Mark Minasi's Reader Forum
Mark Minasi's Reader Forum
Home | Profile | Register | Active Topics | Active Polls | Members | Search | FAQ | Minasi Forum RSS Feed
Username:
Password:
Save Password
Forgot your Password?

 All Forums
 HALP! Questions on Windows and Windows Server
 Active Directory
 Cannot demote server
 New Topic  Reply to Topic
 Printer Friendly
Author Previous Topic Topic Next Topic  

virtualtechie
Welcome Newcomer

3 Posts
Status: offline

Posted - 06/13/2012 :  8:05:38 PM  Show Profile  Reply with Quote
When I attempt to demote the a server called AUTH, I get the following error:

The operation failed because:

Active Directory could not transfer the remaining data in directory partition DC=COMPANY,DC=COM to domain controller DC1.COMPANY.COM

"Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected."

Investigating the event logs on DC1 report the following:


Active Directory Domain Services Replication encountered the existence of objects in the following partition that have been deleted from the local domain controllers (DCs) Active Directory Domain Services database.  Not all direct or transitive replication partners replicated in the deletion before the tombstone lifetime number of days passed.  Objects that have been deleted and garbage collected from an Active Directory Domain Services partition but still exist in the writable partitions of other DCs in the same domain, or read-only partitions of global catalog servers in other domains in the forest are known as "lingering objects". 
 
Source domain controller: 
35e39ab5-0739-4bdd-a0b8-913414917ab3._msdcs.COMPANY.COM 
Object: 
CN=ACCTS01-Auto HP Color LaserJet 2600n on DONNA-PC (from VALUE\0ADEL:aeaf6e4e-6085-47bb-bd53-138212827607,CN=Deleted Objects,DC=COMPANY,DC=COM
Object GUID: 
aeaf6e4e-6085-47bb-bd53-138212827607  This event is being logged because the source DC contains a lingering object which does not exist on the local DCs Active Directory Domain Services database.  This replication attempt has been blocked.

The best solution to this problem is to identify and remove all lingering objects in the forest.

User Action:
Remove Lingering Objects:
The action plan to recover from this error can be found at http://support.microsoft.com/?id=314282.

 If both the source and destination DCs are Windows Server 2003 DCs, then install the support tools included on the installation CD.  To see which objects would be deleted without actually performing the deletion run "repadmin /removelingeringobjects <Source DC> <Destination DC DSA GUID> <NC> /ADVISORY_MODE". The eventlogs on the source DC will enumerate all lingering objects.  To remove lingering objects from a source domain controller run "repadmin /removelingeringobjects <Source DC> <Destination DC DSA GUID> <NC>".

 If either source or destination DC is a Windows 2000 Server DC, then more information on how to remove lingering objects on the source DC can be found at http://support.microsoft.com/?id=314282 or from your Microsoft support personnel.

 If you need Active Directory Domain Services replication to function immediately at all costs and don't have time to remove lingering objects, enable loose replication consistency by unsetting the following registry key:

Registry Key:
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Strict Replication Consistency

 Replication errors between DCs sharing a common partition can prevent user and compter acounts, trust relationships, their passwords, security groups, security group memberships and other Active Directory Domain Services configuration data to vary between DCs, affecting the ability to log on, find objects of interest and perform other critical operations. These inconsistencies are resolved once replication errors are resolved.  DCs that fail to inbound replicate deleted objects within tombstone lifetime number of days will remain inconsistent until lingering objects are manually removed by an administrator from each local DC.

 Lingering objects may be prevented by ensuring that all domain controllers in the forest are running Active Directory Domain Services, are connected by a spanning tree connection topology and perform inbound replication before Tombstone Live number of days pass.”

The source domain controller is AUTH referenced by the GUID of 35e39ab5-0739-4bdd-a0b8-913414917ab3._msdcs.COMPANY.COM. I have ran the command repadmin /removelingering objects and it ran successfully – however 0 objects were deleted.

Active Directory Domain Services has completed the removal of lingering objects on the local domain controller. All objects on this domain controller have had their existence verified on the following source domain controller. 
 
Source domain controller: 
364409ae-2436-4115-b870-1dc7eff203cf._msdcs.COMPANY.COM
Number of objects deleted: 
0 

Next I can try forcing a demote by running dcpromo /forceremoval which will demote the DC to a member server but will not notify DC1 that it has been demoted. I have already transferred the FSMO roles to DC1. What do you think guys? Thanks in advance

Edited by - virtualtechie on 06/13/2012 8:06:59 PM

Pieter
Old Timer

Belgium
526 Posts
Status: offline

Posted - 06/14/2012 :  02:14:56 AM  Show Profile  Reply with Quote
I suggest you do the 'dcpromo /forceremoval ' on the bad DC or shut it down and never connect it again to your domain.

On DC1 (the good one) do a forcefully demote. On a Win2008R2 it is fairly easy to do. Search for "metadata cleanup active directory". For Win2003 look at http://support.microsoft.com/kb/216498/en-us


Pieter Demeulemeester
Go to Top of Page

virtualtechie
Welcome Newcomer

3 Posts
Status: offline

Posted - 06/15/2012 :  12:12:24 AM  Show Profile  Reply with Quote
the BAD DC is also a DNS server and a FILE SERVER

I believe the DNS has been switched over the new good DC

Why should I demote the good DC?
Go to Top of Page

Pieter
Old Timer

Belgium
526 Posts
Status: offline

Posted - 06/15/2012 :  02:17:31 AM  Show Profile  Reply with Quote
>>the BAD DC is also a DNS server and a FILE SERVER
I see. Do a 'dcpromo /forceremoval ' on the BAD DC, keep it as a member server.
If DNS is AD-integrated it will be removed from that DC.

>>Why should I demote the good DC?
My mistake. I meant: do a forcefully remove of the BAD DC.

If all is well, you can repromote the bad DC afterwards.


Pieter Demeulemeester
Go to Top of Page

virtualtechie
Welcome Newcomer

3 Posts
Status: offline

Posted - 06/15/2012 :  10:10:08 PM  Show Profile  Reply with Quote
We need the DNS but already replicated it to the secondary DC when we dcpromo the secondary DC...so it is ok to proceed? The secondary DC is also a global catalog server
Go to Top of Page

Pieter
Old Timer

Belgium
526 Posts
Status: offline

Posted - 06/18/2012 :  04:53:01 AM  Show Profile  Reply with Quote
If the DNS is Active Directory integrated (and I advise you to set it that way), you can proceed with the DC demote. DNS will be uninstalled from that DC.

If in doubt:
  • Start DNS console (dnsmgmt.msc)

  • Properties of servername

  • tab |Advanced|

  • Load zone date on startup should be From Active Directory and registry


If DNS not AD integrated, be sure that the remaining DC is the primary DNS server.


Pieter Demeulemeester
Go to Top of Page
  Previous Topic Topic Next Topic  
 New Topic  Reply to Topic
 Printer Friendly
Jump To:
Mark Minasi's Reader Forum © 2002-2011 Mark Minasi Go To Top Of Page
This page was generated in 0.17 seconds. Snitz Forums 2000