Active Directory: A virtual domain controller exceeds the 60-day tombstone lifetime
My domain controllers were not receiving replication updates from their partners. Event Viewer showed many errors and warnings.
The domain controller I investigated was a Windows Server 2008 virtual machine. The Directory Services event log showed warnings with Event IDs 1925, 1435 and 1663. I restarted the "Active Directory Domain Services" service, rebooted the server and reset the computer account password with netdom.exe.
Because the problem involved Active Directory, I ran dcdiag.exe.
DCDiag.exe command-line tool analyzes the state of one or all domain controllers in a forest and reports any problems to assist in troubleshooting. DCDiag.exe consists of a variety of tests that can be run individually or as part of a suite to verify domain controller health.
I saved the output to a text file and reviewed it. This warning identified the problem:
Code7 lines
1 2 3 4 5 6 7Starting test: Replications REPLICATION-RECEIVED LATENCY WARNING NET-DC-03: Current time is 2009-02-08 17:01:25. DC=ForestDnsZones,DC=Networknet,DC=nl Last replication received from LABN-MSX-01 at 2008-10-26 15:22:49 WARNING: This latency is over the Tombstone Lifetime of 60 days!
This latency is over the Tombstone Lifetime of 60 days!
If you encounter this warning, there is no way to resolve the problem without seizing the FSMO roles to another functioning domain controller and forcing dcpromo.exe to remove Active Directory from the affected system. After rebooting the server, run metadata cleanup to remove the obsolete records.
The virtual machine had been shut down for three months, which caused the tombstone problem. This was a lab environment for my development work. In production, you may not encounter this unless an AD site is disconnected for an extended period.