NTDS Rplication Event 1864
Hi,
We are running an Active Directory Domain with 7 DCs. From couple of days due to some unknown reason I keep getting NTDS Replication 1864 events. When we ran REPADMIN command, I found the following:
Quote:
b056d440-a755-488c-a013-244f994abd60 @ USN 16573 @ Time 2006-06-02
18:43:43
93c84682-3247-4b59-a733-981ba5e97ef5 @ USN 13051 @ Time 2006-06-02
20:21:06
corp\LostAndFoundConfig @ USN 12394 @ Time 2006-06-02
20:48:32
Oakdale\HAUPDC01 @ USN 1586733 @ Time 2007-01-17
13:56:46
Oakdale\ERODC01 @ USN 913426 @ Time 2007-01-17
13:59:13
Oakdale\GRDC01 @ USN 3362295 @ Time 2007-01-17
14:49:21
Oakdale\PCDC01 @ USN 1428596 @ Time 2007-01-17
14:54:04
Oakdale\IT_PS @ USN 1538576 @ Time 2007-01-17
14:58:40
Oakdale\CRODC01 @ USN 5598983 @ Time 2007-01-17
14:58:40
Oakdale\OAKDC02 @ USN 1681252 @ Time 2007-01-17
15:39:37
I tried searching some solution for this on Google as well as on Technet but dint found anything working . So can anyone of you please help me out of this?
RE: NTDS Rplication Event 1864
I’m sure that your first two entries are not creating the problem because they are gone since long ago from AD. So you don’t need to do anything for them. The only culprit entry I can see there is the following one:
Quote:
corp\LostAndFoundConfig @ USN 12394 @ Time 2006-06-02
20:48:32
As it is showing up as a reference to lost and found container in output of /showvector. I haven’t seen this before. I think your NTDS settings object are in lost and found container under configuration partition. Also your repadmin is analyzing the parent of that object as lostandfounfconfig rather than original parent which was the servername. What you can do is use adsiedit and open the configuration container and expand the 'lostandfoundconfig' container. Once done, you will find an NTDS settings object from the long since departed DC. In case you want to know what DC this used to be for, then look at the lastknownparent attribute.
Hope it helps.
RE: NTDS Rplication Event 1864
Thanks for the help friend. As you suggested i checked the container and found the object. I saw the lastknown attribute was not set hence i deleted the same. However i'm not able to dint out what exactly is kicking off the replication that causes those errors. I think they occur somewhere at midnight hence i'll check them later.
As far as other 2 entries are concerned i would like to know whether they will coincide with server's 2 deleted entries which is showing up in repmon? If yes, then how can delete them as well?
RE: NTDS Rplication Event 1864
Hey the problem exists still in the event log. I can still see Event ID 1864. Also when i checked the repadmin /showve, again those 3 entries are visible.
Any other ideas or suggestions? What to do now?
RE: NTDS Rplication Event 1864
you can force repl by running
repadmin /syncall /A /e /P
RE: NTDS Rplication Event 1864
Glenn,
Thanks for your help. It is/was greatly appreciated.
Dennis
