asked on

2003 AD Child to Parent DC Replication is Tombstoned

We have a domain, child.parent.edmondok.com for example (parent.edmondok.com would be the example parent domain), whose 2 domain controllers (CDDC001 and CDBKU01) are not replicating to the 2 parent domain controllers (PD01 and PD02). Something happened back in Febuary 2008, and now CDDC001 and CDBKU01 are tombstoned (tombstone lifetime set to 60 days). Shows what happens when you bury your head in projects and don't check maintenance. It apparently isn't causing any issues, as the two domains don't have much interaction. We are upgrading to 2008, and I would like to get this taken care of before doing so.
I have read on other threads that there are two things we can do to resolve this. The most often recommended is to forcibly demote the DCs using dcpromo /forceremoval and then cleanup the metadata.
As both the child.parent.edmondok.com domain controllers are tombstoned, I'm not sure I should demote them both.
The other option is to run repadmin /removelingeringobjects on all the DCs (with the correct parameters including servername and serverGUID) and then force replication by modifying the "Allow Replication With Divergent and Corrupt Partner" reg key in "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" to 1. After replication I would set it back.
I believe the second option would be best in my case due to both child DCs having been tombstoned and just want to get verification that it is the best option.
Thanks for all comments and answers.

ASKER CERTIFIED SOLUTION

Abhay Pujari

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

Edmondadm

ASKER

As the child domain was a must for security reasons, I went for option 2 with a slight modification. Since the child domain is a small domain and there were very few changes made to it, I just forced replication without removing lingering objects. The reason for this was that I wasn't sure if anything was added to the child domain (new users, etc), but only one user had been deleted that still showed in the parent domain. Forcing replication may have added that user back, but ensured I kept any changes that were made to the child domain that the parent domain wasn't aware of. I'm not entirely sure that is how it works, but didn't want to take a chance. All is working now. Thanks.