give it a shot. If it works, no problem, if not, you were facing a
> demotion anyway, right?
>
> Ace
Re: Event ID 404 Errors [message #159528 is a reply to message #159510] Thu, 30 July 2009 20:38 Go to previous message
aceman  is currently offline aceman  United States
Messages: 5816
Registered: July 2009
Senior Member
"Zachary" <zdundore@agraind.com> wrote in message
news:eLHijHUEKHA.5452@TK2MSFTNGP03.phx.gbl...
> Yeah we were going to anyway, we just need to find out what certificate
> services are doing on the server first. Don't want to disable a server if
> it still is running a valid service for our network. I inherited this
> network about three weeks ago.
>

Tell you what, read the following articles before you trash the cert
services, just in case it's being used for something (such as a simple web
server certificate, or for Exchange OWA).

How to remove manually Enterprise Windows Certificate Authority from Windows
2000/2003 Domain
http://support.microsoft.com/kb/555151

How to decommission a Windows enterprise certification authority and how to
remove all related objects from Windows Server 2003 and from Windows Server
2000
http://support.microsoft.com/?id=889250

HOWTO: Move a certificate authority to a new server running on a 2003 or
2008 CA, Standard or Enterprise
http://directoryservicesconsulting.ca/index.php/2009/04/17/h owto-move-a-certificate-authority-to-a-new-server-running-on -a-domain-controller/

HOWTO: Move a certificate authority to a new server running on a domain
controller (2003).
http://support.microsoft.com/?id=555012

Ace
Previous Topic:Password question
Next Topic:ntlm / kerberos
Goto Forum:
  


Current Time: Sat Oct 21 18:53:40 EDT 2017

Total time taken to generate the page: 0.09193 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software