Article ID: 314282 - View products that this article applies to.
This article was previously published under Q314282
NoticeThis article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy
After you bring back online a domain controller or global catalog server that has been offline for a long time, any of the following problems may occur:
A domain controller (which may also be a global catalog server) that was offline for longer than the value of the Tombstone Lifetime setting (the default value is 60 days) may contain objects that have been deleted on other domain controllers or global catalog servers. Additionally, tombstones for these objects may no longer exist. When you bring the outdated domain controller back online, it cannot be notified of the object deletions. If any of the objects are modified, they are reactivated in the rest of the domain.
For lingering objects that replicate into read/write naming contexts, the standard behavior (Loose Replication Consistency) is for the receiving domain controller to re-create the objects that are not already present in the local database (DIT). These objects are then replicated back to the originating domain controller, effectively re-creating the deleted objects. If the object should not exist in Active Directory at all (for example, if the object was reintroduced by an outdated domain controller), you can delete the objects with the standard tools (such as ADSIEdit or the Active Directory Users and Computers snap-in).
It is easy to remove lingering objects for read/write naming contexts. This article describes how to remove lingering objects that have already appeared in global catalog (and therefore read-only) naming contexts. For more information about tombstone issues, click the following article number to view the article in the Microsoft Knowledge Base:
216993For more information about lingering objects in read/write copies of naming contexts, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/216993/ )Useful shelf life of a system-state backup of Active Directory
(http://support.microsoft.com/kb/317097/ )Lingering objects prevent Active Directory replication from occurring
Service pack informationTo resolve this problem, obtain the latest service pack for Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/260910/ )How to obtain the latest Windows 2000 service pack
Hotfix informationNote Before you install this hotfix, read the entire "More Information" section in this article. The "More Information" section contains important information about how to install and use this hotfix.
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Note This hotfix has been replaced by a rollup fix. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
Date Time Version Size File name ------------------------------------------------------------ 16-Jan-2002 22:07 5.0.2195.4685 123,664 Adsldp.dll 16-Jan-2002 22:07 5.0.2195.4762 130,320 Adsldpc.dll 16-Jan-2002 22:07 5.0.2195.4016 62,736 Adsmsext.dll 16-Jan-2002 22:07 5.0.2195.4797 356,112 Advapi32.dll 16-Jan-2002 22:07 5.0.2195.4797 41,744 Basesrv.dll 11-Dec-2001 03:33 5.0.2195.4571 82,704 Cmnquery.dll 16-Jan-2002 22:07 5.0.2195.4141 133,904 Dnsapi.dll 16-Jan-2002 22:07 5.0.2195.4379 91,408 Dnsrslvr.dll 11-Dec-2001 03:33 5.0.2195.4534 41,744 Dsfolder.dll 11-Dec-2001 03:33 5.0.2195.4534 156,944 Dsquery.dll 11-Dec-2001 03:33 5.0.2195.4574 110,352 Dsuiext.dll 16-Jan-2002 22:16 5.0.2195.4814 521,488 Instlsa5.dll 16-Jan-2002 22:07 5.0.2195.4630 145,680 Kdcsvc.dll 27-Nov-2001 01:33 5.0.2195.4680 199,440 Kerberos.dll 16-Jan-2002 22:07 5.0.2195.4829 708,880 Kernel32.dll 04-Sep-2001 17:32 5.0.2195.4276 71,024 Ksecdd.sys 09-Jan-2002 19:50 5.0.2195.4814 503,568 Lsasrv.dll 09-Jan-2002 19:50 5.0.2195.4814 33,552 Lsass.exe 08-Dec-2001 01:05 5.0.2195.4745 107,280 Msv1_0.dll 16-Jan-2002 22:07 5.0.2195.4594 306,960 Netapi32.dll 16-Jan-2002 22:07 5.0.2195.4686 359,184 Netlogon.dll 16-Jan-2002 22:07 5.0.2195.4797 476,432 Ntdll.dll 16-Jan-2002 22:07 5.0.2195.4827 916,240 Ntdsa.dll 15-Jan-2002 09:34 5.0.2195.4839 1,688,192 Ntkrnlmp.exe 15-Jan-2002 09:36 5.0.2195.4839 1,687,744 Ntkrnlpa.exe 15-Jan-2002 09:36 5.0.2195.4839 1,708,480 Ntkrpamp.exe 15-Jan-2002 09:34 5.0.2195.4839 1,665,856 Ntoskrnl.exe 16-Jan-2002 22:07 5.0.2195.4827 388,368 Samsrv.dll 16-Jan-2002 22:07 5.0.2195.4583 128,784 Scecli.dll 16-Jan-2002 22:07 5.0.2195.4600 299,792 Scesrv.dll 16-Jan-2002 22:07 5.0.2195.4600 48,400 W32time.dll 06-Nov-2001 20:43 5.0.2195.4600 56,592 W32tm.exe 16-Jan-2002 22:07 5.0.2195.4827 125,712 Wldap32.dll
(http://support.microsoft.com/kb/326797/ )Some Windows 2000 Active Directory hotfixes may cause a conflict with S326797 for Windows 2000
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows 2000 Service Pack 3.
This hotfix adds support for removing lingering objects. This procedure requires the objectGUID of a domain controller that has a read/write copy of the object, and the objectGUID of the object itself. If you must remove more than one object, determine whether any of the objects are in a parent/child relationship (you can determine this from the objects' distinguished names). If this is the case, order the deletions so that all of the child objects are deleted before their parent objects.
The best way to identify in which domain an object is located (and from that to determine the name of a domain controller that has a read/write copy of the object) is to establish the distinguished name of the object. You can do this by searching for the name (or parts of the name) of the duplicate user, group, or distribution list by using the Ldp.exe tool from the Support Tools:
Run the repadmin /showreps dc-name command (where dc-name is the name of the domain controller you located). Repadmin.exe is included with the Support Tools. From the output, note the domain controller's objectGuid:
C:\>repadmin /showreps some-DCInstall the hotfix that is described in this article on all of the global catalog servers that have lingering objects. The hotfix is not required on domain controllers that you identify as containing read/write copies of the lingering objects, unless they are also global catalog servers that contain lingering objects. Each global catalog server on which you intend to run the delete operation must have network connectivity to the domain controller that you identified.
DSA Options : (none)
objectGuid : d1fa2207-ae85-466f-88fd-908f1c623ea7
For few objectsIf you have only a few objects and global catalogs, follow these steps to delete the objects by using Ldp.exe:
For many objectsIf you have many objects to delete and many global catalog servers, it may be easier to use the following scripts:
Error message when running Walkservers.cmd to modify many lingering objects in the environment
Object <GUID=ae856ce5-839a-4e44-b2fb-f37082ca2555> : <GUID=514f7510-451a-4297-8129-9b4c8ab79axx> could not be removed. Error number is: -2147016672. Error description is: .
CauseThis error occurs because the script is run against the GUID of a domain controller that does not contain a writeable partition that contains the lingering object. Verify the location of lingering object by the Ldp.exe tool.
ExampleIn the following example, the lingering object that causes the error message to be removed is located in the corp.company.local domain. However, the <GUID=ae856ce5-839a-4e44-b2fb-f37082ca2555> from the objects-list.txt file is associated with a domain controller in the company.local domain that does not have a writeable partition for corp.company.local.
Obtain the GUID of a server in the corp.company.local domain by running the following command:
ldap_search_s(ld, "DC=company,DC=local", 2, "(cn=User*)", attrList, 0, &msg) Result <0>: (null) Matched DNs: Getting 4 entries: >> Dn: CN=User\, Joe,OU=Exec,OU=Corporate Users,DC=corp,DC=company,DC=local 1> canonicalName: corp.company.local/Corporate Users/Exec/User, Joe; 1> cn: User, Joe; 1> description: CEO; 1> displayName: User, Joe; 1> distinguishedName: CN=User\, Joe,OU=Exec,OU=Corporate Users,DC=corp,DC=company,DC=local; 4> objectClass: top; person; organizationalPerson; user; 1> objectGUID: 814226ed-3414-4193-b96d-3a5ea4bf9351; 1> name: User, Joe; >> Dn: CN=User\, Joe,OU=Migration,DC=corp,DC=company,DC=local 1> canonicalName: corp.company.local/Migration/User, Joe; 1> cn: User, Joe; 1> description: Disabled Account; 1> displayName: User, Joe; 1> distinguishedName: CN=User\, Joe,OU=Migration,DC=corp,DC=company,DC=local; 4> objectClass: top; person; organizationalPerson; user; 1> objectGUID: 514f7510-451a-4297-8129-9b4c8ab79axx; 1> name: User, Joe;
repadmin /showreps DC-nameIn this command, DC-name is a placeholder for the name of a domain controller in the corp.company.local domain. Change the GUID in the Objects-list.txt file to match the GUID of the domain controller in the corp.company.local domain. In this example, the Objects-list.txt file will appear as:
The first GUID is the GUID of the domain controller in the corp.company.local domain. The second GUID is the GUID of the lingering object from the Lightweight Directory Access Protocol (LDAP) search.
<GUID=c4fd9c30-b433-40a1-a862-9fdf1f804dc8> : <GUID=514f7510-451a-4297-8129-9b4c8ab79a7c>
When you run Walk-servers.cmd, the command will now complete successfully without the -2147016672 error.
If you cannot resolve the errors in the log files by using these methods, you may be experiencing a different problem. Contact Microsoft Product Support Services for additional assistance.
For more information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the following article number to view the article in the Microsoft Knowledge Base:
265173For more information about how to install multiple hotfixes while restarting only once, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/265173/ )The Datacenter Program and Windows 2000 Datacenter Server product
296861For more information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/296861/ )How to install multiple Windows updates or hotfixes with only one reboot
(http://support.microsoft.com/kb/249149/ )Installing Microsoft Windows 2000 and Windows 2000 hotfixes
Article ID: 314282 - Last Review: March 29, 2007 - Revision: 8.7