We help IT Professionals succeed at work.

How can i remove the Distinguished Name Attribute of a Removed Domain Controller In Active Directory ?

251 Views
Last Modified: 2010-03-17
In one of my domain controllers after running dcdiag tool i got a warning about a replication with a dc that no longer exist; in order to delete this record i opened ADSIEDIT in this particular server where i got this warning and i found it after doing a right click on Configuration | Schema | Domain (it doesn't matter which one i pick it's in the 3 of them), then going to Master By | Distinguished Name | and here are the list of my dc's including the one that i want to delete, so i select it then click on remove, then ok and when i try to click on Apply i got the error "The attribute cannot be modified because it is owned by the system", i checked permissions and i have Full control.
Comment
Watch Question

Author

Commented:
I did the 3 Procedures
1.- NTDSUTIL
2.- REMOVE SERVER OBJECTS FROM SITE
3.- REMOVE THE FAILED SERVER OBJECT FROM THE DOMAIN CONTROLLERS CONTAINER

Still have the same issue in the same Domain Controller.
Did you perform the DNS steps in the _msdcs.root  section?
Did that dc hold any of the fsmo roles by any chance?

Author

Commented:
The server does not contain any fsmo roles, and yes i did the steps in the DNS

Author

Commented:
This is what Microsoft suggested, Im still testing, I'll let you know if it works

Actually, the real problem is not this DC tried to replicated with
non-existing DCs, this issue happen when the problematic DC has not
replicated for over 60 days (a.k.a. The tombstone lift time). When the DC
hasn't replicated with other DC more than tombstone, the replication will
be automatically disabled for security consideration. Therefore, no
replication will happen and the AD database on the problematic DC will not
updated which leads it to replicate with non-existing DCs.

In addition, even though you delete the reference in the AD database, it
will not replicate successfully either. Thus we need enable the replication
firstly and then sync the problematic DCs with the authoritative DC. For
now, please perform the following steps to test the issue:
 
Step 1: Please make sure the time is properly synchronized between the
domain controllers

Step 2:
====================
On GOOD DCs, add the following registry key to resume replication:

1. Click Start, click Run, type regedit, and then click OK.
2. Navigate to the following key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

3. In the details pane, create or edit the registry entry "Allow
Replication With Divergent and Corrupt Partner" as follows:

If the registry entry exists in the details pane, modify the entry as
follows:

a. In the details pane, right-click Allow Replication With Divergent and
Corrupt Partner, and then click Modify.
b. In the Value data box, type 1, and then click OK.

If the registry entry does not exist, create the entry as follows:

a. Right-click Parameters, click New, and then click DWORD Value.
b. Type the name Allow Replication With Divergent and Corrupt Partner, and
then press ENTER.
c. Double-click the entry. In the Value data box, type 1, and then click OK.

If the replication still does not happen, perform the next step:

Step 3:
========================
Still on the good DCs.

1. Locate and click the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

2. Click Add Value on the Edit menu.
3. Add the following value:

Value Name: Strict Replication Consistency
Data type: REG_DWORD
Value data: If the value is 1 , change it to 0 .

Then please restart the server to force a replication.

What's the result?

After replication starts successfully, revert the registry change made in
Step 2 and 3: change "Allow Replication With Divergent and Corrupt Partner"
to 0 and "Strict Replication Consistency" back to 1.

Reference:
----------------
Event ID 2042: It has been too long since this machine replicated
http://technet2.microsoft.com/windowsserver/en/library/34c15446-b47f-4d51-8e
4a-c14527060f901033.mspx

Author

Commented:
ok
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.