After struggling for quite a while to get the right commands to fix a domain controller we thought it a good idea to post the steps we had to take.
I know a lot of people would say that the best way is to dcpromo the DC out of the domain, do a meta data cleanup and then dcpromo it in again. Sometimes this method is not possible like in instance were your DC is also an Exchange server. Then you would first have to migrate the Exchange to another server before fixing the broken DC.
Always first and foremost is to make sure you have a system state backup of a healthy DC in case something goes wrong.
The first step is to allow the other domain controllers in your domain to replicate with Tombstoned DC. To do this follow the steps below:
- Click Start, click Run, type regedit, and then click OK.
- Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
- In the details pane, create or edit the registry entry as follows:
If the registry entry exists in the details pane, modify the entry as follows:
- In the details pane, right-click Allow Replication With Divergent and Corrupt Partner, and then click Modify.
- In the Value data box, type 1, and then click OK.
If the registry entry does not exist, create the entry as follows:
- Right-click Parameters, click New, and then click DWORD Value.
- Type the name Allow Replication With Divergent and Corrupt Partner, and then press ENTER.
- Double-click the entry. In the Value data box, type 1, and then click OK.
The next step would be to clear lingering objects that is residing on the Tombstoned DC.
Lingering objects are objects that are residing on the Tombstoned DC. This happens for instance when an Object is deleted on a working DC, the object is then tombstoned for 180 days. Then after the 180 days the object is removed completely. Now the tombstoned DC if it was still replicating normally it would detected that the object is tombstoned on another DC and place the same object residing in its database also in a tombstoned state.
Now when you bring the Tombstoned DC back into replication it will have that object in its database but the domain would not know about it as its removed the object completely. This can create inconsistencies in your domain.
To remove these lingering objects is a 2 step process which is described below:
1. First you need to view the lingering objects to make sure you are not deleting anything important.
You run this command:
Repadmin /removelingeringobjects ServerWithLingeringObjects CleanServerGUID NamespaceContainingLingeringObject /advisory_mode
Repadmin /removelingeringobjects DC95 a4bcd546-5e94-2330-b4d0-f218b16dc0f6 DC=Test,DC=Com
The server that throws the error is actually the clean server (CleanServerGUID). The GUID of this server can be located in DNS. Expand Forward Lookup Zones and click in the _msdcs.DOMAIN.NAME zone. In this zone there are CNAME records that point all DCs in the domain to their GUIDs. Copy the GUID of the server that threw the error.
After running this the lingering objects will be listed in the Event Logs so you can have a look there.
2. To remove the lingering objects run the exact same command but remove the /Advisory_mode
3. Reboot the domain controllers and see if the replication starts.