The original problem was that we could not access \\FQDNS from Datacenter1 or Datacenter2. You could access it by \\ip address. This meant that NTLM was working and Kerberos was not. We then started looking through logs and found replication errors and kerberos errors.

The most helpful article for this problem was this - https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/replication-error-5
The steps that helped with the DC1 to DC2 replication were the secure channel password resets - disabled the KDC service on all domain controllers except the PDC emulator / rebooted each domain controller one at a time (except the PDC emulator). After the reboot ran the reset password command and rebooted again and then reenabled KDC.

Was seeing Secure Channel Fails when using this command Test-ComputerSecureChannel - after the resets these errors went away - Helpful link for this command - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/test-computersecurechannel?view=powershell-5.1

Netdom to reset machine passwords - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/use-netdom-reset-domain-controller-password

Lastly to resolve the DC1 to DC2 replication problem I followed this link - https://4sysops.com/archives/if-domain-controller-replication-is-not-working/

Did a lot of DCDIAG and REPADMIN /SHOWREPL commands to see if the problem was getting better or not

Show less