walkied in to office yesterday morning, and saw the replication between domain controllers (there are total of 2 domain controllers) is broken in one of the child domains. 'repadmin /syncall /e' throws 'access denied' from parent domain. 'repadmin /syncall' between DC in child domain does generate errors from DC2 on DC1. from DC1 on DC2 is Ok. (will update tommorow, maybe i forgot the orders)
since i do not rely on repadmin output, i created test user to see replication. it copies from dc2 to dc1 but not from dc1 to dc2. so I went to dig about kerberos and there was 'KRB_AP_Modified'. actually hundreds of this error on DC2 which says cant accept request from DC1. apparently UNS path to domain does not work too.
went through troubleshooting. stopedd KDC, netdom reset pwd, klist purge, start kdc.. issue is not fixed. 'pwdlastset' shows the password is set on corrupted dc but issue is not fixed. But here is the fun thing, I stop KDC on problematic DC, klist purge, reauthenticate myself, eveyrhing works find even repadmin in child domain. (issue still exist within parent)..once I start KDC, the story begins which is expected behaviour of broken kerberos.
I wanted to do the force demote but since there are errors from parent domain about replication, i guess i will end up in more mess because force 'replicate now' from parent domain via site & services shows error for "Replicate from..." but "Replicate to..." is OK.
one question apart from the story:
every type of troubleshooting of replication i did so far was based on articles and step by steps of other poeple. I can't tolerate this anymore. what should i do in order to learn the whole thing and understands perfectly, and then start using my own steps to overcome replication problems? rather than following articles blindfolded.
I think I am missing something like a deep book of troubleshooting, an online course of troubleshooting to understands things deeply. I have read brian desmon book back in 3 years but that was when I was so so newbie. I think i have to brush up on that. any other ideas towards this?