Domain Controller Server 2016 - Event Id 1863 errors in event log

Question

Scenario:

DC1 / Windows Server 2016 (ver 1607 GUI)

DC2 / Windows Server 2016 (ver 1607 GUI)

This domain have migrated from server 2000 > 2003 > 2008 > 2016 , Same name/ip have been used after migratrion and metadata cleanup have done properly All servers / clients are on same single subnet with 1 G network connectivity, no delay no timeouts.

in DC1 > Event viewer > Directory Services , I am seeing following errors on a daily basis

Error: 1863
This is the replication status for the following directory partition on this directory server. 
Directory partition:
DC=ForestDnsZones,DC=MYDOMAIN 
This directory server has not received replication information from a number of directory servers within the configured latency interval. 
Latency Interval (Hours): 
24 
Number of directory servers in all sites:
1 
Number of directory servers in this site:
1 
The latency interval can be modified with the following registry key. 
Registry Key: 
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Replicator latency error interval (hours) 
To identify the directory servers by name, use the dcdiag.exe tool. 
You can also use the support tool repadmin.exe to display the replication latencies of the directory servers.   The command is "repadmin /showvector /latency <partition-dn>".

& same errors with

Directory partition:CN=Schema,CN=Configuration,
DC=MYDOMAIN

Directory partition:
DC=MYDOMAIN

I have Attached DC1 diagnostic log which contain all the test results

• dcdiag /s:DC1 /v

• repadmin /showrepl

• repadmin /replsummary

• dcdiag /test:dfsrevent

• DCDiag /Test:DNS

• NET SHARE

• gpotool /verbose

How can I sort this? Kindly advise.

DC DIAGNOSTIC LOG

Answer 1

We got the same problem, error 1863 or error 1864. What we did:

• dc1 - Server 2012
• dc2 - Server 2012
• added dc3 Server 2019 <-transferred als roles
• dc2 - removed ad role and demoted it
• dc2 - promoted new server2019
• dc1 - demoted
• dc1 - promoted new server2019

All checks I made were ok, no error was triggered. I did not understand why?

My thoughts: Now we have old Objects with the same name, but they are out of sync (and thats ok, they are removed).

PS C:\Users\Administrator.ADINT> repadmin /showvector dc=test,dc=dir /latency
GUIDs werden zwischengespeichert.
..
Default-First-Site-Name\DC2-ADINT (deleted DSA) auf USN  80838225 um 2020-08-15 10:36:22 <-old
Default-First-Site-Name\DC1-ADINT (deleted DSA) auf USN  78136866 um 2020-08-15 11:02:35 <- old
Default-First-Site-Name\DC1-ADINT (deleted DSA) auf USN    139606 um 2020-08-15 11:36:26 <-old
Default-First-Site-Name\DC3-ADINT    auf USN   6708796 um 2020-08-21 12:44:46
Default-First-Site-Name\DC2-ADINT    auf USN    419771 um 2020-08-21 12:44:54
Default-First-Site-Name\DC1-ADINT    auf USN    403567 um 2020-08-21 12:44:55

I think its a bug, and I thing the matching was done by the name and not the ID of the object.

The object will be delete by the Tombstone lifetime, I decresed the value (adsiedit -> configuration) (was immediated transferred to alle DCs, so they are in sync).

The result of this is, that the Object is gone and only the ID availible any more.

PS C:\Users\Administrator.ADEXT> repadmin /showvector dc=domain,dc=dir /latency
GUIDs werden zwischengespeichert.
..
3ba7ab39-efc1-443b-938e-533c359ed00e auf USN   4667883 um 2020-02-27 16:49:54
6a5a2a5d-e5ed-4c34-ad20-3ea4906975bd auf USN  11074671 um 2020-03-05 16:25:16
Default-First-Site-Name\DC3-ADEXT    auf USN    438221 um 2020-08-21 12:24:56
Default-First-Site-Name\DC2-ADEXT    auf USN    496058 um 2020-08-21 12:36:31
Default-First-Site-Name\DC1-ADEXT    auf USN    471036 um 2020-08-21 12:43:45

Now the error has disappeared.

Reset the Tombstonelifetime to 180 days.