So I have a pair of 2003 Domain Controllers which seem to have problems replicating. After running netdiag, dcdiag I figured out that there is an RPC problem, so I tested the connection with portqry.exe. From DC2 to DC1 the connection to Domain related ports (ldap, RPC, DNS, Kerberos,...) seem fine. The opposite doesn't seem to work:
TCP port 135 (epmap service): FILTERED
portqry.exe -n 10.6.8.35 -e 135 -p TCP exits with return code 0x00000002.
TCP port 445 (microsoft-ds service): FILTERED
portqry.exe -n 10.6.8.35 -e 445 -p TCP exits with return code 0x00000002.
Wireshark also shows that DC1 receives packets, but does not reply back to DC2, so DC2 retransmits. Other ports are ok:
TCP port 389 (ldap service): LISTENING
UDP port 389 is LISTENING
TCP port 3268 (msft-gc service): LISTENING
TCP port 53 (domain service): LISTENING
UDP port 53 (domain service): LISTENING
Windows firewall is disabled on both servers and they are on the same subnet so there is no other kind of external firewall blocking traffic. All services including RPC are started and running.
Netstat on DC2:
C:\Documents and Settings\Administrator>netstat -na | findstr 135
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 10.6.8.35:135 10.6.8.35:1814 ESTABLISHED
TCP 10.6.8.35:1814 10.6.8.35:135 ESTABLISHED
C:\Documents and Settings\Administrator>netstat -na | findstr 445
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
UDP 0.0.0.0:445 *:*
Running the same test with portqry.exe on localhost also does not seem to work as expected:
Starting portqry.exe -n 127.0.0.1 -e 135 -p TCP ...
Querying target system called:
127.0.0.1
Attempting to resolve IP address to a name...
IP address resolved to adc.xxx.gr
querying...
TCP port 135 (epmap service): LISTENING
Using ephemeral source port
Querying Endpoint Mapper Database...
Server's response:
RPC Endpoint Mapper did not respond
TCP port 135 is FILTERED
portqry.exe -n 127.0.0.1 -e 135 -p TCP exits with return code 0x00000000.
User contributions licensed under CC BY-SA 3.0