Состояние ошибки 1722 0x6ba - Не ошибается лишь тот, кто ничего не делает!

Обновлено 04.01.2023

Добрый день уважаемые читатели и подписчики, в прошлый раз мы с вами устраняли проблему в Active Directory, а именно ошибку 14550 DfsSvc и netlogon 5781 на контроллере домена, сегодня же продолжается эпопея с продолжением этих ошибок, а именно от них мы избавились, но прилетели новые: Ошибка 1722. Сервер RPC и за последние 24 часа после предоставления SYSVOL в общий доступ зафиксированы предупреждения или сообщения об ошибках. Сбои при репликации SYSVOL могут стать причиной проблем групповой политики. Давайте разбираться в чем дело.

Устраняем ошибку 1722 сервер rpc недоступен

Сетевые проблемы с репликацией и их решение, читайте по ссылке выше, про 14550. И так напомню, у меня есть два домена, родительский и дочерний. В дочернем 3 контроллера домена Active Directory. После переноса одного контроллера домена из одного сайта, ко всем остальным стали появляться ошибки 1722. Сервер RPC не доступен и сервер RPC и за последние 24 часа после предоставления SYSVOL.

Выявил я их при диагностике репликации между контроллерами домена, с помощью команды:

Данная команда показывает все ошибки репликации на предприятии. Вот как выглядит ошибка:

Сервер RPC и за последние 24 часа после предоставления SYSVOL в общий доступ зафиксированы предупреждения или сообщения об ошибках. Сбои при репликации SYSVOL могут стать причиной проблем групповой политики.

Первым делом, чтобы проверить, что с репликацией все хорошо, нужно удостовериться, что по UNC пути \ваш домен доступна на чтение папка SYSVOL и NETLOGON.

Если они не доступны, то нужно проверить права на папки и проверьте доступность портов службы RPC TCP/UDP 135, возможно у вас они закрыты на брандмауэре, лучше на время тестирования его вообще отключить.

PS C:Users> Test-NetConnection dc07 -Port 135

ComputerName : dc07
RemoteAddress : 10.91.101.17
RemotePort : 135
InterfaceAlias : Ethernet0
SourceAddress : 10.91.101.7
TcpTestSucceeded : True

Если все нормально, то двигаемся дальше. Давайте теперь проверим, когда в последний раз реплицировались контроллеры домена, делается это командой:

В итоге я обнаружил, что у меня dc7 и dc13 имеют ошибку 1722 Сервер RPC недоступен. Порты 135 я проверил, они слушались. Кто не знает как проверить, то вот вам команда telnet в помощь.

Далее посмотрите в логах Windows 📃журналы «Active Directory Web Services«, «ActiveDirectory_DomainService» и «DFS Replication«, возможно вы там найдете дополнительные детали. Например, у меня была ошибка:

ID 5008: The DFS Replication service failed to communicate with partner DC1 for replication group Domain System Volume. This error can occur if the host is unreachable, or if the DFS Replication service is not running on the server.

Partner DNS Address: DC1.pyatilistnik.org

Optional data if available:
Partner WINS Address: DC1
Partner IP Address: 192.168.1.26

The service will retry the connection periodically.

Additional Information:
Error: 1722 (The RPC server is unavailable.)
Connection ID: 9BBE21A2-46E3-4444-9D40-2967F4BA3400
Replication Group ID: E9198376-3944-4218-89BE-D4EC89CA73E8

В результате данный контроллер разрешался под старым IP-адресом, чтобы это поправить вам нужно почистить локальный кэш на контроллере, где появилась данная ошибка.

Когда с разрешением имени станет все нормально, у вас появится событие:

ID 5004: The DFS Replication service successfully established an inbound connection with partner DC1 for replication group Domain System Volume.

Additional Information:
Connection Address Used: DC1
Connection ID: 9BBE21A2-46E3-4C74-4444-2967F4BA3400
Replication Group ID: E9198376-39FD-4444-89BE-D4EC89CA73E8

Следующим шагом, идет 🛠проверка DNS серверов, в настройках стека TCP/IP. Если у вас более одного контроллера домена, то у вас первым dns сервером в настройках сетевого интерфейса должен идти dns другого контроллера домена, затем либо адрес текущего или петлевой Ip, а уже затем любые, что вам нужны.

Так, что правильный порядок DNS серверов, это 90 процентов случаев

Теперь снова выполнив команду repadmin /replsummary, я увидел, что все репликации прошли успешно. Так же советую запустить вручную репликацию AD, и проверить нет ли ошибок, убедитесь, так же, что команда dcdiag /a /q не дает ошибок. Так же если у вас развитая система сайтов AD, дождитесь времени репликации между ними.

Еще бывает, что на событие 1722 наслаивается ошибка:

Обновление 07.08.2022

Еще заметил интересную вещь, если в логах ошибки перестали появляться, но repadmin показывает ошибку, то нужно смотреть на количество неудачных попыток, если все хорошо, то счетчик начнет уменьшаться, но опять совместно с ошибкой. Как только ошибок станет меньше двух, ошибка уйдет.

Проверка DNS в лесу с несколькими доменами

На, что еще вы можете обратить внимание, если у вас, как и у меня лес состоит из главного корневого домена и нескольких дочерних, то обязательно убедитесь, что у вас правильно все прописано в DNS. Приведу пример, при попытке выполнить команду принудительной репликации:

Я периодически получал ошибку:

SyncAll reported the following errors:
Error contacting server CN=NTDS Settings,CN=DC1,CN=Servers,CN=Holding,CN=Sites,CN=Configuration,DC=Pyatilistnik,DC=org (network error): 1722 (0x6ba):
The RPC server is unavailable.

Хотя реплики все ходили без проблем, судя по repadmin /replsummary, но dcdiag /a /q показывает ошибки, что данный контроллер домена у меня определяется со старым IP-адресом, который я менял при миграции виртуальной машины в новое адресное пространство.

……………………. DC1 failed test Connectivity
Although the Guid DNS name
(d06896a3-be4b-4b8a-b75f-e52e07526a0f._msdcs.Pyatilistnik.org) resolved to
the IP address (192.168.11.1), which could not be pinged, the server
name (DC2.Pyatilistnik.org) resolved to the IP address
(10.97.11.10) and could be pinged. Check that the IP address is
registered correctly with the DNS server.
Got error while checking LDAP and RPC connectivity. Please check your
firewall settings.

Обязательно через команду nslookup проверьте, что ваши контроллеры домена разрешаются в правильный IP и, что IP разрешается в правильное DNS имя. Далее открываем «Управление DNS» оснастку и находим основную зону. Разверните ее, чтобы отобразить все контейнеры. Мультидоменной среде, вы увидите, что корневая основная зона, содержит в себе еще контейнеры с дочерними доменами, в которых вы увидите список ваших DNS серверов и контроллеров домена. Тут у вас может быть:

⛔️Не весь список актуальных DNS серверов
⛔️Список DNS серверов, но с неправильными IP-адресами в которые они разрешаются

У меня dc6 уже точно не было, что уже нужно удалить.

Далее щелкните по любому DNS серверу из списка. У вас откроется окно свойств, где видно в какие IP-адреса разрешаются имена, у меня тут и фигурировали dc1 и dc2 со старыми именами. Тут и получалось, что ошибка «(network error): 1722 (0x6ba)» была плавающая. Когда обращение по разрешению IP-адреса контроллера шло к правильному серверу с валидным IP, все было хорошо, но как только доходило до неправильной записи, была ошибка.

Теперь перейдите к редактированию неправильной записи, и попробуйте ее разрезолвить, если с этим проблем нет, то получите актуальный IP-адрес, если не получается, то смотрите обратную зону или задайте значение вручную.

И вот там уже нужно больше телодвижений. Вот так вот просто решается ошибка 1722 сервер RPC не доступен на контроллере домена по Windows Server 2012 R2. Если у вас есть чем дополнить статью, то просьба написать это в комментариях.

Источник

Добрый день, коллеги!

При подготовке к переходу с FRS на DRS-R, обнаружил на одном из DC проблемы с репликацией, а именно с доступностью RPC.

Время запуска сводки по репликации: 2017-05-29 12:07:24

Начат сбор данных для сводки по репликации, подождите:
……

Исходный DSA наиб. дельта сбоев/всего %% ошибка
DC0 19m:02s 0 / 10 0
DC1 19m:02s 0 / 10 0
MDC120 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.

Конечный DSA наиб. дельта сбои/всего %% ошибка
DC0 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.
DC1 13m:48s 0 / 10 0
MDC120 19m:03s 0 / 10 0

Если запустить принудительную синхронизации на всех DC ругается на RPC:

PS C:Windowssystem32> repadmin /syncall Aed
DsBindWithCred to Aed failed with status 1722 (0x6ba):
The RPC server is unavailable.

На проблемном DC0 DCDIAG выдает следующее, на остальных проверка репликации проходит:

Directory Server Diagnosis

Performing initial setup:
Trying to find home server…
Home Server = dc0
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: MoscowDC0
Starting test: Connectivity
……………………. DC0 passed test Connectivity

Doing primary tests

Testing server: MoscowDC0
Starting test: Advertising
……………………. DC0 passed test Advertising
Starting test: FrsEvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL
replication problems may cause Group Policy problems.
……………………. DC0 passed test FrsEvent
Starting test: DFSREvent
……………………. DC0 passed test DFSREvent
Starting test: SysVolCheck
……………………. DC0 passed test SysVolCheck
Starting test: KccEvent
……………………. DC0 passed test KccEvent
Starting test: KnowsOfRoleHolders
……………………. DC0 passed test KnowsOfRoleHolders
Starting test: MachineAccount
……………………. DC0 passed test MachineAccount
Starting test: NCSecDesc
……………………. DC0 passed test NCSecDesc
Starting test: NetLogons
……………………. DC0 passed test NetLogons
Starting test: ObjectsReplicated
……………………. DC0 passed test ObjectsReplicated
Starting test: Replications
[Replications Check,DC0] A recent replication attempt failed:
From MDC120 to DC0
Naming Context: DC=ForestDnsZones,DC=xxx,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2017-05-29 12:55:21.
The last success occurred at 2016-11-04 04:28:11.
5133 failures have occurred since the last success.
REPLICATION LATENCY WARNING
ERROR: Expected notification link is missing.
Source MDC120
Replication of new changes along this path will be delayed.
This problem should self-correct on the next periodic sync.
[Replications Check,DC0] A recent replication attempt failed:
From MDC120 to DC0
Naming Context: DC=DomainDnsZones,DC=xx,DC=local
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2017-05-29 12:55:21.
The last success occurred at 2016-11-04 04:51:53.
21279 failures have occurred since the last success.
[Replications Check,DC0] A recent replication attempt failed:
From MDC120 to DC0
Naming Context: CN=Schema,CN=Configuration,DC=xx,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-05-29 12:56:45.
The last success occurred at 2016-11-04 04:26:33.
5025 failures have occurred since the last success.
The source MDC120 is responding now.
REPLICATION LATENCY WARNING
ERROR: Expected notification link is missing.
Source MDC120
Replication of new changes along this path will be delayed.
This problem should self-correct on the next periodic sync.
[Replications Check,DC0] A recent replication attempt failed:
From MDC120 to DC0
Naming Context: CN=Configuration,DC=xx,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-05-29 12:56:03.
The last success occurred at 2016-11-04 04:26:33.
5719 failures have occurred since the last success.
The source MDC120 is responding now.
[Replications Check,DC0] A recent replication attempt failed:
From MDC120 to DC0
Naming Context: DC=xx,DC=local
The replication generated an error (1722):
The RPC server is unavailable.
The failure occurred at 2017-05-29 13:04:06.
The last success occurred at 2016-11-04 04:51:35.
190198 failures have occurred since the last success.
The source MDC120 is responding now.
……………………. DC0 failed test Replications
Starting test: RidManager
……………………. DC0 passed test RidManager
Starting test: Services
……………………. DC0 passed test Services
Starting test: SystemLog
A warning event occurred. EventID: 0x80040020
Time Generated: 05/29/2017 12:24:23
Event String:
The driver detected that the device DeviceHarddisk0DR0 has its write cache enabled. Data corruption may
ccur.
A warning event occurred. EventID: 0x80040020
Time Generated: 05/29/2017 12:24:23
Event String:
The driver detected that the device DeviceHarddisk0DR0 has its write cache enabled. Data corruption may
ccur.
A warning event occurred. EventID: 0x80040020
Time Generated: 05/29/2017 12:24:23
Event String:
The driver detected that the device DeviceHarddisk0DR0 has its write cache enabled. Data corruption may
ccur.
A warning event occurred. EventID: 0x00001796
Time Generated: 05/29/2017 12:24:42
Event String:
Microsoft Windows Server has detected that NTLM authentication is presently being used between clients and
his server. This event occurs once per boot of the server on the first time a client uses NTLM with this server.
……………………. DC0 passed test SystemLog
Starting test: VerifyReferences
……………………. DC0 passed test VerifyReferences

Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
……………………. ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
……………………. ForestDnsZones passed test CrossRefValidation

Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
……………………. DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
……………………. DomainDnsZones passed test CrossRefValidation

Running partition tests on : Schema
Starting test: CheckSDRefDom
……………………. Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
……………………. Schema passed test CrossRefValidation

Running partition tests on : Configuration
Starting test: CheckSDRefDom
……………………. Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
……………………. Configuration passed test CrossRefValidation

Running partition tests on : xxx
Starting test: CheckSDRefDom
……………………. xxx passed test CheckSDRefDom
Starting test: CrossRefValidation
……………………. xxx passed test CrossRefValidation

Running enterprise tests on : xxx.local
Starting test: LocatorCheck
……………………. xxx.local passed test LocatorCheck
Starting test: Intersite
……………………. xxx.local passed test Intersite

Подскажите в какую сторону копать, полазил по форумам похожая проблемы вызывалась фаерволом или остатками старых DC, но это не мой случай, фаервол отключил для диагностики.

Содержание

Dsbindwithcred to aed failed with status 1722 0x6ba the rpc server is unavailable
Устраняем ошибку 1722 сервер rpc недоступен
Обновление 07.08.2022
Популярные Похожие записи:
6 Responses to Ошибка 1722 сервер RPC не доступен на контроллере домена
Active Directory replication error 1722: The RPC server is unavailable
Symptoms
Cause
Resolution
Verify the startup value and service status are correct for RPC, RPC Locator, and Kerberos Key Distribution Center
Verify the ClientProtocols key exists under HKEY_LOCAL_MACHINESoftwareMicrosoftRpc, and that it contains the correct default protocols
Verify DNS is working
Verify network ports are not blocked by a firewall or third-party application listening on the required ports
Bad NIC drivers
UDP fragmentation can cause replication errors that appear to have a source of RPC server is unavailable
SMB signing mismatches between DCs

Dsbindwithcred to aed failed with status 1722 0x6ba the rpc server is unavailable

Выявил я их при диагностике репликации между контроллерами домена, с помощью команды:

Данная команда показывает все ошибки репликации на предприятии. Вот как выглядит ошибка:

Первым делом, чтобы проверить, что с репликацией все хорошо, нужно удостовериться, что по UNC пути ваш домен доступна на чтение папка SYSVOL и NETLOGON.

PS C:Users> Test-NetConnection dc07 -Port 135

ComputerName : dc07
RemoteAddress : 10.91.101.17
RemotePort : 135
InterfaceAlias : Ethernet0
SourceAddress : 10.91.101.7
TcpTestSucceeded : True

Partner DNS Address: DC1.pyatilistnik.org

Optional data if available:
Partner WINS Address: DC1
Partner IP Address: 192.168.1.26

The service will retry the connection periodically.

Additional Information:
Error: 1722 (The RPC server is unavailable.)
Connection ID: 9BBE21A2-46E3-4444-9D40-2967F4BA3400
Replication Group ID: E9198376-3944-4218-89BE-D4EC89CA73E8

Когда с разрешением имени станет все нормально, у вас появится событие:

Additional Information:
Connection Address Used: DC1
Connection ID: 9BBE21A2-46E3-4C74-4444-2967F4BA3400
Replication Group ID: E9198376-39FD-4444-89BE-D4EC89CA73E8

Еще бывает, что на событие 1722 наслаивается ошибка:

Обновление 07.08.2022

Еще заметил интересную вещь, если в логах ошибки перестали появляться, но repadmin показывает ошибку, то нужно смотреть на количество неудачных попыток, если все хорошо, то счетчик начнет уменьшаться, но опять же совместно с ошибкой. Как только ошибок станет меньше двух, ошибка уйдет.

6 Responses to Ошибка 1722 сервер RPC не доступен на контроллере домена

Привет, Иван! Я так не понял, что Вы сделали, чтобы все заработало. Как я понял, вы провели проверку, и все заработало?

Скринов случайно не осталось для написания статейки по переносу контроллера домена?)

Убедитесь, что все реплики ходят, и во вторых, чтобы в dns не было 127.0.0.1

Добрый день!
Спасибо за статью!
Подскажите, а как бороться с этим недугом?
The File Replication Service is having trouble enabling replication from DC1 to DC2 for c:windowssysvoldomain using the DNS name DC1.netwell.local. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name DC1.netwell.local from this computer.
[2] FRS is not running on DC1.netwell.local.
[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

Вы не можете составить програмку для решения этого вопроса и поэтому выделываетесь в сети.

Этого 1722 и RPC не было на ХР и семёрке, у меня проявилось на десятке и не даёт возможности форматировать и создавать новые диски в программе от SEAGATE «Диск визард». Короче, моё мнение — это неумышленная, а может быть умышленная ошибка программистов, т.е. вирус. Придётся связываться с SEAGATE.
Как мне всё это надоело!

Источник

Active Directory replication error 1722: The RPC server is unavailable

This article helps fix the error 1722 of Active Directory replication.

Applies to: В Windows Server 2019, Windows Server 2016, Windows Server 2012 R2
Original KB number: В 2102154

Symptoms

This article describes the symptoms, cause, and resolution for resolving Active Directory replication failing with Win32 error 1722: The RPC server is unavailable.

DCPROMO Promotion of a replica DC fails to create an NTDS Settings object on the helper DC with error 1722гЂ‚

Dialog Title text: Active Directory Domain Services Installation Wizard

Dialog Message text:

DCDIAG reports that the Active Directory Replications test has failed with error 1722: The RPC Server is unavailable.

REPADMIN.EXE reports that replication attempt has failed with status 1722 (0x6ba).

REPADMIN commands that commonly cite the -1722 (0x6ba) status include but are not limited to:

REPADMIN /REPLSUM
REPADMIN /SHOWREPL
REPADMIN /SHOWREPS
REPADMIN /SYNCALL

Sample output from REPADMIN /SHOWREPS and REPADMIN /SYNCALL depicting The RPC server is unavailable error is shown below:

Sample output of REPADMIN /SYNCALL depicting The RPC server is unavailable error is shown below:

The replicate now command in Active Directory Sites and Services returns The RPC server is unavailable.

Right-clicking on the connection object from a source DC and choosing replicate now fails with The RPC server is unavailable. The on-screen error message is shown below:

Dialog title text: Replicate Now

Dialog message text:

The following error occurred during the attempt to synchronize naming context from domain controller to domain controller :The RPC server is unavailable. This operation will not continue. This condition may be caused by a DNS lookup problem. For information about troubleshooting common DNS lookup problems, see the following Microsoft Web site: DNS Lookup Problem

NTDS Knowledge Consistency Checker (KCC), NTDS General, or Microsoft-Windows-ActiveDirectory_DomainService events with the 1722 status are logged in the directory service event log.

Active Directory events that commonly cite the 1722 status include but are not limited to:

Event Source	Event ID	Event String
Microsoft-Windows-ActiveDirectory_DomainService	1125	The Active Directory Domain Services Installation Wizard (Dcpromo) was unable to establish connection with the following domain controller.
NTDS KCC	1311	The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
NTDS KCC	1865	The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
NTDS KCC	1925	The attempt to establish a replication link for the following writable directory partition failed.
NTDS Replication	1960	Internal event: The following domain controller received an exception from a remote procedure call (RPC) connection. The operation may have failed.

Cause

RPC is an intermediate layer between the network transport and the application protocol. RPC itself has no special insight into failures but attempts to map lower layer protocol failures into an error at the RPC layer.

RPC error 1722 / 0x6ba / RPC_S_SERVER_UNAVAILABLE is logged when a lower layer protocol reports a connectivity failure. The common case is that the abstract TCP CONNECT operation failed. In the context of AD replication, the RPC client on the destination DC was not able to successfully connect to the RPC server on the source DC. Common causes for this are:

Link local failure
DHCP failure
DNS failure
WINS failure
Routing failure (including blocked ports on firewalls)
IPSec / Network authentication failures
Resource limitations
Higher layer protocol not running
Higher layer protocol is returning this error

Resolution

Basic troubleshooting steps to identify the problem.

Verify the startup value and service status are correct for RPC, RPC Locator, and Kerberos Key Distribution Center

Verify the startup value and service status are correct for the Remote Procedure Call (RPC), Remote Procedure Call (RPC) Locator and Kerberos Key Distribution Center.

The OS version will determine the correct values for the source and destination system that is logging the replication error. Use the following table to help validate the settings.

Service Name	Windows 2000	Windows 2003 /R2	Windows 2008	Windows 2008 R2
Remote Procedure Call (RPC)	Started / Automatic	Started / Automatic	Started / Automatic	Started / Automatic
Remote Procedure Call (RPC) Locator	Started / Automatic (Domain Controllers) Not started / Manual(Member Servers)	Not started / Manual	Not started / Manual	Not started / Manual
Kerberos Key Distribution Center (KDC)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)

Service Name

Windows 2000

Windows 2003 /R2

Windows 2008

Windows 2008 R2

Remote Procedure Call (RPC)

Started / Automatic

Remote Procedure Call (RPC) Locator

Started / Automatic (Domain Controllers)

Not started / Manual(Member Servers)

Not started / Manual

Kerberos Key Distribution Center (KDC)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

If you make any changes to match the settings above, restart the machine. Verify both the startup value and service status match the values documented in the table above.

Verify the ClientProtocols key exists under HKEY_LOCAL_MACHINESoftwareMicrosoftRpc, and that it contains the correct default protocols

Protocol Name	Type	Data Value
ncacn_http	REG_SZ	rpcrt4.dll
ncacn_ip_tcp	REG_SZ	rpcrt4.dll
ncacn_np	REG_SZ	rpcrt4.dll
ncacn_ip_udp	REG_SZ	rpcrt4.dll

If the ClientProtocols key or any of the four default values are missing, import the key from a known good server.

Verify DNS is working

DNS lookup failures are the cause of a large number of 1722 RPC errors when it comes to replication.

There are a few tools to use to help identify DNS errors:

DCDIAG /TEST:DNS /V /E /F:

The DCDIAG /TEST:DNS command can validate DNS health of Windows 2000 Server (SP3 or later), Windows Server 2003, and Windows Server 2008 family domain controllers. This test was first introduced with Windows Server 2003 Service Pack 1.

There are seven test groups for this command.

Records registration (RReg)

Dynamic update ( Dyn )

Forwarders/Root hints (Forw)

Summary of DNS test results:

The summary provides remediation steps for the more common failures from this test.

Explanation and additional options for this test can be found at Domain Controller Diagnostics Tool (dcdiag.exe).

Nltest /dsgetdc is used to exercise the dc locator process. Thus /dsgetdc: tries to find the domain controller for the domain. Using the force flag forces domain controller location rather than using the cache. You can also specify options such as /gc or /pdc to locate a Global Catalog or a primary domain controller emulator. For finding the Global Catalog, you must specify a tree name, which is the DNS domain name of the root domain.

Can be used with Windows 2003 and earlier versions to gather specific information for networking configuration and error. This tool takes some time to run when executing the -v switch.

Sample output for the DNS test:

It’s a simple quick test to validate the host record for a domain controller is resolving to the correct machine.

dnslint /s IP /ad IP

DNSLint is a Windows utility that helps you to diagnose common DNS name resolution issues. The output is an htm file with much information including:

DNS server: localhost

SOA record data from server:

Additional authoritative (NS) records from server: DC2.fabrikam.com

Alias (CNAME) and glue (A) records for forest GUIDs from server:

Verify network ports are not blocked by a firewall or third-party application listening on the required ports

The endpoint mapper (listening on port 135) tells the client which randomly assigned port a service (FRS, AD replication, MAPI, and so on) is listening on.

Application protocol	Protocol	Ports
Global Catalog Server	TCP	3269
Global Catalog Server	TCP	3268
LDAP Server	TCP	389
LDAP Server	UDP	389
LDAP SSL	TCP	636
LDAP SSL	UDP	636
IPsec ISAKMP	UDP	500
NAT-T	UDP	4500
RPC	TCP	135
RPC randomly allocated high TCP portsВ№	TCP	1024 — 5000 49152 — 65535*

* This is the range in Windows Server 2008, Windows Vista, Windows 7, and Windows 2008 R2.

Portqry can be used to identify if a port is blocked from a Dc when targeting another DC. It can be downloaded at PortQry Command Line Port Scanner Version 2.0.

-e 135
portqry -n

A graphical version of portqry, called Portqryui can be found at PortQryUI — User Interface for the PortQry Command Line Port Scanner.

If the Dynamic Port range has ports being blocked, use the below links to configure a port range that is manageable for the customer.

Additional important links for configuration and working with Firewalls and Domain Controllers:

Bad NIC drivers

See network card vendors or OEMs for the latest drivers.

UDP fragmentation can cause replication errors that appear to have a source of RPC server is unavailable

Event ID 40960 & 40961 errors with a source of LSASRV are common for this particular cause.

SMB signing mismatches between DCs

Using Default Domain Controllers Policy to configure consistent settings for SMB Signing under the following section will help address this cause:

Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options

Microsoft network client: Digitally sign communications (always) Disabled.
Microsoft network client: Digitally sign communications (if server agrees) Enabled.
Microsoft network server: Digitally sign communications (always) Disabled.
Microsoft network server: Digitally sign communications (if client agrees) Enabled.

The settings can be found under the following registry keys:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManWorkstationParameters and HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParameters

RequireSecuritySignature = always (0,disable, 1 enable).
EnableSecuritySignature = is server agrees (0,disable, 1 enable).

If the above don’t provide a solution to the 1722, use the following Diagnostic logging to gather more information:

Источник

Обновлено 04.01.2023

Устраняем ошибку 1722 сервер rpc недоступен

Выявил я их при диагностике репликации между контроллерами домена, с помощью команды:

Данная команда показывает все ошибки репликации на предприятии. Вот как выглядит ошибка:

PS C:Users> Test-NetConnection dc07 -Port 135

ComputerName : dc07
RemoteAddress : 10.91.101.17
RemotePort : 135
InterfaceAlias : Ethernet0
SourceAddress : 10.91.101.7
TcpTestSucceeded : True

Partner DNS Address: DC1.pyatilistnik.org

Optional data if available:
Partner WINS Address: DC1
Partner IP Address: 192.168.1.26

The service will retry the connection periodically.

Additional Information:
Error: 1722 (The RPC server is unavailable.)
Connection ID: 9BBE21A2-46E3-4444-9D40-2967F4BA3400
Replication Group ID: E9198376-3944-4218-89BE-D4EC89CA73E8

Когда с разрешением имени станет все нормально, у вас появится событие:

ID 5004: The DFS Replication service successfully established an inbound connection with partner DC1 for replication group Domain System Volume.

Additional Information:
Connection Address Used: DC1
Connection ID: 9BBE21A2-46E3-4C74-4444-2967F4BA3400
Replication Group ID: E9198376-39FD-4444-89BE-D4EC89CA73E8

Так, что правильный порядок DNS серверов, это 90 процентов случаев

Еще бывает, что на событие 1722 наслаивается ошибка:

Обновление 07.08.2022

Проверка DNS в лесу с несколькими доменами

Я периодически получал ошибку:

⛔️Не весь список актуальных DNS серверов
⛔️Список DNS серверов, но с неправильными IP-адресами в которые они разрешаются

У меня dc6 уже точно не было, что уже нужно удалить.

Добрый день, коллеги!

Время запуска сводки по репликации: 2017-05-29 12:07:24

Начат сбор данных для сводки по репликации, подождите:
……

Исходный DSA наиб. дельта сбоев/всего %% ошибка
DC0 19m:02s 0 / 10 0
DC1 19m:02s 0 / 10 0
MDC120 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.

Конечный DSA наиб. дельта сбои/всего %% ошибка
DC0 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.
DC1 13m:48s 0 / 10 0
MDC120 19m:03s 0 / 10 0

Если запустить принудительную синхронизации на всех DC ругается на RPC:

PS C:Windowssystem32> repadmin /syncall Aed
DsBindWithCred to Aed failed with status 1722 (0x6ba):
The RPC server is unavailable.

На проблемном DC0 DCDIAG выдает следующее, на остальных проверка репликации проходит:

Directory Server Diagnosis

Performing initial setup:
Trying to find home server…
Home Server = dc0
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: MoscowDC0
Starting test: Connectivity
……………………. DC0 passed test Connectivity

Doing primary tests

Добрый день, коллеги!

Время запуска сводки по репликации: 2017-05-29 12:07:24

Начат сбор данных для сводки по репликации, подождите:
……

Исходный DSA наиб. дельта сбоев/всего %% ошибка
DC0 19m:02s 0 / 10 0
DC1 19m:02s 0 / 10 0
MDC120 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.

Конечный DSA наиб. дельта сбои/всего %% ошибка
DC0 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.
DC1 13m:48s 0 / 10 0
MDC120 19m:03s 0 / 10 0

Если запустить принудительную синхронизации на всех DC ругается на RPC:

PS C:Windowssystem32> repadmin /syncall Aed
DsBindWithCred to Aed failed with status 1722 (0x6ba):
The RPC server is unavailable.

На проблемном DC0 DCDIAG выдает следующее, на остальных проверка репликации проходит:

Directory Server Diagnosis

Performing initial setup:
Trying to find home server…
Home Server = dc0
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: MoscowDC0
Starting test: Connectivity
……………………. DC0 passed test Connectivity

Doing primary tests

Источник

Добрый день, коллеги!

Время запуска сводки по репликации: 2017-05-29 12:07:24

Начат сбор данных для сводки по репликации, подождите:
……

Исходный DSA наиб. дельта сбоев/всего %% ошибка
DC0 19m:02s 0 / 10 0
DC1 19m:02s 0 / 10 0
MDC120 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.

Конечный DSA наиб. дельта сбои/всего %% ошибка
DC0 >60 days 5 / 10 50 (1722) Сервер RPC недоступен.
DC1 13m:48s 0 / 10 0
MDC120 19m:03s 0 / 10 0

Если запустить принудительную синхронизации на всех DC ругается на RPC:

PS C:Windowssystem32> repadmin /syncall Aed
DsBindWithCred to Aed failed with status 1722 (0x6ba):
The RPC server is unavailable.

На проблемном DC0 DCDIAG выдает следующее, на остальных проверка репликации проходит:

Directory Server Diagnosis

Performing initial setup:
Trying to find home server…
Home Server = dc0
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: MoscowDC0
Starting test: Connectivity
……………………. DC0 passed test Connectivity

Doing primary tests

Источник

Remove From My Forums

Question
Hi all, I have
two AD Sites. All except one
Servers are Windows Server 2008 R2.

Everything worked fine, but I have two weeks
to replication errors between the two
Sites. Users created at one of the sites
is not replicated to the other.

I see the following events in the
DCs:

Event id1864 Microsoft-Windows-ActiveDirectory_DomainService
Event id 2093 Microsoft-Windows-ActiveDirectory_DomainService
Event id 1925 ActiveDirectory_DomainService

When I run repadmin / showpl

Active Directory Replication with state
DsBindWithCred Error.Error of 1722
(0x6ba): The RPC server is unavailable.

I tried communicating with PortQuery
tool, and everything seems to be correct.

The DCs that are in the same
Site, are replicated correctly.

I CAN NOT BE HAPPENING,
Can you help?

thank you very much

Microsoft Certified IT Professional Server Administrator

Answers

Hi all, after opening dynamic ports, replication works
correctly.

Thank you very much to all for your support.

Microsoft Certified IT Professional Server Administrator
- Marked as answer by
  
  Tuesday, July 30, 2013 6:43 AM

Источник

title	description	ms.date	author	ms.author	manager	audience	ms.topic	ms.prod	localization_priority	ms.reviewer	ms.custom	ms.technology
Troubleshoot replication error 1722	Fixes error 1722 of Active Directory replication in Windows Server 2008 R2 and earlier versions.	04/28/2023	Deland-Han	delhan	dcscontentpm	itpro	troubleshooting	windows-server	medium	kaushika	sap:active-directory-replication, csstroubleshoot	windows-server-active-directory

Active Directory replication error 1722: The RPC server is unavailable

This article helps fix the error 1722 of Active Directory replication.

Applies to: Windows Server 2019, Windows Server 2016, Windows Server 2012 R2
Original KB number: 2102154

Symptoms

This article describes the symptoms, cause, and resolution for resolving Active Directory replication failing with Win32 error 1722: The RPC server is unavailable.

DCPROMO Promotion of a replica DC fails to create an NTDS Settings object on the helper DC with error 1722。

Dialog Title text: Active Directory Domain Services Installation Wizard

Dialog Message text:

The operation failed because: Active Directory Domain Services could not create the NTDS Settings object for this Active Directory Domain Controller CN=NTDS Settings,CN=<Name of DC being promoted),CN=Servers,CN=<site name>,CN=Sites,CN=Configuration,DC=<forest root domain> on the remote AD DC <helper DC>.<domain name>.<top level domain>. Ensure the provided network credentials have sufficient permissions. "The RPC server is unavailable."

DCDIAG reports that the Active Directory Replications test has failed with error 1722: The RPC Server is unavailable.

[Replications Check,<DC Name>] A recent replication attempt failed:
From <source DC> to <destination DC>  
Naming Context: <DN path of directory partition>  
The replication generated an error (1722):  
The RPC server is unavailable.  
The failure occurred at <date> <time>.  
The last success occurred at <date> <time>.  
<X> failures have occurred since the last success.  
[<dc name>] DsBindWithSpnEx() failed with error 1722,  
The RPC server is unavailable..  
Printing RPC Extended Error Info:  
<snip>

REPADMIN.EXE reports that replication attempt has failed with status 1722 (0x6ba).

REPADMIN commands that commonly cite the -1722 (0x6ba) status include but are not limited to:

REPADMIN /REPLSUM
REPADMIN /SHOWREPL
REPADMIN /SHOWREPS
REPADMIN /SYNCALL

Sample output from REPADMIN /SHOWREPS and REPADMIN /SYNCALL depicting The RPC server is unavailable error is shown below:

c:> repadmin /showreps  
<site name><destination DC>  
DC Options: <list of flags>  
Site Options: (none)  
DC object GUID: <NTDS settings object object GUID>  
DC invocationID: <invocation ID string>  
==== INBOUND NEIGHBORS ======================================  
DC=<DN path for directory partition>  
    <site name><source DC via RPC  
        DC object GUID: <source DCs ntds settings object object guid>  
        Last attempt @ <date> <time> failed, result **1722 (0x6ba):  
The RPC server is unavailable.  
        <X #> consecutive failure(s).  
        Last success @ <date> <time>

Sample output of REPADMIN /SYNCALL depicting The RPC server is unavailable error is shown below:

 C:>repadmin /syncall  
 CALLBACK MESSAGE: Error contacting server <object guid of NTDS Settings object>._msdcs.<forest root domain>.<top level domain> (network error): 1722 (0x6ba):  
 The RPC server is unavailable.

The replicate now command in Active Directory Sites and Services returns The RPC server is unavailable.

Right-clicking on the connection object from a source DC and choosing replicate now fails with The RPC server is unavailable. The on-screen error message is shown below:

Dialog title text: Replicate Now

Dialog message text:

The following error occurred during the attempt to synchronize naming context <DNS name of directory partition> from domain controller <source Dc host name> to domain controller <destination DC hostname>:The RPC server is unavailable. This operation will not continue. This condition may be caused by a DNS lookup problem. For information about troubleshooting common DNS lookup problems, see the following Microsoft Web site: DNS Lookup Problem

NTDS Knowledge Consistency Checker (KCC), NTDS General, or Microsoft-Windows-ActiveDirectory_DomainService events with the 1722 status are logged in the directory service event log.

Active Directory events that commonly cite the 1722 status include but are not limited to:

Event Source	Event ID	Event String
Microsoft-Windows-ActiveDirectory_DomainService	1125	The Active Directory Domain Services Installation Wizard (Dcpromo) was unable to establish connection with the following domain controller.
NTDS KCC	1311	The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
NTDS KCC	1865	The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site.
NTDS KCC	1925	The attempt to establish a replication link for the following writable directory partition failed.
NTDS Replication	1960	Internal event: The following domain controller received an exception from a remote procedure call (RPC) connection. The operation may have failed.

Cause

Link local failure
DHCP failure
DNS failure
WINS failure
Routing failure (including blocked ports on firewalls)
IPSec / Network authentication failures
Resource limitations
Higher layer protocol not running
Higher layer protocol is returning this error

Resolution

Basic troubleshooting steps to identify the problem.

Verify the startup value and service status are correct for RPC, RPC Locator, and Kerberos Key Distribution Center

Verify the startup value and service status are correct for the Remote Procedure Call (RPC), Remote Procedure Call (RPC) Locator and Kerberos Key Distribution Center.

The OS version will determine the correct values for the source and destination system that is logging the replication error. Use the following table to help validate the settings.

Service Name	Windows 2000	Windows 2003 /R2	Windows 2008	Windows 2008 R2
Remote Procedure Call (RPC)	Started / Automatic	Started / Automatic	Started / Automatic	Started / Automatic
Remote Procedure Call (RPC) Locator	Started / Automatic (Domain Controllers) Not started / Manual(Member Servers)	Not started / Manual	Not started / Manual	Not started / Manual
Kerberos Key Distribution Center (KDC)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)	Started / Automatic (Domain Controllers) Not started / Disabled(Member Servers)

Service Name

Windows 2000

Windows 2003 /R2

Windows 2008

Windows 2008 R2

Remote Procedure Call (RPC)

Started / Automatic

Remote Procedure Call (RPC) Locator

Started / Automatic (Domain Controllers)

Not started / Manual(Member Servers)

Not started / Manual

Kerberos Key Distribution Center (KDC)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

Started / Automatic (Domain Controllers)

Not started / Disabled(Member Servers)

If you make any changes to match the settings above, restart the machine. Verify both the startup value and service status match the values documented in the table above.

Verify the ClientProtocols key exists under HKEY_LOCAL_MACHINESoftwareMicrosoftRpc, and that it contains the correct default protocols

Protocol Name	Type	Data Value
ncacn_http	REG_SZ	rpcrt4.dll
ncacn_ip_tcp	REG_SZ	rpcrt4.dll
ncacn_np	REG_SZ	rpcrt4.dll
ncacn_ip_udp	REG_SZ	rpcrt4.dll

If the ClientProtocols key or any of the four default values are missing, import the key from a known good server.

Verify DNS is working

DNS lookup failures are the cause of a large number of 1722 RPC errors when it comes to replication.

There are a few tools to use to help identify DNS errors:

DCDIAG /TEST:DNS /V /E /F:<filename.log>

The DCDIAG /TEST:DNS command can validate DNS health of Windows 2000 Server (SP3 or later), Windows Server 2003, and Windows Server 2008 family domain controllers. This test was first introduced with Windows Server 2003 Service Pack 1.

There are seven test groups for this command.

Authentication (Auth)
Basic (Basc)
Records registration (RReg)
Dynamic update (Dyn)
Delegations (Del)

Forwarders/Root hints (Forw)

Sample output:

TEST: Authentication (Auth)  
Authentication test: Successfully completed

TEST: Basic (Basc)  
Microsoft(R) Windows(R) Server 2003, Enterprise Edition (Service Pack level: 2.0) is supported  
NETLOGON service is running  
kdc service is running  
DNSCACHE service is running  
DNS service is running  
DC is a DNS server  
Network adapters information:  
Adapter [00000009] Microsoft Virtual Machine Bus Network Adapter:  
MAC address is 00:15:5D:40:CF:92  
IP address is static  
IP address: <IP Address>  
DNS servers:  
<DNS IP Address> (DC.domain.com.) [Valid]  
The A record for this DC was found  
The SOA record for the Active Directory zone was found  
The Active Directory zone on this DC/DNS server was found (primary)  
Root zone on this DC/DNS server was not found  
<omitted other tests for readability>

Summary of DNS test results:

Auth Basc Forw Del  Dyn  RReg Ext

Domain: fragale.contoso.com
DC1 PASS PASS FAIL PASS PASS PASS n/a  
Domain: child.fragale.contoso.com  
DC2 PASS PASS n/a  n/a  n/a  PASS n/a  

Enterprise DNS infrastructure test results:  
For parent domain domain.com and subordinate domain child:  
Forwarders or root hints are not misconfigured from parent domain to subordinate domain  
Error: Forwarders are configured from subordinate to parent domain but some of them failed DNS server tests  

(See DNS servers section for error details)  
Delegation is configured properly from parent to subordinate domain  
......................... domain.com failed test DNS

The summary provides remediation steps for the more common failures from this test.

Explanation and additional options for this test can be found at Domain Controller Diagnostics Tool (dcdiag.exe).

NLTEST /DSGETDC:<netbios or DNS domain name>

Nltest /dsgetdc is used to exercise the dc locator process. Thus /dsgetdc:<domain name> tries to find the domain controller for the domain. Using the force flag forces domain controller location rather than using the cache. You can also specify options such as /gc or /pdc to locate a Global Catalog or a primary domain controller emulator. For finding the Global Catalog, you must specify a tree name, which is the DNS domain name of the root domain.

Sample output:
```
DC: [DC.fabrikam.com]  
Address: \<IP Address>  
Dom Guid: 5499c0e6-2d33-429d-aab3-f45f6a06922b  
Dom Name: fabrikam.com  
Forest Name: fabrikam.com  
Dc Site Name: Default-First-Site-Name  
Our Site Name: Default-First-Site-Name  
Flags: PDC GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE  
The command completed successfully
```

Netdiag -v

Can be used with Windows 2003 and earlier versions to gather specific information for networking configuration and error. This tool takes some time to run when executing the -v switch.

Sample output for the DNS test:

DNS test . . . . . . . . . . . . . : Passed  
Interface {34FDC272-55DC-4103-B4B7-89234BC30C4A}  
DNS Domain:  
DNS Servers: <DNS Server Ip address>  
IP Address:         Expected registration with PDN (primary DNS domain name):  
Hostname: DC.fabrikam.com.  
Authoritative zone: fabrikam.com.  
Primary DNS server: DC.fabrikam.com <Ip Address>  
Authoritative NS:<Ip Address>  
Check the DNS registration for DCs entries on DNS server <DNS Server Ip address>  
The Record is correct on DNS server '<DNS Server Ip address>'.  
(You will see this line repeated several times for every entry for this DC.  Including srv records.)  
The Record is correct on DNS server '<DNS Server Ip address>'.  
PASS - All the DNS entries for DC are registered on DNS server '<DNS Server Ip address>'.

ping -a <IP_of_problem_server>

It’s a simple quick test to validate the host record for a domain controller is resolving to the correct machine.

dnslint /s IP /ad IP

DNSLint is a Windows utility that helps you to diagnose common DNS name resolution issues. The output is an htm file with much information including:

DNS server: localhost

IP Address: 127.0.0.1  
UDP port 53 responding to queries: YES  
TCP port 53 responding to queries: Not tested  
Answering authoritatively for domain: NO

SOA record data from server:

Authoritative name server: DC.domain.com  
Hostmaster: hostmaster  
Zone serial number: 14  
Zone expires in: 1.00 day(s)  
Refresh period: 900 seconds  
Retry delay: 600 seconds  
Default (minimum) TTL: 3600 seconds

Additional authoritative (NS) records from server: DC2.fabrikam.com <IP Address>

Alias (CNAME) and glue (A) records for forest GUIDs from server:
- CNAME: 98d4aa0c-d8e2-499a-8f90-9730b0440d9b._msdcs.fabrikam.com
  - Alias: DC.fabrikam.com
  - Glue: <IP Adress>
- CNAME: a2c5007f-7082-4adb-ba7d-a9c47db1efc3._msdcs.fabrikam.com
  - Alias: dc2.child.fabrikam.com
  - Glue: <IP Address>
  For more information, see Description of the DNSLint utility.

Verify network ports are not blocked by a firewall or third-party application listening on the required ports

The endpoint mapper (listening on port 135) tells the client which randomly assigned port a service (FRS, AD replication, MAPI, and so on) is listening on.

Application protocol	Protocol	Ports
Global Catalog Server	TCP	3269
Global Catalog Server	TCP	3268
LDAP Server	TCP	389
LDAP Server	UDP	389
LDAP SSL	TCP	636
LDAP SSL	UDP	636
IPsec ISAKMP	UDP	500
NAT-T	UDP	4500
RPC	TCP	135
RPC randomly allocated high TCP ports¹	TCP	1024 — 5000 49152 — 65535*

* This is the range in Windows Server 2008, Windows Vista, Windows 7, and Windows 2008 R2.

Portqry can be used to identify if a port is blocked from a Dc when targeting another DC. It can be downloaded at PortQry Command Line Port Scanner Version 2.0.

Example syntax:

portqry -n <problem_server> -e 135
portqry -n <problem_server> -r 1024-5000

A graphical version of portqry, called Portqryui can be found at PortQryUI — User Interface for the PortQry Command Line Port Scanner.

If the Dynamic Port range has ports being blocked, use the below links to configure a port range that is manageable for the customer.

Additional important links for configuration and working with Firewalls and Domain Controllers:

HOWTO: Configure RPC Dynamic Port Allocation to Work with Firewall
Restricting Active Directory Replication Traffic to a Specific Port
How to Configure a Firewall for Domains and Trusts
A List of the Windows Server Domain Controller Default Ports
Port Requirements for the Microsoft Windows Server System

Bad NIC drivers

See network card vendors or OEMs for the latest drivers.

UDP fragmentation can cause replication errors that appear to have a source of RPC server is unavailable

Event ID 40960 & 40961 errors with a source of LSASRV are common for this particular cause.

For more information, see How to force Kerberos to use TCP instead of UDP in Windows.

SMB signing mismatches between DCs

Using Default Domain Controllers Policy to configure consistent settings for SMB Signing under the following section will help address this cause:

Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity Options

Microsoft network client: Digitally sign communications (always) Disabled.
Microsoft network client: Digitally sign communications (if server agrees) Enabled.
Microsoft network server: Digitally sign communications (always) Disabled.
Microsoft network server: Digitally sign communications (if client agrees) Enabled.

The settings can be found under the following registry keys:

HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManWorkstationParameters and HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParameters
- RequireSecuritySignature = always (0,disable, 1 enable).
- EnableSecuritySignature = is server agrees (0,disable, 1 enable).

Additional Troubleshooting:

If the above don’t provide a solution to the 1722, use the following Diagnostic logging to gather more information:

Windows Server 2003 SP2 computers logs extended RPC Server info in NTDS Replication events 1960, 1961, 1962 and 1963.  
Crank up NTDS Diagnostic logging

1 = basic, 2 and 3 add continually verbose info and 5 logs extended info.

Data collection

If you need assistance from Microsoft support, we recommend you collect the information by following the steps mentioned in Gather information by using TSSv2 for Active Directory replication issues.

References

RPC Return Values
Understanding Extended Error Information
Extended error information detection locations
Enabling Extended error information
Network Connectivity

Источник

Устраняем ошибку 1722 сервер rpc недоступен

Обновление 07.08.2022

Проверка DNS в лесу с несколькими доменами

Dsbindwithcred to aed failed with status 1722 0x6ba the rpc server is unavailable

Обновление 07.08.2022

Популярные Похожие записи:

6 Responses to Ошибка 1722 сервер RPC не доступен на контроллере домена

Active Directory replication error 1722: The RPC server is unavailable

Symptoms

Cause

Resolution

Verify the startup value and service status are correct for RPC, RPC Locator, and Kerberos Key Distribution Center

Verify the ClientProtocols key exists under HKEY_LOCAL_MACHINESoftwareMicrosoftRpc, and that it contains the correct default protocols

Verify DNS is working

Verify network ports are not blocked by a firewall or third-party application listening on the required ports

Bad NIC drivers

UDP fragmentation can cause replication errors that appear to have a source of RPC server is unavailable

SMB signing mismatches between DCs

Устраняем ошибку 1722 сервер rpc недоступен

Обновление 07.08.2022

Проверка DNS в лесу с несколькими доменами

Question

Answers

Active Directory replication error 1722: The RPC server is unavailable

Symptoms

Cause

Resolution

Verify the startup value and service status are correct for RPC, RPC Locator, and Kerberos Key Distribution Center

Verify the ClientProtocols key exists under HKEY_LOCAL_MACHINESoftwareMicrosoftRpc, and that it contains the correct default protocols

Verify DNS is working

Verify network ports are not blocked by a firewall or third-party application listening on the required ports

Bad NIC drivers

UDP fragmentation can cause replication errors that appear to have a source of RPC server is unavailable

SMB signing mismatches between DCs

Data collection

References