Tombstone lifetime. HELP!!!!!

[kabutomz]

We have a child domain in a remote site. Router was filtering tcp port 135 so no more replication over there for a while (more than 60 days). now child domain is outdated. i've tried replicate changes using Sistes & Services and replmon but it doesn't work.

Several event erros at Directory Services : 1925, 1926, 2042

How can i force replication from updated domains?

 

[mlichstein]

2003 won't let you. There may be a registry key that will force it, but you don't want to do that.

Basically that child domain is hosed. You basically have two options. Ignore it, and keep going with no replication, which essentially isloates the child domain; or rebuild the child domain.

 

[kabutomz]

I was wondering about set Strict Replication Consistency key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters to 0

 

[LordMarshal]

Kabutomz,

too late for that with a 60 day gap in replication. Once you get past 30, replication is totally out of date. You do have an option though, provided your intact schema and forest master systems still know about the child domain?

If so, you can bring up a new domain controller for the child domain (any temp box will do - if ther are already other DC's for the child domain, skip this step!), and then dcpromo down and then back up the box in question. Once it has replicated the domain info from the temp domain controller or other ad servers, you can remove the temp domain controller, and run on the rebuilt one.

Have you run an NTDSUTIL on your TLD to see if it knows who controls the FISMO roles for the Child domain? It it does, you may be able to seize them and perform the steps above...

Not elegant, but it does work, having done it before on many occasions...

Hope it helps,
LM

 

[mlichstein]

That won't work.

If you really want to do this, you can set the following registry key to 1:

HKLM\System\CurrentControlSet\Services\NTDS\Parameters
Allow Replication With Divergent and Corrupt Partner

Make sure you have the spaces, and don't use quotes.

Then force replication, and pray you don't get any lingering objects. You should also return the registry key to 0 as soon as possible after forcing replication

 

[mlichstein]

By the way, I am not reponsible for this making a complete mess out of your entire forest.

Enjoy...

 

[mlichstein]

I forgot to mention, you enable that key on another DC (most likely in the parent domain) that replicates with a DC in the orphaned child domain.