Replication, /forceremoval

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Hey guys,

I've seen various posts involving a suggestion that when a DC has been
offline for 60 days and tombstoned, the best recourse is to follow a
demote/promote scenario.

I'm planning for a disaster and would like to discuss the following.
We have several remote offices, each office has its own domain, all in
the same forest, connected via VPN to the root domain at head office.
Each office is small and could only justify one DC.
Each DC replicates to the root domain regularly.

Now, let's say there's a Telstra fault, and the Internet is offline for
60 days (we hit 55 not long ago, so I need to plan for this). Since
there is no other domain controller for the domain hosted in that
single remote branch, what course of action should be taken to get that
office replicating again?

I know we can increase the tomestone lifetime now, but that's a hack, I
was looking for a proper fix.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

You would need to remove the DC that has been disconnected for 60+ days
from AD (clean the metadata) and then re-promote. There is a regkey
that allows replication between DCs after the tombstone lifetime has
expired which is HKLM\System\CCS\Services\NTDS\Parameters\Allow
Replication With Divergent and Corrupt Partner = 1 (reg_dword) but use
at your own risk. The tombstone lifetime was designed to prevent
problems with conflicting replicated objects after that time has
expired.

Clean the metadata using the following:
http://support.microsoft.com/default.aspx?scid=kb;en-us;216498


chris

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

The definition of 'hack' is somewhat in the eye of the beholder, but
good news, Microsoft have already increased the tombstone lifetime
default for a freshly built 2003-SP1 forest to 180 days (if your WAN is
down for that long or longer then perhaps your problems lies elsewhere
;o). Since MS have impicitly blessed a longer TSL, I hope that that may
ease or remove your apprehension in increasing the value on your own
production forest.

If you still have concerns that such an extensive downtime may once
again occur, consider implementing a cost effective secondary
connectivity on-demand solution such as a point-to-point dialup ... or
possibly consider promoting a Panasonic Toughbook to the role of DC and
FedEx'ing it between sites on an intermittent basis during the downtime
.... this is somewhat of a tongue-in-cheek suggestion due to the severe
security implications but I felt it worth a mention.

--
Dean Wells [MVP / Directory Services]
MSEtechnology
[[ Please respond to the Newsgroup only regarding posts ]]
R e m o v e t h e m a s k t o s e n d e m a i l

technion@wiretapped.net wrote:
> Hey guys,
>
> I've seen various posts involving a suggestion that when a DC has been
> offline for 60 days and tombstoned, the best recourse is to follow a
> demote/promote scenario.
>
> I'm planning for a disaster and would like to discuss the following.
> We have several remote offices, each office has its own domain, all in
> the same forest, connected via VPN to the root domain at head office.
> Each office is small and could only justify one DC.
> Each DC replicates to the root domain regularly.
>
> Now, let's say there's a Telstra fault, and the Internet is offline
> for 60 days (we hit 55 not long ago, so I need to plan for this).
> Since there is no other domain controller for the domain hosted in
> that single remote branch, what course of action should be taken to
> get that office replicating again?
>
> I know we can increase the tomestone lifetime now, but that's a hack,
> I was looking for a proper fix.

 

[Guest]

Archived from groups: microsoft.public.win2000.active_directory (More info?)

"" wrote:
> Hey guys,
>
> I've seen various posts involving a suggestion that when a DC
> has been
> offline for 60 days and tombstoned, the best recourse is to
> follow a
> demote/promote scenario.
>
> I'm planning for a disaster and would like to discuss the
> following.
> We have several remote offices, each office has its own
> domain, all in
> the same forest, connected via VPN to the root domain at head
> office.
> Each office is small and could only justify one DC.
> Each DC replicates to the root domain regularly.
>
> Now, let's say there's a Telstra fault, and the Internet is
> offline for
> 60 days (we hit 55 not long ago, so I need to plan for this).
> Since
> there is no other domain controller for the domain hosted in
> that
> single remote branch, what course of action should be taken to
> get that
> office replicating again?
>
> I know we can increase the tomestone lifetime now, but that's
> a hack, I
> was looking for a proper fix.

You are right... "killing" the DC and rebuilding it is THE BEST and
MOST SAFE WAY to accomplish this!

If you take those future outages into account you have the following
possibilities:
* Keep the current forest structure but increase the tombstone
lifetime (TSL) from the default 60 days to lets say 180 days. MS has
increased the TSL from 60 to 180 days in W2K3SP1 for new forest
installs. This is not a hack... this is the fix that might save you
from future connection outages and thus rebuilding those 1 replica
(DCs) domains. Even with more than 1 DC it will not safe you because
if the connection with the hub location is gone for more than the TSL
all DCs in that branch office are toast! By the way... do you care to
share why a connection goes out for more than 60 days? Connections can
get lost but for 60 days....???!!!

* Change your forest structure from a multiple domain forest to a
single domain forest and configure replication to off peak hours if
needed. For safety measures increase the TSL to lets say 180 days.
Having a single domain forest means you have backup DCs at other
locations. So when a branch office location looses connection again
for mre than the TSL you can kill the DC and rebuild it from a copy of
another DC in another location. In your current structure this is not
possible. If you have w2k3 you have the option to use install from
media which means you can rebuild a DC from backup from another DC.
This saves a lot of initial replication through your WAN. After
install it still needs to replicate to changes after the backup was
made, but hey that is a lot less than the initial replication.

I would prefer the option change the forest structure to a single
domain and change the TSL to lets say 180 days. The downside of
increasing the TSL is that tombstones are kept longer longer in your
database and it needs more space on the harddisk. But that also
depends how frequent you guys delete objects

Now back to your current problem... YES, it it the safest way to kill
the DC and rebuidingh it from scratch! In your case it also means you
are rebuilding your domain and thus all objects in it. You also need
to rejoin all clients, repermission all resources etc. It is still the
safest way for the OTHER DOMAINS in the forest. If you decommission
the domain all the objects in it will also be gone from all GCs in the
forest and you will not have lingering objects. However, I understand
your pain and why you are searching for other methods to resolve this.

There is however another way.... hoever, you must know what you are
doing and also know what could go wrong. Be carefull!!!
See
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/4a1f420d-25d6-417c-9d8b-6e22f472ef3c.mspx
If you hesitate get help from MS!
Cheers,

--
Posted using the http://www.windowsforumz.com interface, at author's request
Articles individually checked for conformance to usenet standards
Topic URL: http://www.windowsforumz.com/Active-Directory-Replication-forceremoval-ftopict552108.html
Visit Topic URL to contact author (reg. req'd). Report abuse: http://www.windowsforumz.com/eform.php?p=1749955