Event ID ( 4521 ) appear every 3 min after SP2 installed Help :(

Hello Everyone.

I am continously getting this warning message in the DNS event log after we
installed SP2 to our windows 2003 Root AD Server. I saw some of the post here
people also received 9002 event error. but in my case I don't see any.

I have restarted net logon service , this does since to fix the problem. any
help or suggestion will be really appreciated.

The description for Event ID ( 4521 ) in Source ( DNS ) cannot be found. The
local computer may not have the necessary registry information or message DLL
files to display messages from a remote computer. You may be able to use the
/AUXSOURCE= flag to retrieve this description; see Help and Support for
details. The following information is part of the event: 9002, ..

Check out this articles:
I executed dnscmd
/config /bootmethod, the 4521 warning message has stop.

[sergey81]

i have the same issue and when I run dnscmd /config /bootmethod the events stop until next DNS restart. It doesn't fix the problem permanently.
I've recently installed SP2 and my problem is that is the only 1 of 3 servers that contains "good" NETLOGON and SYSLOG. other 2 servers can't replicate.

Thanks.

Because you are posting a reply to an old post in a web-based forum that doesn't delete posts, we cannot see the original thread. Keep in mind, all posts at Techarena either originate in the Microsoft public newsgroups, or get replied to from the newsgroups. The Microsoft newsservers delete posts older than 90 day, hence why we cannot see the original.

However based on the event ID in the subject line, please try the following link:

If the suggestions in that link do not help, then we'll need specific information concerning your installation to determine a specific diagnosis and response, such as:

How many DCs?
An unedited ipconfig /all of your DCs.
Any other Event log errors, especially regarding replication.

[sergey81]

It looks like the issue is gone. After I restarted dns and netlogon services it never showed up again. I will try restarting the server though.
my main problem is that NTFRS doesn't replicate.
I have mutiple 13508 events without 13509 following. I've tried everything including burflags D4/D2 trick.

2 of 3 servers don't have NETLOGON and SYSVOL folders shared.

"sergey81" <sergey81.3v60zb@DoNotSpam.com> wrote in message
news:sergey81.3v60zb@DoNotSpam.com...
>
> It looks like the issue is gone. After I restarted dns and netlogon
> services it never showed up again. I will try restarting the server
> though.
> my main problem is that NTFRS doesn't replicate.
> I have mutiple 13508 events without 13509 following. I've tried
> everything including burflags D4/D2 trick.
>
> 2 of 3 servers don't have NETLOGON and SYSVOL folders shared.
>

Hi sergey81,

What are the source names of EventID 13508?

Which article did you follow to set the burflag options?

EventID 13508, Source Name = NTFRS
http://eventid.net/display.asp?event...=NtFrs&phase=1

EventID 13508, Source Name = FRS:
http://eventid.net/display.asp?event...ce=FRS&phase=1

EventID 13509, Source Name = NTFRS
http://eventid.net/display.asp?event...=NtFrs&phase=1


There are numerous things that can cause replication to fail, such as:

1. Using an ISP's DNS server as a DNS server in IP properties on the DCs and
internal machines.
2. Using the router's IP as a DNS server address in IP properties on the DCs
and internal machines.
3. DCs are multihomed (two or more NICs that are not teamed, and/or more
than one IP)
4. Single label name AD DNS domain name (';domain' rather than the minimal
required format of 'domain.com' or 'domain.local,' etc)
5. Local Windows or third party firewall software blocking traffic
6. Firewalls between locations not having the necessary ports opened.
7. ADSL links that use PPPoE, which reduces the MTU to 1492, which causes
LDAP traffic errors
8. Duplicate AD integrated zones issue
9. and more...

Therefore, without knowing specific information about your DCs or
infrastructure (such as routers, VPNs between locations, firewall rules,
what's installed on the DCs, etc), it will be difficult to diagnose this.

If you can provide the following, it may help:
1. unedited ipconfig /all of all three DCs
2. Firewalls status between locations
3. Installed software on the DCs
4. How long has this been going on?
5. ANy other EventID errors on the DCs (post the eventID and Source name
please)

Thank you,

Ace