Solved

Active Directory - Error 8614 - Do all DC's need to replicate

Posted on 2016-10-11
5
97 Views
Last Modified: 2016-10-27
We have a domain with 10 sites.
We have noticed after running a "repadmin /replsummary" that not all of our DC's are communicating and that we are getting a

 "(8614) The directory service cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime."

We are not experiencing issues with replication but we think that at least one of the DC's should be able to replicate with all of the DC's.

Is this fine to leave this as everything is working or should we look at resolving this problem?
0
Comment
Question by:Pmb2000
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 5

Expert Comment

by:Deepin
ID: 41838308
How many are not syncing?

you are going to have to kill those DC's and then clean the rest of your AD.....and then rebuild them and bring them back in...
1
 

Author Comment

by:Pmb2000
ID: 41838354
Half of them are giving the error - (8614) The directory service cannot replicate with this server because the time since the last replication with this server has exceeded the tombstone lifetime.

But we are having no issues with AD objects being replicated.

What is the best method for the cleaning up of the AD?

Are we best to demote and then bring them back on. or what would you suggest?
0
 
LVL 5

Assisted Solution

by:Deepin
Deepin earned 250 total points
ID: 41838411
1
 
LVL 6

Accepted Solution

by:
Niten Kumar earned 250 total points
ID: 41839277
Best would be to demote the non-replicating DC's one at a time.  Demote one, rebuild and promote.  Make sure sites and inter-site links are defined properly.  Test the replication using:

1.   repadmin /replsum
2.   repadmin /showrepl

If all is good then do the same with problematic dc's in other sites.

If in case demotion fails then metadata cleanup will be required which will be best cleaned up through the command line utility ntdsutil.

For help you check out this video which thoroughly explains its usage.  You will find the metadata cleanup part at the second half of the video.

https://www.youtube.com/watch?v=DzJTCYtp7XI
1
 

Author Closing Comment

by:Pmb2000
ID: 41862018
Great Guys.

Thanks!!
0

Featured Post

Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question