En préparant un plugin nagios sur la santé AD, dcdiag /e /c a eu la bonne idée de remonter cette alerte:
Starting test: VerifyEnterpriseReferences
The following problems were found while verifying various important DN
references. Note, that these problems can be reported because of
latency in replication. So follow up to resolve the following
problems, only if the same problem is reported on all DCs for a given
domain or if the problem persists after replication has had
reasonable time to replicate changes.
[1] Problem: Missing Expected Value
Base Object: CN=myDC,OU=Domain Controllers,DC=mydomain,DC=net
Base Object Description: "DC Account Object"
Value Object Attribute Name: msDFSR-ComputerReferenceBL
Value Object Description: "SYSVOL FRS Member Object"
Recommended Action: See Knowledge Base Article: Q312862
L’article Q312862 n’est plus vraiment d’actualité, mais le problème sous-jacent est bien réel.
Depuis Windows 2008, la réplication AD est censée se faire via DFS-R et non plus FRS. Cependant, cela implique de n’avoir plus que des DC > Windows Server 2003.
Donc si vos DC sont à jours, il faut utiliser dfsrmig dont les principales commandes sont:
Vérifier l’état global:
PS C:usersmchateauDesktop> dfsrmig /GetGlobalState
Current DFSR global state: 'Start'
Succeeded.
Les différents états possibles sont:
0 'Start'
1 'Prepared'
2 'Redirected'
3 'Eliminated'
==>Si vous êtes déjà en DFS-R, l’état est Eliminated.
Vérifier l’état de la migration:
PS C:usersmchateauDesktop> dfsrmig /GetMigrationState
All domain controllers have migrated successfully to the Global state ('Start').
Migration has reached a consistent state on all domain controllers.
Succeeded.
Passer à l’état Prepared:
PS C:usersmchateauDesktop> dfsrmig /SetGlobalState 1
Current DFSR global state: 'Start'
New DFSR global state: 'Prepared'
Migration will proceed to 'Prepared' state. DFSR service will copy the contents of SYSVOL to SYSVOL_DFSR folder.
If any domain controller is unable to start migration, try manual polling.
Or run with option /CreateGlobalObjects.
Migration can start anytime between 15 minutes to 1 hour.
Succeeded.
Vérifier l’état (en cours):
PS C:usersmchateauDesktop> dfsrmig /GetMigrationState
The following domain controllers have not reached Global state ('Prepared'):
Domain Controller (Local Migration State) - DC Type
===================================================
myDC01 ('Start') - Writable DC
myDC02 ('Start') - Writable DC
myDC03 ('Start') - Primary DC
myDC04 ('Start') - Writable DC
Migration has not yet reached a consistent state on all domain controllers.
State information might be stale due to Active Directory Domain Services latency.
PS C:usersmchateauDesktop>
Il ne reste plus qu’à faire les 2 états suivants tour à tour:
dfsrmig /SetGlobalState 2
dfsrmig /SetGlobalState 3
Au final:
PS C:usersmchateauDesktop> dfsrmig /GetMigrationState
All domain controllers have migrated successfully to the Global state ('Eliminated').
Migration has reached a consistent state on all domain controllers.
Succeeded.