NTDS KCC 1265

1 Apr 2005 6:13 PM

wli2k2

I am getting a ton of NTDS KCC Event ID 1265 messages inside the Directory
Service of Event Viewer.

Does this message implied that the demotion of a DC was not successful,
meaning there still some entries in the AD that needs to be removed?

Thanks to all

1 Apr 2005 11:20 PM

Andrei Ungureanu

can be ... was that DC demoted recently ?

for some general troubleshoting of this event look at
http://www.eventid.net/display.asp?eventid=1265&eventno=346&source=NTDS%20KCC&phase=1

--
Andrei Ungureanu
www.eventid.net
Free Windows event logs reports
http://www.altairtech.ca/evlog/

Show quoteHide quote

"wli2k2" <wli***@discussions.microsoft.com> wrote in message
news:34DAA9C2-1689-4FF9-9F18-9196DB68618F@microsoft.com...
>I am getting a ton of NTDS KCC Event ID 1265 messages inside the Directory
> Service of Event Viewer.
>
> Does this message implied that the demotion of a DC was not successful,
> meaning there still some entries in the AD that needs to be removed?
>
> Thanks to all
>
>

2 Apr 2005 1:15 AM

wli2k2

Actually, someone else in my group demoted it recently. My understanding is
that he could not demote the DC via running DCPROMO, so he manually deleted
the data in AD (http://support.microsoft.com/kb/216498/). The next day,
users were having problems logging in, so he did a dcpromo /forceremoval.

But now we are having this NTDS KCC error in the event viewer.

Also, on a related note, the KB216498 article states that to remove the DC
from Active Directory Sites and Services. Yet, when I tried to delete, it
gave me the message "the DSA object cannot be deleted."

Any suggestions on this, because I think the problem might be solved if I am
able to delete the DC from Active Directory Sites and Services.

thanks

Show quoteHide quote

"Andrei Ungureanu" wrote:

> can be ... was that DC demoted recently ?
>
> for some general troubleshoting of this event look at
> http://www.eventid.net/display.asp?eventid=1265&eventno=346&source=NTDS%20KCC&phase=1
>
>
>
> --
> Andrei Ungureanu
> www.eventid.net
> Free Windows event logs reports
> http://www.altairtech.ca/evlog/
>
>
> "wli2k2" <wli***@discussions.microsoft.com> wrote in message
> news:34DAA9C2-1689-4FF9-9F18-9196DB68618F@microsoft.com...
> >I am getting a ton of NTDS KCC Event ID 1265 messages inside the Directory
> > Service of Event Viewer.
> >
> > Does this message implied that the demotion of a DC was not successful,
> > meaning there still some entries in the AD that needs to be removed?
> >
> > Thanks to all
> >
> >
>
>
>

2 Apr 2005 8:45 AM

Andrei Ungureanu

try using ADSIEDIT (but make a backup first)

--
Andrei Ungureanu
www.eventid.net
Free Windows event logs reports
http://www.altairtech.ca/evlog/

Show quoteHide quote

"wli2k2" <wli***@discussions.microsoft.com> wrote in message
news:10D6E407-1B9B-45D0-BDC8-3A07F55CC72B@microsoft.com...
> Actually, someone else in my group demoted it recently. My understanding
> is
> that he could not demote the DC via running DCPROMO, so he manually
> deleted
> the data in AD (http://support.microsoft.com/kb/216498/). The next day,
> users were having problems logging in, so he did a dcpromo /forceremoval.
>
> But now we are having this NTDS KCC error in the event viewer.
>
> Also, on a related note, the KB216498 article states that to remove the DC
> from Active Directory Sites and Services. Yet, when I tried to delete, it
> gave me the message "the DSA object cannot be deleted."
>
> Any suggestions on this, because I think the problem might be solved if I
> am
> able to delete the DC from Active Directory Sites and Services.
>
> thanks
>
> "Andrei Ungureanu" wrote:
>
>> can be ... was that DC demoted recently ?
>>
>> for some general troubleshoting of this event look at
>> http://www.eventid.net/display.asp?eventid=1265&eventno=346&source=NTDS%20KCC&phase=1
>>
>>
>>
>> --
>> Andrei Ungureanu
>> www.eventid.net
>> Free Windows event logs reports
>> http://www.altairtech.ca/evlog/
>>
>>
>> "wli2k2" <wli***@discussions.microsoft.com> wrote in message
>> news:34DAA9C2-1689-4FF9-9F18-9196DB68618F@microsoft.com...
>> >I am getting a ton of NTDS KCC Event ID 1265 messages inside the
>> >Directory
>> > Service of Event Viewer.
>> >
>> > Does this message implied that the demotion of a DC was not successful,
>> > meaning there still some entries in the AD that needs to be removed?
>> >
>> > Thanks to all
>> >
>> >
>>
>>
>>

2 Apr 2005 3:13 PM

wli2k2

My problem is that I followed everything in KB216498, including the using
ADSIEDIT and I did not find the DC name. But, I did found the DC name in AD
Sites and Services. However, I get the "the DSA object cannot be deleted"
message when I tried to delete it.

There must be something that can be done to remove the object.

Any suggestions would be greatly appreciated.
thanks

Show quoteHide quote

"Andrei Ungureanu" wrote:

> try using ADSIEDIT (but make a backup first)
>
>
> --
> Andrei Ungureanu
> www.eventid.net
> Free Windows event logs reports
> http://www.altairtech.ca/evlog/
>
> "wli2k2" <wli***@discussions.microsoft.com> wrote in message
> news:10D6E407-1B9B-45D0-BDC8-3A07F55CC72B@microsoft.com...
> > Actually, someone else in my group demoted it recently. My understanding
> > is
> > that he could not demote the DC via running DCPROMO, so he manually
> > deleted
> > the data in AD (http://support.microsoft.com/kb/216498/). The next day,
> > users were having problems logging in, so he did a dcpromo /forceremoval.
> >
> > But now we are having this NTDS KCC error in the event viewer.
> >
> > Also, on a related note, the KB216498 article states that to remove the DC
> > from Active Directory Sites and Services. Yet, when I tried to delete, it
> > gave me the message "the DSA object cannot be deleted."
> >
> > Any suggestions on this, because I think the problem might be solved if I
> > am
> > able to delete the DC from Active Directory Sites and Services.
> >
> > thanks
> >
> > "Andrei Ungureanu" wrote:
> >
> >> can be ... was that DC demoted recently ?
> >>
> >> for some general troubleshoting of this event look at
> >> http://www.eventid.net/display.asp?eventid=1265&eventno=346&source=NTDS%20KCC&phase=1
> >>
> >>
> >>
> >> --
> >> Andrei Ungureanu
> >> www.eventid.net
> >> Free Windows event logs reports
> >> http://www.altairtech.ca/evlog/
> >>
> >>
> >> "wli2k2" <wli***@discussions.microsoft.com> wrote in message
> >> news:34DAA9C2-1689-4FF9-9F18-9196DB68618F@microsoft.com...
> >> >I am getting a ton of NTDS KCC Event ID 1265 messages inside the
> >> >Directory
> >> > Service of Event Viewer.
> >> >
> >> > Does this message implied that the demotion of a DC was not successful,
> >> > meaning there still some entries in the AD that needs to be removed?
> >> >
> >> > Thanks to all
> >> >
> >> >
> >>
> >>
> >>
>
>
>