Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Still have an ongoing replication issue on my network. Long story short:

Existing 2003 Domain (2003 Level). Added a new 2008R2 server. Did the usual Adprep/forestprep steps as required. Transferred FSMO roles etc.

Had some initial issues creating Sysvol and Netlogon shares. Rectified with assistance from here running the Burflags reset workaround.

Now, strangely, I have the following issues:

In AD Users and CLients on the 2008DC I have all the users....but nothing in any of the other OU's. Nothing in Computers, Builtin, Domain Controllers etc but on my 2003DC they are all there. So its not pulling the info out of 2003DC and putting it into the 2008DC.

But, if a create a user on the 2008DC it will successfully replicate back to the 2003DC AND if I create a user ont he 2003DC it will replicate successfully back to the 2008DC.

Any ideas?? I'd like to kill off the 2003DC but can't till I get this working 100%.

Also, ont he 2008DC, and this may be related. I get repeated Event 6's and 13's - to do with failing to auto-enroll - RPC server unavailable. Again, any help is apprciated.

share|improve this question
what is the output of dcdiag on your 2008 DC? Also do you have any errors in your FRS or AD DS event logs on that DC? Any firewalls possibly blocking traffic between the DCs? – HostBits Feb 20 '12 at 1:36
up vote 1 down vote accepted

Given that there have been issues, it's possible that inbound replication from the 2003 DC has been stopped due to detection of a lingering object. This is due the feature known as strict replication.

You can use repadmin /showreps to determine if replication is working. If replication is not working, the date in the output will not be recent.

If this is the case, the fix is to remove the lingering objects, and hopefully there aren't many. One tool is to use repadmin /removelingeringobjects /advisory_mode to detect lingering objects that may be removed, and run without the advisory_mode switch to fix them. In practice, this only works on small domains with a reasonable number of objects. It can run forever on large domains.

Fixing Replication Lingering Object Problems (Event IDs 1388, 1988, 2042)

share|improve this answer
Thanks Greg. I beleive I have it sorted out now, apart fromt he certificate enrollment errors. AD now looks clean and DCDIag is now coming up with no errors etc – vlannoob Feb 23 '12 at 0:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.