Chat now with support
Chat with Support

Active Administrator 8.6.3 - Web Console User Guide

Active Administrator Web Console Overview Active Directory Health Alerts Notifications Active Directory Health Check
Using the Health Check landing page Creating a Health Check Setting options for Health Check tests Purging Health Check History Health check tests
Forest tests Domain tests Domain controller tests Site tests
Active Directory Topology Reports Network Operations Center

Naming operations master not responding

Indicates if the naming operations master is not responding within the configured threshold.

Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Description
•
The domain controller does not exist, is not running, or lost connectivity to the network
•
The DNS records for the domain controller are incorrect; e.g., the IP address for the domain controller is not what is published in DNS.
•
Active Directory® on the domain controller has failed, or is overloaded and taking too long to respond.
Resolution
•
Ping the domain controller to see if there is connectivity. If there is not, fix that problem. The problem may be that DNS has the incorrect address or the IP stack for the domain controller is misconfigured.
•
If the domain controller does not exist, run NTDSUTIL and select the metadata cleanup option to clean up the erroneous objects in the directory.
•
Check the LDAP response time for the domain controller. If it is too high, you may need to add another domain controller for the same domain in the same site.

Schema operations master inconsistent

Indicates that the schema operations master is not consistent among all domain controllers in the forest.

Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Description

The schema operations master object (CN=&ldots;) contains an attribute called fSMORoleOwner, which contains the distinguished name of the domain controller that is allowed to originate changes to the Active Directory® schema. When an administrator attempts to modify the Active Directory schema, the directory system agent (DSA) makes sure that the fSMORoleOwner property refers to the server on which the administrator is making the change. If it does not refer to that server, the DSA will not modify the schema. The schema operations master ensures that the schema cannot become inconsistent because of conflicting changes issued from different domain controllers.

If the schema operations master is inconsistent, meaning the domain controllers have differing values for the fSMORoleOwner attribute, it is possible for administrators (or others) to issue conflicting updates to the schema, potentially causing sufficient damage to Active Directory that replication will fail. It is important to not attempt to modify the Active Directory schema when the schema operations master is inconsistent.

The schema operations master can become inconsistent due to replication failures or due to an administrator using NTDSUTIL.EXE to move the operations master to another domain controller. This can also be transient if the replication latency for the schema naming context is fairly large.

Resolution
•
Make sure that no one attempts to modify the Active Directory schema while the schema operations master is inconsistent.
•
Normally, the Active Directory replication process will correct this error, so the next step is to wait awhile to see if the error clears by itself. The amount of time you should wait depends on the replication latency for the schema naming context.
•
If the error does not clear itself in a reasonable amount of time, contact your Microsoft® Windows® support representative.

Schema operations master not responding

Indicates that the schema operations master is not responding within the configured threshold.

Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Description
•
The domain controller does not exist, is not running, or lost connectivity to the network
•
The DNS records for the domain controller are incorrect; e.g., the IP address for the domain controller is not what is published in DNS.
•
Active Directory® on the domain controller has failed, or is overloaded and taking too long to respond.
Resolution
•
Ping the domain controller to see if there is connectivity. If there is not, fix that problem. The problem may be that DNS has the incorrect address or the IP stack for the domain controller is misconfigured.
•
If the domain controller does not exist, run NTDSUTIL and select the metadata cleanup option to clean up the erroneous objects in the directory.
•
Check the LDAP response time for the domain controller. If it is too high, you may need to add another domain controller for the same domain in the same site.

Schema version inconsistent

Indicates that the schema version is not consistent across all domain controllers in the forest.

Requirements
•
Supported on: Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019
•
Required permissions: Domain user privilege is required.
Resolution
•
Wait for a while to see if the error clears itself. An inconsistent schema version error can be transitory in nature.
•
If you have waited long enough for replication to have occurred to all domain controllers, contact your Microsoft® Windows® support representative.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating