2003 AD Child to Parent DC Replication is Tombstoned

Posted on 2009-05-06
Last Modified: 2012-05-06
We have a domain, for example ( would be the example parent domain), whose 2 domain controllers (CDDC001 and CDBKU01) are not replicating to the 2 parent domain controllers (PD01 and PD02).  Something happened back in Febuary 2008, and now CDDC001 and CDBKU01 are tombstoned (tombstone lifetime set to 60 days).  Shows what happens when you bury your head in projects and don't check maintenance.  It apparently isn't causing any issues, as the two domains don't have much interaction.  We are upgrading to 2008, and I would like to get this taken care of before doing so.
I have read on other threads that there are two things we can do to resolve this.  The most often recommended is to forcibly demote the DCs using dcpromo /forceremoval and then cleanup the metadata.
As both the domain controllers are tombstoned, I'm not sure I should demote them both.
The other option is to run repadmin /removelingeringobjects on all the DCs (with the correct parameters including servername and serverGUID) and then force replication by modifying the "Allow Replication With Divergent and Corrupt Partner" reg key in "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" to 1.  After replication I would set it back.
I believe the second option would be best in my case due to both child DCs having been tombstoned and just want to get verification that it is the best option.
Thanks for all comments and answers.
Question by:Edmondadm
LVL 11

Accepted Solution

Abhay Pujari earned 250 total points
ID: 24315610
I think you are right, 2nd options suits you. But my point is if you do not need Child DCs then go for option 1. This is upto you how do you want to get this done.

Author Closing Comment

ID: 31578475
As the child domain was a must for security reasons, I went for option 2 with a slight modification.  Since the child domain is a small domain and there were very few changes made to it, I just forced replication without removing lingering objects.  The reason for this was that I wasn't sure if anything was added to the child domain (new users, etc), but only one user had been deleted that still showed in the parent domain.  Forcing replication may have added that user back, but ensured I kept any changes that were made to the child domain that the parent domain wasn't aware of.  I'm not entirely sure that is how it works, but didn't want to take a chance.  All is working now.  Thanks.

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
DNS Settings for Domain controllers 22 109
Create a managed service account 2 33
no GUI domain controller 2 38
Bind Mac To Azure AD 1 16
Synchronize a new Active Directory domain with an existing Office 365 tenant
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now