Hello everybody,
we have a problem with the AD. In the past we upgraded some of our DC's from server 2012 to server 2016. We have a forest - not yet all subdomains are upgraded.
As recommended by Microsoft we did not an inplace upgrade. We did a demote,unjoin and after a new installation with
same hostname and IP we joined and promoted it.
Since a longer time we get Event ID 1864 on these DCs:
This is the replication status for the following directory partition on this directory server. Directory partition: DC=domain,DC=local This directory server has not recently received replication information from a number of directory servers. The count of directory servers is shown, divided into the following intervals. More than 24 hours: 1 More than a week: 1 More than one month: 1 More than two months: 1 More than a tombstone lifetime: 0 Tombstone lifetime (days): 180 Directory servers that do not replicate in a timely manner may encounter errors. They may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled. To identify the directory servers by name, use the dcdiag.exe tool. You can also use the support tool repadmin.exe to display the replication latencies of the directory servers. The command is "repadmin /showvector /latency <partition-dn>".
A repadmin /showvector /latency dc=domain,dc=local shows the following:
Caching GUIDs. .. Site1\ROOT-DC2 (deleted DSA) @ USN 31227390 @ Time 2018-03-15 10:17:20 Site1\ROOT-DC1\0ADEL:b738d30e-8a3a-4175-ab4f-27bb0652857e (deleted DSA) @ USN 41123970 @ Time 2018-03-20 13:13:06 Site1\SUB1-DC2 (deleted DSA) @ USN 53882505 @ Time 2018-03-20 15:50:21 Site1\SUB1-DC1 (deleted DSA) @ USN 59794124 @ Time 2018-03-22 10:03:16 Site2\SUB2-DC2 (deleted DSA) @ USN 12111634 @ Time 2018-04-12 12:49:55 Site2\SUB2-DC1 (deleted DSA) @ USN 202422306 @ Time 2018-04-12 15:47:08 Site1\SUB3-DC1 @ USN 15696469 @ Time 2018-08-13 13:57:02 Site2\SUB2-DC1 @ USN 653303 @ Time 2018-08-13 14:02:41 Site3\SUB3-DC2 @ USN 10636306 @ Time 2018-08-13 14:03:47 Site2\SUB2-DC2 @ USN 1012325 @ Time 2018-08-13 14:05:55 Site5\SUB6-DC3 @ USN 9335718 @ Time 2018-08-13 14:07:02 Site6\SUB4-DC2 @ USN 2745623 @ Time 2018-08-13 14:12:03 Site4\SUB5-DC2 @ USN 130326526 @ Time 2018-08-13 14:12:30 Site1\ROOT-DC1 @ USN 1623323 @ Time 2018-08-13 14:23:55 Site1\SUB4-DC1 @ USN 25724705 @ Time 2018-08-13 14:24:10 Site1\SUB8-DC1 @ USN 6287872 @ Time 2018-08-13 14:24:16 Site1\SUB1-DC2 @ USN 43936554 @ Time 2018-08-13 14:47:56 Site1\ROOT-DC2 @ USN 2334008 @ Time 2018-08-13 14:48:48 Site1\SUB5-DC1 @ USN 25602431 @ Time 2018-08-13 14:49:02 Site1\SUB7-DC1 @ USN 4156821 @ Time 2018-08-13 14:49:02 Site1\SUB1-DC1 @ USN 3773274 @ Time 2018-08-13 15:39:50
We deleted these old objects in the trash. But we still see here (above) these entries like "Site1\ROOT-DC2 (deleted DSA)".
A metadata cleanup did not help.
Is there any way to get rid off these "deleted DSA" entries and so also from Event ID 1864?
Thanks for your ideas!
Wolfgang