Sunday, March 04, 2007

More on lingering objects

A followup to a previous post. I've been thinking how lingering objects appeared in the DCA domain controller (the one that didn't have the time sync problem). I have two theories:

Theory 1. While DCB controller was in year 2000, some objects were deleted in its copy of the Active Directory database. If things were going normal, DCB would keep a copy of these deleted objects in a "tombstoned" state for the duration of "tombstone lifetime" (by default 60 days). Within this period it would synchronize with DCA and tell it about the deletions, so DCA would delete these objects from its copy of the Active Directory database. But things were not going normal. When time on DCB was corrected, it found that those deleted objects were deleted 7 years ago, i.e. way longer ago than "tombstone lifetime". Consequently, the "tombstones" were deleted and it no longer had any memory of the deleted objects. All along, DCA continued to have copies of these objects, unaware of them being deleted. So, when the time was corrected, DCA wanted to synchronize to DCB, those objects were found to be lignering in DCA.

If this theory is correct, then the solution to delete lingering objects was the right one.

Theory 2. Nothing was deleted in DCB, instead something was created in DCA. While time was broken on DCB these changes failed to replicate from DCA to DCB. When time was corrected, DCB incorrectly assumed those new objects on DCA were lingering.

If this theory is correct, then the lingering objects should not have been deleted. Instead, Strict Replication Consistency should have been disabled (as described, among other places in the Event ID 1388 or 1988: A lingering object is detected section of Active Directory Operations Guide at Microsoft Technet) and thus objects allowed to be recreated at DCB.

Somehow I feel that Theory 1 is correct, but I have no definite proof.

Post a Comment