https://pastein.ru/t/dMB
Загрузка данных
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>dcdiag
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
Home Server = DC2
* Identified AD Forest.
Done gathering initial info.
Doing initial required tests
Testing server: MILANE\DC2
Starting test: Connectivity
......................... DC2 passed test Connectivity
Doing primary tests
Testing server: MILANE\DC2
Starting test: Advertising
Warning: DC2 is not advertising as a time server.
......................... DC2 failed test Advertising
Starting test: FrsEvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
......................... DC2 failed test FrsEvent
Starting test: DFSREvent
......................... DC2 passed test DFSREvent
Starting test: SysVolCheck
......................... DC2 passed test SysVolCheck
Starting test: KccEvent
......................... DC2 passed test KccEvent
Starting test: KnowsOfRoleHolders
[DC1] DsBindWithSpnEx() failed with error -2146893022,
The target principal name is incorrect..
Warning: DC1 is the Schema Owner, but is not responding to DS RPC Bind.
[DC1] LDAP bind failed with error 8341,
A directory service error has occurred..
Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Domain Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Domain Owner, but is not responding to LDAP Bind.
Warning: DC1 is the PDC Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the PDC Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Rid Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Rid Owner, but is not responding to LDAP Bind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to DS RPC Bind.
Warning: DC1 is the Infrastructure Update Owner, but is not responding to LDAP Bind.
......................... DC2 failed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... DC2 passed test MachineAccount
Starting test: NCSecDesc
......................... DC2 passed test NCSecDesc
Starting test: NetLogons
......................... DC2 passed test NetLogons
Starting test: ObjectsReplicated
......................... DC2 passed test ObjectsReplicated
Starting test: Replications
[Replications Check,DC2] A recent replication attempt failed:
From FDC to DC2
Naming Context: DC=ForestDnsZones,DC=milane,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2026-06-22 12:58:14.
The last success occurred at 2018-09-16 06:01:45.
67994 failures have occurred since the last success.
[FDC] DsBindWithSpnEx() failed with error 1722,
The RPC server is unavailable..
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=ForestDnsZones,DC=milane,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2026-06-22 12:58:56.
The last success occurred at 2026-05-04 10:01:35.
1174 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From FDC to DC2
Naming Context: DC=DomainDnsZones,DC=milane,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2026-06-22 12:58:14.
The last success occurred at 2018-09-16 06:33:18.
67994 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=DomainDnsZones,DC=milane,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2026-06-22 12:58:56.
The last success occurred at 2026-05-04 10:17:55.
1668 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Schema,CN=Configuration,DC=milane,DC=local
The replication generated an error (5):
Access is denied.
The failure occurred at 2026-06-22 12:58:56.
The last success occurred at 2026-05-04 10:00:11.
1136 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From FDC to DC2
Naming Context: CN=Schema,CN=Configuration,DC=milane,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2026-06-22 12:59:38.
The last success occurred at 2018-09-16 06:00:21.
67992 failures have occurred since the last success.
The source remains down. Please check the machine.
[Replications Check,DC2] A recent replication attempt failed:
From FDC to DC2
Naming Context: CN=Configuration,DC=milane,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2026-06-22 12:58:56.
The last success occurred at 2018-09-16 06:00:21.
67994 failures have occurred since the last success.
The source remains down. Please check the machine.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Configuration,DC=milane,DC=local
The replication generated an error (5):
Access is denied.
The failure occurred at 2026-06-22 12:58:56.
The last success occurred at 2026-05-04 10:00:11.
1137 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From FDC to DC2
Naming Context: DC=milane,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2026-06-22 12:58:14.
The last success occurred at 2018-09-16 06:46:37.
67992 failures have occurred since the last success.
The source remains down. Please check the machine.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=milane,DC=local
The replication generated an error (5):
Access is denied.
The failure occurred at 2026-06-22 12:59:38.
The last success occurred at 2026-05-04 10:25:37.
1342 failures have occurred since the last success.
......................... DC2 failed test Replications
Starting test: RidManager
......................... DC2 failed test RidManager
Starting test: Services
......................... DC2 passed test Services
Starting test: SystemLog
A warning event occurred. EventID: 0x00000C18
Time Generated: 06/22/2026 12:42:37
Event String: The primary Domain Controller for this domain could not be located.
A warning event occurred. EventID: 0x000727AA
Time Generated: 06/22/2026 12:42:53
Event String: The WinRM service failed to create the following SPNs: WSMAN/DC2.milane.local; WSMAN/DC2.
An error event occurred. EventID: 0x00000469
Time Generated: 06/22/2026 12:42:53
Event String:
The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has successfully processed. If you do not see a success message for several hours, then contact your administrator.
A warning event occurred. EventID: 0x00000081
Time Generated: 06/22/2026 12:43:01
Event String:
NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)
A warning event occurred. EventID: 0x00000081
Time Generated: 06/22/2026 12:43:02
Event String:
NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)
An error event occurred. EventID: 0x0000168F
Time Generated: 06/22/2026 12:46:33
Event String:
The dynamic deletion of the DNS record '_ldap._tcp.gc._msdcs.milane.local. 600 IN SRV 0 100 3268 DC2.milane.local.' failed on the following DNS server:
An error event occurred. EventID: 0x0000168F
Time Generated: 06/22/2026 12:46:33
Event String:
The dynamic deletion of the DNS record 'gc._msdcs.milane.local. 600 IN AAAA 2a03:1ac0:b0d4:c331::1:102' failed on the following DNS server:
An error event occurred. EventID: 0x0000168F
Time Generated: 06/22/2026 12:46:33
Event String:
The dynamic deletion of the DNS record 'gc._msdcs.milane.local. 600 IN AAAA 2a03:1ac0:b0d4:c331:2028:9ed:78a7:4fcc' failed on the following DNS server:
An error event occurred. EventID: 0x0000168F
Time Generated: 06/22/2026 12:46:33
Event String:
The dynamic deletion of the DNS record 'gc._msdcs.milane.local. 600 IN A 10.10.1.102' failed on the following DNS server:
An error event occurred. EventID: 0x0000168F
Time Generated: 06/22/2026 12:46:33
Event String:
The dynamic deletion of the DNS record '_gc._tcp.milane.local. 600 IN SRV 0 100 3268 DC2.milane.local.' failed on the following DNS server:
A warning event occurred. EventID: 0xC000042B
Time Generated: 06/22/2026 12:46:37
Event String:
The RD Session Host server cannot register 'TERMSRV' Service Principal Name to be used for server authentication. The following error occured: Access is denied.
A warning event occurred. EventID: 0x00001796
Time Generated: 06/22/2026 12:54:14
Event String:
Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and this server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
An error event occurred. EventID: 0x000016AD
Time Generated: 06/22/2026 13:09:52
Event String:
The session setup from the computer WS-PC-38 failed to authenticate. The following error occurred:
An error event occurred. EventID: 0x000016AD
Time Generated: 06/22/2026 13:12:52
Event String:
The session setup from the computer WS-PC-88 failed to authenticate. The following error occurred:
An error event occurred. EventID: 0x000016AD
Time Generated: 06/22/2026 13:17:39
Event String:
The session setup from the computer WS-PC-02 failed to authenticate. The following error occurred:
An error event occurred. EventID: 0x000003EE
Time Generated: 06/22/2026 13:27:21
Event String:
The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.
An error event occurred. EventID: 0x40000004
Time Generated: 06/22/2026 13:28:50
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was LDAP/af4d8c14-3206-4c7a-9f74-336624eab87f._msdcs.milane.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MILANE.LOCAL) is different from the client domain (MILANE.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
An error event occurred. EventID: 0x40000004
Time Generated: 06/22/2026 13:28:50
Event String:
The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was ldap/DC1.milane.local. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MILANE.LOCAL) is different from the client domain (MILANE.LOCAL), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.
......................... DC2 failed test SystemLog
Starting test: VerifyReferences
......................... DC2 passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation
Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation
Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Running partition tests on : milane
Starting test: CheckSDRefDom
......................... milane passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... milane passed test CrossRefValidation
Running enterprise tests on : milane.local
Starting test: LocatorCheck
Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
A Primary Domain Controller could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(TIME_SERVER) call failed, error 1355
A Time Server could not be located.
The server holding the PDC role is down.
Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355
A Good Time Server could not be located.
......................... milane.local failed test LocatorCheck
Starting test: Intersite
......................... milane.local passed test Intersite
C:\Windows\system32>dcdiag /c /v
Directory Server Diagnosis
Performing initial setup:
Trying to find home server...
* Verifying that the local machine DC2, is a Directory Server.
Home Server = DC2
* Connecting to directory service on server DC2.
* Identified AD Forest.
Collecting AD specific global data
* Collecting site info.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=milane,DC=local,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
The previous call succeeded
Iterating through the sites
Looking at base site object: CN=NTDS Site Settings,CN=MILANE,CN=Sites,CN=Configuration,DC=milane,DC=local
Getting ISTG and options for the site
* Identifying all servers.
Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=milane,DC=local,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
The previous call succeeded....
The previous call succeeded
Iterating through the list of servers
Getting information for the server CN=NTDS Settings,CN=DC1,CN=Servers,CN=MILANE,CN=Sites,CN=Configuration,DC=milane,DC=local
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
Getting information for the server CN=NTDS Settings,CN=SDC,CN=Servers,CN=MILANE,CN=Sites,CN=Configuration,DC=milane,DC=local
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
Getting information for the server CN=NTDS Settings,CN=FDC,CN=Servers,CN=MILANE,CN=Sites,CN=Configuration,DC=milane,DC=local
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
Getting information for the server CN=NTDS Settings,CN=DC2,CN=Servers,CN=MILANE,CN=Sites,CN=Configuration,DC=milane,DC=local
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
* Identifying all NC cross-refs.
* Found 4 DC(s). Testing 1 of them.
Done gathering initial info.
Doing initial required tests
Testing server: MILANE\DC2
Starting test: Connectivity
* Active Directory LDAP Services Check
Determining IP4 connectivity
Determining IP6 connectivity
* Active Directory RPC Services Check
......................... DC2 passed test Connectivity
Doing primary tests
Testing server: MILANE\DC2
Starting test: Advertising
The DC DC2 is advertising itself as a DC and having a DS.
The DC DC2 is advertising as an LDAP server
The DC DC2 is advertising as having a writeable directory
The DC DC2 is advertising as a Key Distribution Center
Warning: DC2 is not advertising as a time server.
The DS DC2 is advertising as a GC.
......................... DC2 failed test Advertising
Starting test: CheckSecurityError
* Dr Auth: Beginning security errors check!
Found KDC DC2 for domain milane.local in site MILANE
Checking machine account for DC DC2 on DC DC2.
* SPN found :LDAP/DC2.milane.local/milane.local
* SPN found :LDAP/DC2.milane.local
* SPN found :LDAP/DC2
* SPN found :LDAP/DC2.milane.local/MILANE
* SPN found :LDAP/1ee6d11b-c19f-4190-a69b-a477b294ce0d._msdcs.milane.local
* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/1ee6d11b-c19f-4190-a69b-a477b294ce0d/milane.local
* SPN found :HOST/DC2.milane.local/milane.local
* SPN found :HOST/DC2.milane.local
* SPN found :HOST/DC2
* SPN found :HOST/DC2.milane.local/MILANE
* SPN found :GC/DC2.milane.local/milane.local
Source DC FDC has possible security error (1722). Diagnosing...
Found KDC DC2 for domain milane.local in site MILANE
Checking time skew between servers:
FDC
DC2
