Preventing Lingering Object Replication in Active Directory

Reading Time: 2 minutes

One thing you want to prevent in Active Directory is an Islanded DC, one in which you have lost connectivity to.  If a DC is disconnected beyond its "Tombstone Lifetime" it will begin to accumulate Lingering objects.  This isn't something you ever want to happen and if you are put in this situation I would strongly recommend you just flatten the DC, clean up the metadata in your domain and repromote the server.

Read my blogpost on AD clean up for assistance if you do need to remove a failed dc:

If you have an Islanded DC and for some unknown reason it is reconnected, you surely don't want to start replicating tombstoned objects to healthy DC's.  There is a simple fix for this, just enable "Strict Replication Consistency".  This registry setting will prevent replication from a corrupt partner.  You can simply open up the registry and make the modification on each dc in your domain/forest:

HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Strict Replication Consistency
0 = Disable (Loose)
1 = Enabled (Strict)

More information: http://technet.microsoft.com/en-us/library/cc784245(WS.10).aspx

Better yet, using RepAdmin just update all DC's from a command prompt (You need to elevate if on Vista/2008 or greater) in your forest.  I pipe the output and save the text file for documentation.

repadmin /regkey * +strict > c:\temp\dcListStrict.log

This will ensure that all your DC's are protected from any partners that are unhealthy and hopefully save you some real headscratching problems that can occur with Lingering objects.  In the example below you can see that only one of the three DC's needed to be updated.  You will also notice that rerunning this does not have an adverse effect.

The output of the above command would look like:

Repadmin: running command /regkey against read-only DC DC01.acme.com
HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" REG_DWORD 0x00000001 (1)
New HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" REG_DWORD 0x00000001 (1)

Repadmin: running command /regkey against full DC DC02.acme.com
HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" REG_DWORD 0x00000001 (1)
New HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" REG_DWORD 0x00000001 (1)

Repadmin: running command /regkey against full DC DC03.acme.com
HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" value does not exist
New HKLM\System\CurrentControlSet\Services\NTDS\Parameters: "Strict Replication Consistency" REG_DWORD 0x00000001 (1)