Replication tombstone lifetime has expired

[N.]

Hope someone can help me.

I have a WIN 2003 DC running AD and another WIN 2003 DC running AD in a
remote office.

The replication in the home office domain has not occurred in some time and
has surpassed the tombstone lifetime (according to the event viewer stop
error below)

I need to get this DC replicating again with the remote domain. I have
looked into the options mentioned below but am not sure the best way to go
about this.

Can anyone provide me with some direction ?

Here is the Event Viewer STOP error I'm receiving:

EVENT ID: 2042

It has been too long since this machine last replicated with the named
source machine. The time between replications with this source has exceeded
the tombstone lifetime. Replication has been stopped with this source.

The reason that replication is not allowed to continue is that the two
machine's views of deleted objects may now be different. The source machine
may still have copies of objects that have been deleted (and garbage
collected) on this machine. If they were allowed to replicate, the source
machine might return objects which have already been deleted.

Time of last successful replication:

2004-06-22 23:49:58

Invocation ID of source:

(##########################)

Name of source:

(###################_domain_name)

Tombstone lifetime (days):

60



The replication operation has failed.



User Action:



Determine which of the two machines was disconnected from the forest and is
now out of date. You have three options:



1. Demote or reinstall the machine(s) that were disconnected.

2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent
deleted objects and then resume replication.

3. Resume replication. Inconsistent deleted objects may be introduced. You
can continue replication by using the following registry key. Once the
systems replicate once, it is recommended that you remove the key to
reinstate the protection.

Registry Key:

HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication
With Divergent and Corrupt Partner


Many thans in adance

 

[Chriss3 [MVP]]

Hello,
Have you tried one of the 3 choose in the event log?
I recommend to try step 2 first, Install Windows Support Tools from the
Windows Server CD, then the command line based tool repadmin is available.

1. Demote or reinstall the machine(s) that were disconnected.

2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent
deleted objects and then resume replication.

3. Resume replication. Inconsistent deleted objects may be introduced. You
can continue replication by using the following registry key. Once the
systems replicate once, it is recommended that you remove the key to
reinstate the protection.

Registry Key:

HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication
With Divergent and Corrupt Partner

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup

 

[Harald Bilke]

Hej, hej

Lurker mode off
Similar problem - maybe a solution from you?

...

I did some testing w/imaging software. Not a problem with a single AD,
and not with more if in the AD didn't change objects.

1. Demote or reinstall the machine(s) that were disconnected.

Hmm, takes some time and FSMOs?

2. Use the "repadmin /removelingeringobjects" tool to remove inconsistent
deleted objects and then resume replication.

Deleted objects - ok! But what happens to added/changed object when
issuing this command? I _know_ the other DC(s) have the correct AD.

3. Resume replication. Inconsistent deleted objects may be introduced. You
can continue replication by using the following registry key. Once the
systems replicate once, it is recommended that you remove the key to
reinstate the protection.
How?


Registry Key:

HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication
With Divergent and Corrupt Partner

Well, does the "younger" AD win?

Harald, just curious

 

[Joe Richards [MVP]]

In my experience of helping lots of companies with their ADs I only have one
solution I recommend for this.

Wipe the DC and rebuild it. You don't risk any corruption in the rest of your AD
and you learn a very critical lesson on monitoring replication.

I ran an AD with some 400 domain controllers and if any of them were not
replicating for a week I started busting heads. Once they hit 40 days they were
on a 10 day countdown, if they couldn't be repaired or the network couldn't be
repaired the DC was chopped out of the forest at 50 days.

joe