Windows 2012 and Windows 2003 domain controllers not replicating after restore

Steve Bantz
Steve Bantz used Ask the Experts™
I had a situation where I had to restore a Windows Server 2012 Domain Controller from backup that was a month old.  There is another Windows Server 2003 domain controller.  Yes, I know, but I am still decommissioning it.  When the Windows 2012 DC came back online, it will no longer replicate with the 2003 server.  For example, I am getting all kinds of errors that I have posted in the dcdiag attached.  The computer databases are inconsistent (contents of Computers is different on the domain controllers) and I have trouble with workstations not having a trust relationship (Windows 7).

How can this be corrected?  I know it is because one DC is a month older than the online one, but why won't they exchange info now?

Results of dcdiag.  Server is Windows 2012 and Server1 is Windows 2003 are attached:
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018

Bringing up old DC's is never a good idea. If you aren't making backups more often, do so.  As long as your 2003 DC is healthy, I'd go in, delete all references to the failed DC, clean up the metadata, and then install 2012 again and make it a new DC. It'll replicate fresh (the 2003 is up to date after all, if it is healthy) and you end up with a good DC without the month-old backup problem.  If the 2012 DC was servicing other roles, restore them separately. A file server, for example, can simply restore the files without restoring the system state and AD.

As things are, your 2003 hold a later version of the AD objects, so they will not replicate over the older data on the 2008 box.

You will need to perform an "authoritative restore" one the 2008 box. This is  a process that increments the serial number on each AD object, making the old, restored data "newer".

Here is some guidance:
Senior Solution Architect
Most Valuable Expert 2015
Top Expert 2015
Is the 2003 DC holding the FSMO roles or was it the failed 2012 DC? If the 2012 DC was NOT olding the roles then the proper way to restore would be to do a NON-Authoritative restore which will then allow all of the changes from the 2003 DC to be replicated to the 2012 DC.

However based on the DCDiag results, it appears that you have a USN issue. In this case it is best to decomm the 2012 DC using the force removal from Server Manager.

See iSiek's blog good read.

Also once that is completed, make sure that you check your AD replication. Using the following commands...

repadmin /replsum
repadmin /showrepl
repadmin /bridgeheads
DCDiag /v

Delete the computer account for the 2012 DC from the domain controllers OU, if it has not been removed already.

Then run the following command
netdom query dc

If the 2012 DC is still showing after running the above command then perform the meta data cleanup.

Next, open DNS management console
- expand
- look through all of the records and make sure that there are no SRV records that reference the 2012 DC
- Open AD Sites and Services and make sure that there are no Computer objects that reference 2012 DC

Once you have validated all of the above promote the 2012 DC back into the environment.

Steve BantzIT Manager


Well, I really am not sure how this happened but after a bit both domain controllers were in synch.  I ran dcdiag and it came back clean with no errors.  I also noticed something in the event viewer directory service category stating that everything has been cleaned up and the domain controllers are replicating successfully.  I didn't do anything at all.  I changed descriptions for Computer objects on both servers and they immediately were replicated.  I also disabled a user account and it showed that way on the other DC. This is a very small environment with a Windows 2012 DC and a Windows 2003 DC with 7 workstations.  Everything seems to be working fine and I am not sure why now.  It is extremely rare that Windows works something out on its own, which is why I was surprised to see that message in the event log.  I have been monitoring the event viewer and it seems like everything is normal.  I am not sure what to think but it is good to know how I should have done it thanks to you guys.  Maybe I just got lucky this time.  I can't wait to decommission the 2003 DC and demote it just to not have to worry as much.
Will SzymkowskiSenior Solution Architect
Most Valuable Expert 2015
Top Expert 2015

I also disabled a user account and it showed that way on the other DC.

Simply creating an account and watching it replicate to another DC does mean that "some" directory partitions are replicating. However, there are other directory partitions that need to replicate as well to ensure that ALL directory partitions are successful in replicating.

Use the commands above, i have provided will help with this.


Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial