Tracking a deleted Active Directory object's replication status

Learn how to track a deleted Active Directory object's replication status and how to determine if the object has been replicated throughout the DC forest.

There are many times when a Windows admin needs to determine when a change -- such as the creation, modification or deletion of an object -- has been replicated throughout the forest. For instance, if you demote a DC or a GC either manually or via DCPromo, you must wait until the deleted server object has replicated to all domain controllers before you re-promote using the same name.

The problem comes if you want to demote the existing DC and re-promote it with the same name and IP address on a different physical computer. When you re-promote the DC or want to promote another machine with the same name and IP address, it will create a new computer account with a new GUID. If you do the new promotion before the first object deletion has replicated to all DCs in the forest, it will cause a great deal of confusion about the status of this object. Some domain controllers will know that the old object is deleted and the new one is now in existence. Some will see the old one but not the new one, and some will see both as valid objects.

More on Active Directory Replication

  • Bad external time source stops Active Directory replication
  • Unwinding USN rollback when faced with AD replication failure

This is because of Active Directory replication latency. I have seen cases where adequate time was not allowed before the promotion of the new DC with the same name, and they usually eventually converge and are happy. However, I would recommend waiting long enough for the change to be replicated thru the forest before promoting a new DC with the same name.

The tricky part of this operation is to determine when all the DCs have replicated the deletion. Usually you can just wait overnight to be sure, but there is an easy way to find out using the Repadmin command. Repadmin.exe is part of the Windows Support tools for Windows 2003 Service Pack 1. These support tools are not installed automatically by installing SP1. If you have a CD for SP1, they will be on the CD. Or you can download them. Also refer to KB 892777. If you have a Windows 2000 environment, then you can install the support tools on a Windows 2003 Server or XP workstation and execute the command.

The general command using the /ShowObjMeta is:

Repadmin /showObjMeta <DC name > < "DN of computer object">

In the following example, the DC HPQNET-DC3 has been demoted and removed. It's Distinguished Name, or DN, is DC=hpqnet-DC3,DC=hpqnet,DC-cpqcorp, DC=net.

The command:

C:\>repadmin /showobjmeta hpqnet-dc3 "CN=HPQnet-DC3,OU=Domain Controllers OU, DC=hpqnet,DC=qtest,DC=cpqcorp,DC=net"

Executing the Repadmin command above returned the following table:


Loc.USN Originating DC Org.USN Org.Time/Date Ver Attribute
======= =============== ====== ============= === ========
72830 Dublin\HPQBOX-DC02 68360 2005-07-26 16:28:52 1 objectClass
72878 Roseville\HPQBOX-DC01 72878 2005-07-26 16:31:10 2 cn
72884 Roseville\HPQBOX-DC01 72884 2005-07-26 16:32:01 2 description
624242 Roseville\HPQBOX-DC01 624242 2005-11-03 02:11:42 1 userCertificate
72830 Dublin\HPQBOX-DC02 68360 2005-07-26 16:28:52 1 instanceType
72830 Dublin\HPQBOX-DC02 68360 2005-07-26 16:28:52 1 whenCreated
73146 Alpharetta\HPQBOX-DC03 12290 2005-07-26 17:32:54 2 nTSecurityDescriptor
72878 Dublin\HPQBOX-DC02 68395 2005-07-26 16:30:57 2 name

This command dumps the values of all object attributes if it finds the object. If it doesn't find the object, it will return an error:

DsReplicaGetInfo() failed with status 8333 (0x208d): Directory object not found.

There is one final option that will allow admins to execute this command on all DCs with one command -- without having to execute it on each DC individually. Using the * in the DCLIST option executes the command on all DCs – one at a time – and reports if it finds the object. If it returns an error, then the computer object is not in the DC OU because that was the path we are searching for. When all DCs report the error, then we know all of them have moved the old DC computer object into the Deleted Objects folder and it is safe to promote the new computer using the name and IP of the old one.

The command in our example to execute on all DCs would be

C:\>repadmin /showobjmeta *"cn=hpqbox-dc03,ou=domain controllers,dc=hpqbox,dc=a dapps,dc=hp,dc=com" >objmeta.txt

Here, we have redirected the output to a text file, Objmeta.txt.

Again, if any of the DCs in the report return attributes for the object, then the deletion has not replicated there yet. If there is an error for each DC in the list, then AD object replication has completed and the new machine can be promoted.

Gary Olsen, contributorGary Olsen is a systems software engineer for Hewlett-Packard in Global Solutions Engineering. He wrote Windows 2000: Active Directory Design and Deployment and co-authored Windows Server 2003 on HP ProLiant Servers. Olsen is a Microsoft MVP for Directory Services and formerly for Windows File Systems.

Dig Deeper on IT operations and infrastructure management

Cloud Computing
Enterprise Desktop
Virtual Desktop