Find a tombstone in a large forest

Question

I need some guidance in finding a tombstone in a forest that has 90 domain controllers and 79 sites. Each domain controller is receiving three daily EventID 1864 alerts. One for the domain partition, one for the configuration partition and one
for the schema partition. I have checked the replication between all domain controllers using repldiag /CheckForStableReplTopology and it returned No topology errors found.
I created a PS script to go out to the forest and search all DC's for EventID 2042 and it returned nothing. Due to the size of the infrastructure and the fact that they set their tombstone lifetime to 400 days, running any type of query where I can pull
GUID's and check DNS, returns literally thousands of entries in the output. I currently have a support case with Microsoft that has been open for nearly two weeks now but we have not found a resolution that wouldn't take countless man hours. I came into
this situation recently and was told that this tombstone has been out there for around 4 years. The reason this has come up again is because the client is looking to raise the functional level of their forest from 2003 to 2008. I am doing this for a client,
so everything is done remotely, and sometimes very slowly due to the fact that these domain controllers are located all over the world, and sometimes in places that have very bad connectivity.
A few quick questions:
Will they/we be able to raise the functional level of the forest with the tombstone there?
If we can, will this have any impact in the long run, or will it just remain a tombstone until it is found?
If we can't, is there a workaround to get the functional level raised while the tombstone is still there?
Is there any quick way to find either the name, IP address or even the GUID of the device that is causing these EventID's?
Any assistance would be greatly appreciated as I've tried everything I could possibly think of and have been researching and trying different tools for over two weeks now.

Answer 1

If strict replication consistency on domain controller is not enabled, lingering objects can be replicated to domain controller.
AD DS: Strict replication consistency should be enabled on all domain controllers in this forest
http://technet.microsoft.com/en-us/library/dd723692(v=ws.10).aspx
Strict Replication Consistency - Myth versus Reality
http://blogs.technet.com/b/askds/archive/2010/02/15/strict-replication-consistency-myth-versus-reality.aspx
http://technet.microsoft.com/en-us/library/cc816938(v=ws.10).aspx
If the server has reached tombstone lifecycle period the best way to deal with is demote/promote the DC.You cannot demote the faulty DC gracefully you need to do forcefull removal.You need to ran dcpromo/force removal and then run matadata cleanup on other
DC(healthy) to remove the instance of faulty DC from AD database and DNS.If faulty DC is fsmo role holder server the you need to seize the FSMO role on other DC.Once done you can promote the Server back as DC.
Sometimes its difficult to remove lingering object either using repadmin /removelingeringobjects or other tool. If lingering objects spreads then its more difficult to tackle them, demoting & promoting the server containg the lingering is best bet.
Complete Step by Step Guideline to Remove an Orphaned Domain controller (including seizing FSMOs, running a metadata cleanup, and more)
http://msmvps.com/blogs/acefekay/archive/2010/10/05/complete-step-by-step-to-remove-an-orphaned-domain-controller.aspxis
To remove lingering object see this:http://blogs.technet.com/b/glennl/archive/2007/07/26/clean-that-active-directory-forest-of-lingering-objects.aspx
Hope helps
Best Regards,
Sandesh Dubey.
MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator |
My Blog
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.