NTFRS error id: 13508

[Guest]

I have several domain controllers, and all are logging this error when trying
to replicate with one particular dc. DNS is fine and I have recreated the
links in AD Sites & Services, i'm really am not sure where else to go with
this one.

any help would be much appreciated.
regards,
Paul.

 

[chriske911]

PAULO submitted this idea :

I have several domain controllers, and all are logging this error when trying
to replicate with one particular dc. DNS is fine and I have recreated the
links in AD Sites & Services, i'm really am not sure where else to go with
this one.

any help would be much appreciated.
regards,
Paul.

the links in site and services are only logical
this means they are not real, they need support from the routing
topology in between

can you reach the server in question from any site
can you reach any site from that server in question

grtz

 

[Jorge_de_Almeida_Pinto]

I have several domain controllers, and all are logging this
error when trying
to replicate with one particular dc. DNS is fine and I have
recreated the
links in AD Sites & Services, i'm really am not sure where
else to go with
this one.

any help would be much appreciated.
regards,
Paul.

Hi,

Check out the following to see if it applies to you:
http://www.eventid.net/display.asp?eventid=13508&eventno=349&source=NtFrs&phase=1

Cheers,

 

[Guest]

Paulo,

If the DCs are logging 13508 when trying to communicate with a particular DC
then we need to check the following:

1) If the DC we cannot communicate with is in a different site (phisically)
when we may be getting Kerberos fragmentation as FRS uses an authenticated
RPC call. You can try forcing Kerberos to use TCP instead of UDP on one
server recording the 13508 and the server it is trying to communicate with

2) Check the FRS logs on the server that nobody can cammunicate with and
make sure that it is not in Journal Wrap (JRNL_WRAP)

3) This type of error is often caused by port blocking, I suggest that you
run a port scan on the DC and check if you are blocking any ports

4) Also check the staging areas on the affected DC and make sure they are
not full

What FRS events are you getting on the DC that nobody can replicate with?