Right now my active directory is failing a dcdiag test. I can find no info online about this error.

When I run dcdiag /test:crossrefvalidation, I get the output:

Doing primary tests
    Testing server: Default-First-Site-Name\ad01

    Running partition tests on : ForestDnsZones
        Starting test: CrossRefValidation
            ......................... ForestDnsZones passed test CrossRefValidation

    Running partition tests on : DomainDnsZones
        Starting test: CrossRefValidation
            ......................... DomainDnsZones passed test CrossRefValidation

    Running partition tests on : Schema
        Starting test: CrossRefValidation
            ......................... Schema passed test CrossRefValidation

    Running partition tests on : Configuration
        Starting test: CrossRefValidation
            ......................... Configuration passed test CrossRefValidation

    Running partition tests on : mydomain
        Starting test: CrossRefValidation
            ......................... mydomain passed test CrossRefValidation

    Running partition tests on : t
        Starting test: CrossRefValidation
            This cross-ref has a non-standard dNSRoot attribute.
             Cross-ref DN:
             nCName attribute (Partition name): DC=t
             Bad dNSRoot attribute: dc01.mydomain.com
             Check with your network administrator to make sure this dNSRoot
            attribute is correct, and if not please change the attribute to the
            value below.
              dNSRoot should be: t
               It appears this partition (DC=t) failed to get completely created.
               This cross-ref
                is dead and should be removed from the Active Directory.
            ......................... t failed test CrossRefValidation

I used the LDP tool from the windows support tools. I searched for the dnsRoot attribute in "cn=partitions,cn=configuration,dc=mydomain,dc=com", with the filter "(&(objectcategory=crossref)(systemFlags:1.2.840.113556.1.4.803:=5))"

I got the result:

ldap_search_s(ld, "cn=partitions,CN=Configuration,DC=mydomain,DC=com", 1, "(&
(objectcategory=crossref)(systemFlags:1.2.840.113556.1.4.803:=5))", attrList,  0, &msg)
Result <0>: (null)
Matched DNs: 
Getting 3 entries:
>> Dn: CN=65502be3-fc90-442a-83d8-4b3b91e82439,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
    1> dnsRoot: ForestDnsZones.mydomain.com; 
>> Dn: CN=a3a24d3a-4782-460b-9148-86ac2d86b9ae,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
    1> dnsRoot: ad01.mydomain.com; 
>> Dn: CN=f0ef5771-6225-4984-acd9-c08f582eb4e2,CN=Partitions,CN=Configuration,DC=mydomain,DC=com
    1> dnsRoot: DomainDnsZones.mydomain.com;

It looks like the bad partition has the name of my first domain controller 'ad01.mydomain.com'.

I have googled for a while and have not been able to find any help or documentation about application partitions in Active Directory.

Does anyone have any advice on how to cleanup this partition (or what the partition is for)?

Does anyone know the repercussions for deleting this partition?

  • How many DCs? Which version of Windows on the DCs? Which functional level for the domain? How many domains in the forest? Which functional level for the forest? – Massimo May 21 '10 at 12:27
  • There are 3 DC's, (2 local, 1 at colo). All are Server 2003 R2. Domain and forest are at 'Windows Server 2003' (Highest available) functional level. There is only 1 domain in the forest. – BLAKE May 21 '10 at 19:25

Fire up your trusty ADSIEdit (adsiedit.msc, it's in the support tools) and connect to the Configuration context of your domain, then "Partitions"; there you should have five entries (assuming the domain name is "domain.com"):

  • CN= (partition name: DC=ForestDnsZones,DC=domain,DC=com)
  • CN= (partition name: DC=DomainDnsZones,DC=domain,DC=com)
  • CN=Enterprise Configuration (partition name: CN=Configuration,DC=domain,DC=com)
  • CN=Enterprise Schema (partition name: CN=Schema,CN=Configuration,DC=domain,DC=com)
  • CN=DOMAIN (partition name: DC=domain,DC=com)

Anything else is useless, unless you explicitly created a directory partition for it; in a standard AD setup there isn't anything else there. If one of these entries is missing, you're in troubles.

You should also find your spurious partition there; it should be safe to delete it.

Just to be on the safe side, it would be a good idea to take a proper AD backup (i.e. a DC's system state) before deleting it.

  • When I look at it, there are 6 partitions. Is there anyway to find out why the extra partition was created, or what data is stored on it? – BLAKE May 21 '10 at 19:23
  • You can read anything that's in there using ADSIEdit, but I don't think you can find why it was actually created; looks like some kind of error to me. I think it's safe to delete it, but I'd take a backup before, just in case. – Massimo May 22 '10 at 15:39
  • +1 - I can get behind deleting it. I wonder if it's an old stale ADAM partition... (msdn.microsoft.com/en-us/library/ms675765(VS.85).aspx) – Evan Anderson Jul 7 '10 at 23:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.