Active Directory Clean Leading to Fixes for CRM 4.0, DNS errors, SPN errors, W32time errors

Active Directory Replication Issues
Windows Resource Kit > type replmon. Verify proper replication.
 
W32time error (Event ID 29 and 47) – How to Sync Domain Controller with an External Time Source
Open Registry Editor (regedit.exe) and configure the following registry entries:

HKLMSYSTEMCurrentControlSetServicesW32TimeParametersType

This registry entry determines which peers W32Time will accept synchronization from. Change this REG_SZ value from NT5DS to NTP so the PDC Emulator synchronizes from the list of reliable time servers specified in the NtpServer registry entry described below.

HKLMSYSTEMCurrentControlSetServicesW32TimeConfigAnnounceFlags

This registry entry controls whether the local computer is marked as a reliable time server (which is only possible if the previous registry entry is set to NTP as described above). Change this REG_DWORD value from 10 to 5 here.

HKLMSYSTEMCurrentControlSetServicesW32TimeParametersNtpServer

This registry entry specifies a space-delimited list of stratum 1 time servers from which the local computer can obtain reliable time stamps. The list may consist of one or more DNS names or IP addresses (if DNS names are used then you must append ,0x1 to the end of each DNS name). For example, to synchronize the PDC Emulator in your forest root domain with tock.usno.navy.mil, an open-access SNTP time server run by the United States Naval Observatory, change the value of the NtpServer registry entry from time.windows.com,0x1 to tock.usno.navy.mil,0x1 here. Alternatively, you can specify the IP address of this time server, which is 192.5.41.209 instead.

Now stop and restart the Windows Time service using the following commands:

net stop w32time

net start w32time

It may take an hour or so for the PDC Emulator to fully synchronize with the external time server because of the nature of the polling method W32Time uses. Depending on the latency of your Internet connection, the accuracy of the CMOS clock on your forest root PDC Emulator may be within a second or two of UTC. If you need more accurate time however, you can purchase a hardware time source like an atomic clock and connect it to your PDC emulator.

Alternatively, if you don’t want to wait for time convergence to occur between your stratum 2 time server (your forest root PDC Emulator) and the external stratum 1 time server, you can run the following command on your PDC Emulator:

w32tm /resync /rediscover

Active Directory tools –

http://technet2.microsoft.com/windowsserver/en/library/aa376482-83f8-41e3-96fc-870ed0ea0c0b1033.mspx?mfr=true

CRM 4.0 SPN Issues (Event ID 11)

setspn -l computer

setspn -l crmserver

From Domain Controller, Start > Run, type adsiedit.msc

Use snap-in to navigate to computer or domain account with a redundant entry in the servicePrincipalName (right click to edit values). In our case, we had a domain account referencing HTTPourcrmserver.com which was referenced by the Network Service account. We’ll have to see if this error returns.

More reading – http://www.mombu.com/microsoft/microsoft-crm/t-kdc-errors-739326.html

DNS Cleanup (Event ID 409, 4004, 4015)

Active Directory replication and time synch issues above fixed most of the errors.

Additional things to try: ipconfig /flushdns, DNS cache

Removed old entries.

DNS Server > Properties > Interfaces – listening on All IPs.

For a detailed report of DNS errors, run dcdiag /test:dns from a Windows Resource Kit prompt.

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.