Some PCs unable to login to a 2003 domain. One server may have tombstoned?

Hi,

I have three domain controlers all running 2003

Some PCs are able to login without an issue but some cannot.

One DC was offline for over 60 days so I think it has now tombstoned. This DC has no roles and is not hosting any critial applications. I have NTDS replication in the event viewer (one is event ID 2042)

I'm tempted to demote the problematic DC in the short term to get the users back online as soon as possible. Would this sort this issue?

Is it as easy as DCPROMO and follow the wizard or is there anything else I can try? And can I demote a dc via remote desktop?. The DC in question is a virtual server on ESXI.
APC_40Asked:
Who is Participating?
 
SandeshdubeyConnect With a Mentor Senior Server EngineerCommented:
Event ID 2042 indicates server has has not replicated with its partner for longer than a tombstone lifetime.Demote/promote should fix the issue.

You cannot demote the faulty DC gracefully you need to do forcefull removal.You need to ran dcpromo/force removal and then run matadata cleanup on other DC(healthy) to remove the instance of faulty DC from AD database and DNS.If faulty DC is fsmo role holder server the you need to seize the FSMO role on other DC.

Once done you can promote the Server back as ADC.Also configure authorative time server role on PDC role holder server.

Reference link
Forcefull removal of DC: http://support.microsoft.com/kb/332199
Metadata cleanup: http://www.petri.co.il/delete_failed_dcs_from_ad.htm
Seize FSMO role: http://www.petri.co.il/seizing_fsmo_roles.htm
Authorative time server: http://support.microsoft.com/kb/816042
0
 
APC_40Author Commented:
I went straght to metadatacleanupp and did not use the force removal - will this cause issues? The DC appears to be gone though.

I have two DCs  - do I have to run metadatacleanup twice from each DC to cleanup the bad DC?
0
 
SandeshdubeySenior Server EngineerCommented:
You have to run metadata cleanup only once to remove the instances of faulty server the other DC will replicate and remove the instances of faulty server no need to run on all DC.

On the faulty server excute dcpromo/force  to remove the AD.
0
 
APC_40Author Commented:
Excellent answer - thanks
0
All Courses

From novice to tech pro — start learning today.