The master browser is stopping or an election is being forced
One, or both of the following may be present in a clients events. If so then the solution is to alter the registry keys as listed to resolve the messages continual appearance.
Error Message:
The browser has received a server announcement indicating that the computer
is a master browser, but this computer is not a master browser.
The master browser has received a server announcement from the computer
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{000000000000000000. The master browser is stopping or an election is being forced.
In order to stop this error from occuring, use Regedit and set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList from Auto or YES to FALSE
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters]
Value Name: IsDomainMaster, MaintainServerList
To prevent an NT Workstation or Server (non-PDC) from acting as a browser, create a new string value, or modify the existing value, named “MaintainServerList” and set it “No”, the other options are “Yes”, “No” or “Auto”.
EventID:
Log Name: System
Source: bowser
Date: 13/07/2010 3:56:00 PM
Event ID: 8005
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer:
Description:
The browser has received a server announcement indicating that the computer
is a master browser, but this computer is not a master browser.
Log Name: System
Source: bowser
Date: 13/07/2010 3:56:00 PM
Event ID: 8003
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer:
Description:
The master browser has received a server announcement from the computer
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{. The master browser is stopping or an election is being forced.
Permalink
EVENT ID 36881 Schannel Error
I received this error on a box that holds a database that polls LDAP once a day on LDAPS to get our user directory for its contact info etc.
This error started after certificates rotated on some of the boxes and it must have rotated on the box this server polls to get the AD info from.
Thanks to Microsoft the solution was simple but annoying, a scheduled reboot of the machine.
http://support.microsoft.com/kb/839514
EventID:
Event Type: Error
Event Source: Schannel
Event Category: None
Event ID: 36881
Date: 7/10/2009
Time: 6:38:56 PM
User: N/A
Computer:
Description:
The certificate received from the remote server has expired. The SSL connection request has failed. The attached data contains the server certificate.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
MSDTC Could Not Correctly Process a DC Promotion/Demotion event. EVENT ID 53258
Installing a fresh windows 2003 R2 install onto a new esx server and then creating a new forest from scratch yielded this error.
I created a brand new domain from scratch and got this error off the bat so i thought it was worth fixing before it got any worse.
Error Message:
EVENTID 53258
Source MSDTC
MS DTC could not correctly process a DC Promotion/Demotion event. MS DTC will continue to function and will use the existing security settings.
One of the Many eventid.net responses helped me out here.
EVENTID Article
1. Click Start -> Administrative Tools -> Component Services.
2. Click the “+” next to Component services to expand it.
3. Right click “My Computer” in the right window pane and select Properties.
4. Click the MS DTC Tab.
5. Click the “Security Configuration” button, a dialog box appears. Click “OK”.
6. Click “OK” on the “My Computer Properties” box; this will take you back to the console.
7. Right click “My Computer” and select “Stop MS DTC” (this stops the MSDTC service.
8. Again, right click “My Computer” and select “Start MS DTC”.
By following the above steps, it appears that this sets the MS DTC defaults resolving the error messages. Check the event log to verify that the problem is gone. You might also want to restart the server to verify this.
Gpresult On 2003 Native Domain Shows 2000
This did come as a shock to me but due to the age of the application it still only identifies Native 2003 domains as 2000 Domains, so no need to panic like I did and wonder what massive part of your network just broke.
Example gpresult on a native 2003 domain:
—————————————————————————————————
C:\>gpresult
Microsoft (R) Windows (R) XP Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 27/03/2008 at 11:16:03 AM
RSOP results for domain\user.name on computername : Logging Mode
———————————————————————————————————
OS Type: Microsoft Windows XP Professional
OS Configuration: Member Workstation
OS Version: 5.1.2600
Domain Name: domainname
Domain Type: Windows 2000
Site Name: sitename
Roaming Profile:
Local Profile: C:\Documents and Settings\user.name
Connected over a slow link?: No
How to find FSMO roles in a Domain
FSMO Roles are extremely important to Active Directory and understanding where they lie and how they all work (eg. some roles only exist once on a domain) should be at the top of your list of “things to know” if you aren’t already well versed on it.
Wiki - FSMO Explained
Windows Networking explain FSMO
Petri explanation of FSMO
I found this Technet Blog to be extremely useful in the most efficient ways to find where your roles lie.
On any domain controller, click Start, click Run, type Ntdsutil in the Open box, and then click OK.
Type roles, and then press ENTER.
Type connections, and then press ENTER.
Type connect to server
is the name of the server you want to use, and then press ENTER.
At the server connections: prompt, type q, and then press ENTER again.
At the FSMO maintenance: prompt, type Select operation target, and then press ENTER again.
At the select operation target: prompt, type List roles for connected server, and then press ENTER again.
Type q 3 times to exit the Ntdsutil prompt.
Petri has an article on the matter but i find his ways a little more involved than the technet above from Mark.
I find that no matter how confident I am that I have removed all FSMO from a domain controller before demoting it, I still use this to double check.
Printers Not Appearing In Active Directory When Published
So Printers are being added but they aren’t appearing in AD even when you tick the box in the sharing tab “List in the Directory” they still do not appear.
Of note is when you add a new printer into your printer list the local events will show an Event ID 9 (System Event Log). What should happen when its added to AD is you see an Event ID 36, In my case I didn’t see this event at all.
Googling around I noticed that the fix most people were going for is to reboot the server, in my case fortunately that is a primary file server in one of my larger sites so was not an option. The issue is actually stemming from the good ol’ Print Spooler Service; all you need to do is restart that service and all those printers that you added and haven’t appeared will now all be there. Event ID 36 will also appear in logs if you are doing this remote and can’t actually see the list for whatever reason. The problem seems to just happen over time as after a print spooler service restart i can still add printers and they update straight away but if i leave the server up for a lengthy period of time (Days/Weeks) i notice i have to restart the service, im not sure if this is by design or one of MS little ‘quirks’ but its a hacky solution to an unfixable problem from what i found.
Printers Dissapearing From Active Directory
Whilst looking through issues for another printing problem closely related I came across an old issue I had that I thought best I put up here for safe keeping as I’m sure it will happen to me or someone else again.
Printers in the Active Directory printer list can sometimes just disappear for no reason at all; this is actually due to a bigger problem in your network. In my case it was one site where AD was not replicating properly and as such it couldn’t contact the main print server and just deleted all the printers. This is known as Printer Pruning, I’ve got the official MS article HERE
The quick and easy fix for this is just to go into the printers sharing tab, un-tick the List in the Directory option, hit apply and re-tick it. If that doesn’t work un-tick, restart spooler, tick again and restart spooler to be 100% sure it’s applying.
Please note this is exposing a bigger issue where AD is not communicating properly and should be investigated straight away (now that your printers are working and your users aren’t screaming at you anymore because they can’t print their tenders). You should be seeing logs reporting problems in replication and fix them as soon as possible.