Authoritative Restore Triggers Communication Error on Bridgehead Servers (289901)

CAUSE

This problem occurs after an administrator performs an authoritative restore operation by using the Ntdsutil utility that is included with Windows 2000. When you use the Restore Database option, this procedure increments the version number on each attribute for each object in the naming contexts in the database (DIT).

After this procedure is finished, these changes are replicated to other domain controllers. The object that causes the higher-level problem (the Knowledge Consistency Checker, or KCC, generating topology/replication errors) is a cross-ref object for the root domain. Cross-ref objects are present in the Configuration naming context in Active Directory and represent each domain in the forest.

After the authoritative restore process, the cross-ref object in the Configuration container is updated for the domain (as a result of Active Directory replication), which triggers a data refresh on the domain controller. Part of this refresh is to generate Service Principal names (SPNs), which are used to locate services on given computers. However, during this refresh, not enough buffer is allocated (see the information below) and the resulting SPN is truncated. For example, a domain controller would typically register or advertise: However, when the refresh occurs, the data is truncated to: The domain controller registers the latter and this information is replicated to a global catalog server, which other computers query to locate a given computer. The higher-level problem is that, in this scenario, the inter-site topology generator is attempting to communicate with one of the bridgehead servers. It does this by looking up a specific SPN in Active Directory. When it queries the global catalog server for this value, it looks for the full name that is referenced above, but a negative response is returned from the global catalog server, resulting in the event log messages.

   Date         Time    Version        Size     File name
   -----------------------------------------------------------------
   6/27/2001   12:19p	5.0.2195.3787  501,520	Lsasrv.dll(56-bit)
   7/2/2001	   05:49p	5.0.2195.3787  355,088	Advapi32.dll
   7/2/2001	   06:38p	5.0.2195.3787  519,440	Instlsa5.dll
   7/2/2001	   05:49p	5.0.2195.3787  143,120	Kdcsvc.dll
   6/26/2001   08:15p	5.0.2195.3781  197,392	Kerberos.dll
   6/26/2001   08:16p	5.0.2195.3781   69,456	Ksecdd.sys
   6/27/2001   12:20p	5.0.2195.3787  501,520	Lsasrv.dll
   6/26/2001   08:16p	5.0.2195.3781   33,552	Lsass.exe
   7/2/2001	   05:49p	5.0.2195.3781  909,072	Ntdsa.dll
   7/2/2001	   05:49p	5.0.2195.3781  382,224	Samsrv.dll
   7/2/2001	   05:49p	5.0.2195.3781  128,784	Scecli.dll
   7/2/2001	   05:49p	5.0.2195.3649  299,792	Scesrv.dll