Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


How can i remove the Distinguished Name Attribute of a Removed Domain Controller In Active Directory ?

Posted on 2008-09-30
Medium Priority
Last Modified: 2010-03-17
In one of my domain controllers after running dcdiag tool i got a warning about a replication with a dc that no longer exist; in order to delete this record i opened ADSIEDIT in this particular server where i got this warning and i found it after doing a right click on Configuration | Schema | Domain (it doesn't matter which one i pick it's in the 3 of them), then going to Master By | Distinguished Name | and here are the list of my dc's including the one that i want to delete, so i select it then click on remove, then ok and when i try to click on Apply i got the error "The attribute cannot be modified because it is owned by the system", i checked permissions and i have Full control.
Question by:QUIMMCOIT
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Expert Comment

ID: 22610401

Author Comment

ID: 22613827
I did the 3 Procedures

Still have the same issue in the same Domain Controller.

Expert Comment

ID: 22655819
Did you perform the DNS steps in the _msdcs.root  section?
Did that dc hold any of the fsmo roles by any chance?
Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.


Author Comment

ID: 22659318
The server does not contain any fsmo roles, and yes i did the steps in the DNS

Author Comment

ID: 22995228
This is what Microsoft suggested, Im still testing, I'll let you know if it works

Actually, the real problem is not this DC tried to replicated with
non-existing DCs, this issue happen when the problematic DC has not
replicated for over 60 days (a.k.a. The tombstone lift time). When the DC
hasn't replicated with other DC more than tombstone, the replication will
be automatically disabled for security consideration. Therefore, no
replication will happen and the AD database on the problematic DC will not
updated which leads it to replicate with non-existing DCs.

In addition, even though you delete the reference in the AD database, it
will not replicate successfully either. Thus we need enable the replication
firstly and then sync the problematic DCs with the authoritative DC. For
now, please perform the following steps to test the issue:
Step 1: Please make sure the time is properly synchronized between the
domain controllers

Step 2:
On GOOD DCs, add the following registry key to resume replication:

1. Click Start, click Run, type regedit, and then click OK.
2. Navigate to the following key:


3. In the details pane, create or edit the registry entry "Allow
Replication With Divergent and Corrupt Partner" as follows:

If the registry entry exists in the details pane, modify the entry as

a. In the details pane, right-click Allow Replication With Divergent and
Corrupt Partner, and then click Modify.
b. In the Value data box, type 1, and then click OK.

If the registry entry does not exist, create the entry as follows:

a. Right-click Parameters, click New, and then click DWORD Value.
b. Type the name Allow Replication With Divergent and Corrupt Partner, and
then press ENTER.
c. Double-click the entry. In the Value data box, type 1, and then click OK.

If the replication still does not happen, perform the next step:

Step 3:
Still on the good DCs.

1. Locate and click the following registry key:


2. Click Add Value on the Edit menu.
3. Add the following value:

Value Name: Strict Replication Consistency
Data type: REG_DWORD
Value data: If the value is 1 , change it to 0 .

Then please restart the server to force a replication.

What's the result?

After replication starts successfully, revert the registry change made in
Step 2 and 3: change "Allow Replication With Divergent and Corrupt Partner"
to 0 and "Strict Replication Consistency" back to 1.

Event ID 2042: It has been too long since this machine replicated

Author Comment

ID: 24487534

Accepted Solution

ee_auto earned 0 total points
ID: 24515708
Question PAQ'd, 500 points refunded, and stored in the solution database.

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question