Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our Windows domain has 3 DCs. One of the DCs is replicating changes made on the other DCs but not replicating out any changes made on itself.

We have no idea which has the most up-to-date AD so we want to compare the other 2 with the 1 that isn't working.

Is it possible to export the properties on every object (OU, CN, User, Group etc.) so that I can compare them? Maybe to an xml file?

Maybe there is a PowerShell or vbScript that will do this?

share|improve this question

migrated from Feb 20 '13 at 21:04

This question came from our site for computer enthusiasts and power users.

just found csvde -f test.csv which might be what I want – neildeadman Feb 20 '13 at 10:30
if you found a solution answer your own question. share your knowledge – Mayank Sharma Feb 20 '13 at 10:56
@MayankSharma once I have confirmed it does what I want I will, but currently still exploring options. – neildeadman Feb 20 '13 at 11:33

It sounds like your plan is to determine what DC has the latest changes, and then make them on another DC?

No no no no no.

This will backfire. AD doesn't replicate by what changes are consistent with each other, it replicates by latest serial number. What you need to do is fix replication. Depending on your version of Windows (you didn't tell us; it would be helpful), you can use REPLMON or REPADMIN to determine what is failing, and probably why. Edit- cheekaleak is correct: DCDIAG is also useful for finding replication and other errors in your DCs.

share|improve this answer
My plan isn't to just make the changes elsewhere, its to determine how many objects are inconsistent on the other DCs. The tombstone period has past so really all we can do is remove this DC. – neildeadman Feb 21 '13 at 8:34

Run dcdiag on the server that isn't replicating changes made on it, and check its File Replication Services log for errors. That should help point you in the direction of how to fix replication.

share|improve this answer

The symptom is a classic indicator of lingering objects. If Strict Replication is enabled on a domain controller, and it detects a lingering object from a replication neighbor, it block inbound changes from that neighbor until the offending object is removed.

Strict Replication is set by default in new Windows Server 2003 SP1 domains and later.

When a lingering object is detected, an event id 1988 or 1388 is recorded in the Directory Service event log. If the domain/forest is small (at most a few domain controllers and less than 50,000 objects), you may use repadmin to remove lingering objects. Using repadmin for this purpose is not feasible on large AD implementations.

The following command will compare the specified partition on all domain controllers when * is substituted for ServerName, and log any offending lingering objects for removal:

repadmin /removelingeringobjects <ServerName> <ServerGUID> <DirectoryPartition> /advisory_mode  

If you are satisfied with the report, run the command without the advisory_mode switch to perform the action.

Troubleshooting Active Directory Replication Problems

Event ID 1388 or 1988: A lingering object is detected

Use Repadmin to remove lingering objects

A similar tool is GCChk from JoeWare, although I haven't used it:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.