Fixing Replication Security Problems
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
When security problems cause replication to fail, various event log messages and Repadmin messages contain error codes that identify the problems.
The version of Dcdiag.exe that is included with Windows Support Tools in Windows Server 2003 Service Pack 1 (SP1) provides new functionality that reports on the overall health of replication with respect to Active Directory. Dcdiag is modified to detect common causes of "Access denied" events, "Account unknown" events, and similar events.
The error codes that Dcdiag detects are described in the following table. Error codes that are marked with an asterisk (*) are not always caused by a security problem.
| Error code | Description |
|---|---|
5 |
Access is denied. |
1314* |
A required privilege is not held by the client. |
1326 |
Logon failure: unknown user name or bad password. |
1396 |
Logon failure: The target account name is incorrect. |
1908 |
Could not find the domain controller for this domain. |
1397* |
Mutual authentication failed. The server's password is out of date at the domain controller. |
1398* |
There is a time and/or date difference between the client and server. |
1722* |
The remote procedure call (RPC) server is unavailable. |
2202* |
The specified username is invalid. |
8453 |
Replication access was denied. |
Use the procedures in An "Access denied" or other security error has caused replication problems to diagnose and fix replication security problems.