Azure AD Domain Services Domain Controller's failing Replications Test

Question

I have up Azure AD DS, have joined some Windows 10 PC's, and created some security groups and GPO's. I am getting investigating an error in the Windows 10 System Event Log (Event 4, Security-Kerberos. The Kerberos client received a KRB_AP_ERR_Modified error from the server [AADDS-DC-SERVER-NAME$]. The target name used was ldap/FQDN-OF-SERVER/DOMAIN.COM@keyman .COM. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (DOMAIN.COM) is different from the client domain (DOMAIN.COM), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.). I thought I'd do a quick test on the AADDS Domain Controllers with DCDIAG, and they are showing that Replications have been failing since yesterday. Results below:

Starting test: Replications
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=ForestDnsZones,DC=domain,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
34 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=DomainDnsZones,DC=domain,DC=com
The replication generated an error (1256):
The remote system is not available. For information about network troubleshooting, see Windows Help.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
45 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
31 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: CN=Configuration,DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 10:48:28.
The last success occurred at 2020-01-16 03:58:53.
33 failures have occurred since the last success.
[Replications Check,DC2] A recent replication attempt failed:
From DC1 to DC2
Naming Context: DC=domain,DC=com
The replication generated an error (-2146893022):
The target principal name is incorrect.
The failure occurred at 2020-01-17 11:15:57.
The last success occurred at 2020-01-16 04:54:52.
1777 failures have occurred since the last success.
......................... DC2 failed test Replications

Given that the AADDS DC's are supposed to be locked down, how is this happening?

Answer 1

It sounds like there's an issue with your networking or your AAD DS is having issues.

If you're still having an issue here, please email AzCommunity[at]microsoft[dot]com and I can enable a one time free support ticket. Please provide your Azure Subscription GUID and a reference to this thread. And hopefully we can get you on the right path again soon. 

Please see : https://blogs.msdn.microsoft.com/mschray/2016/03/18/getting-your-azure-subscription-guid-new-portal/

On how to get a subscription GUID.

In addition to that once you are able to resolve your issue with the support engineer, please post your response on this thread so that future readers will be able to benefit from your solution.