We are receiving Event id 1084 and 2084 in our FSMO holder DC's (All roles in same Server) in all domains.
Issue is always with objects in "CN=Deleted Objects" As per the below article this may be due to the lingering objects in AD.
Moreover i could not find any Event ID related to AD database corruption.
I remember strict replication is always enabled by default in Win2k3 DC's.. How about Win2k8 R2 DC's? We are in Win2k8 R2 environment and I could not find the below registry entry in our DC's. What does this mean ? I mean which replication is
enabled, Strict replication or Loose replication ?
If strict replication is not enabled, how can i view the lingering objects in our DC's?
- Registry Key: HKLMSystemCurrentControlSetSer
vicesNTDSParameters - Registry Name: Strict Replication Consistency
- Registry Type: REG_DWORD
PS:- If this is not due to the lingering objects is there anything else do i need to check to find the root cause.
----------------------------------------------------------------------------------------------------------------
Event ID: 1084
Internal event: Active Directory Domain Services could not update the following object with changes received from the following source directory service. This is because an error occurred during the application of the changes to Active Directory
Domain Services on the directory service.
Object:
DC=SARM0308\0ADEL:147bd9b7-8d97-4b8c-ad5e-8226494da45d,CN=Deleted Objects ,DC=XXX,DC=XXX,DC=com
Object GUID:
147bd9b7-8d97-4b8c-ad5e-8226494da45d
Source directory service:
8f1a2edc-1fde-465e-ba12-f637d89bfcfe._msdcs.XXX.com
Synchronization of the directory service with the source directory service is blocked until this update problem is corrected.
This operation will be tried again at the next scheduled replication.
User Action
Restart the local computer if this condition appears to be related to low system resources (for example, low physical or virtual memory).
Additional Data
Error value:
8206 The directory service is busy.
----------------------------------------------------------------------------------------------------------------
Event ID 2108
This event contains REPAIR PROCEDURES for the 1084 event which has previously been logged. This message indicates a specific issue with the consistency of the Active Directory Domain Services database on this replication destination. A database
error occurred while applying replicated changes to the following object. The database had unexpected contents, preventing the change from being made.
Object:
DC=SARM0308\0ADEL:147bd9b7-8d97-4b8c-ad5e-8226494da45d,CN=Deleted Objects,DC=XXX,DC=XXX,DC=com
Object GUID:
147bd9b7-8d97-4b8c-ad5e-8226494da45d
Source domain controller:
8f1a2edc-1fde-465e-ba12-f637d89bfcfe._msdcs.ad.flextronics.com
User Action
Please consult KB article 837932, http://support.microsoft.com/?id=837932 . A subset of its repair procedures are listed here.
1. Confirm that sufficient free disk space resides on the volumes hosting the Active Directory Domain Services database then retry the operation. Confirm that the physical drives hosting the NTDS.DIT and log files do not reside on
drives where NTFS compression is enabled. Also check for anti-virus software accessing these volumes.
2. It may be of benefit to force the Security Descriptor Propagator to rebuild the object container ancestry in the database. This may be done by following the instructions in KB article 251343, http://support.microsoft.com/?id=251343 .
3. The problem may be related to the object's parent on this domain controller. On the source domain controller, move the object to have a different parent.
4. If this machine is a global catalog and the error occurs in one of the read-only partitions, you should demote the machine as a global catalog using the Global Catalog checkbox in the Sites & Services user interface.
If the error is occurring in an application partition, you can stop the application partition from being hosted on this replica. This may be changed using the ntdsutil.exe command.
5. Obtain the most recent ntdsutil.exe by installing the latest service pack for your operating system. Prior to booting into Directory Services Restore Mode (DSRM), verify that the DSRM password is known. Otherwise reset it prior
to restarting the system.
6. In DSRM, run the NT CMD prompt, run "ntdsutil files integrity". If corruption is found and other replicas exist, then demote replica and check your hardware. If no replicas are present, restore a system state backup and
repeat this verification.
7. Perform an offline defragmentation using the "ntdsutil files compact" function.
8. The "ntdsutil semantic database analysis" should also be performed. If errors are found, they may be corrected using the "go fixup" function. Note that this should not be confused with the database maintenance
function called "ESE repair", which should not be used, since it causes data loss for Active Directory Domain Services Databases.
If none of these actions succeed and the replication error continues, you should demote this domain controller and promote it again.
Additional Data
Primary Error value:
8206 The directory service is busy.
Secondary Error value:
0 The operation completed successfully.
Regards, Nidhin.CK