I have 6 Windows 2008 R2 Domain Controllers, all GCs, across multiple locations (2+2+2).

On my main site I have a clone of one of our DCs done a few month ago, usually totally isolated from the network. This morning I made a mistake of accidentally linking this clone to my standard network. (Never right click on edit settings without selecting the correct VM) I left this connected for 25 minutes until I noticed the issue. I ran dcdiag on a different site without particular issue notified.

I would like help to see if I am in big trouble per the Microsoft Support article How to detect and recover from a USN rollback. I don't fully understand it.

This is the output of repadmin: This is the clone of DC1 that I powered on this morning..

C:\Users\admin>repadmin /showutdvec DC1 dc=mydomain,dc=local
Caching GUIDs.
mainsite\DC2                   @ USN  28895532 @ Time 2014-02-26 12:41:58
mainsite\DC1                      @ USN 202723681 @ Time 2014-02-26 12:42:29

C:\Users\admin>repadmin /showutdvec DC2 dc=mydomain,dc=local
Caching GUIDs.
mainsite\DC2                   @ USN  28895538 @ Time 2014-02-26 12:42:30
mainsite\DC1                      @ USN 202723672 @ Time 2014-02-26 12:42:11

As I can see, I have:

  • DC2: usn value for DC1: 202723672
  • DC1: usn value for DC1: 202723681

As 202723681 is greater than 202723672 is that all ok ?

To be sure the replication is OK, I did the following tests:

  1. Test 1

    • Block all traffic from my computer except to DC1.
    • Change my password
    • Try to authenticate with this new password on another computer --> OK
  2. Test 2

    • Block all traffic from my computer except to DC2
    • Change my password
    • Try to authenticate with this new password on another computer --> OK

Are these tests results relevant?

  • 3
    This is the opposite of a USN Rollback - it's a regular replication delta, exactly as you would expect. – Mathias R. Jessen Feb 26 '14 at 15:08

Your verbiage could be a little more clear, but assuming you ran repadmin /showutdvec on and against the actual DC1 (not its clone), those results indicate that you probably have not suffered a USN rollback.

From the article you linked (emphasis added):

One way to detect a USN rollback is to use the Windows Server version of Repadmin.exe to run the repadmin /showutdvec command. This version of Repadmin.exe displays the up-to-dateness vector USN for all domain controllers that replicate a common naming context. To detect a USN rollback, compare the output of the repadmin /showutdvec command on the domain controller with the output of the same command on the domain controller's replication partners. If the direct replication partners have a higher USN number for the domain controller than the domain controller has for itself, and the repadmin /showreps command does not report replication errors between direct replication partners, you have compelling evidence of a USN rollback.

DC1 has a higher USN number for itself than DC2 has for it, so this does not indicate a USN rollback situation.

To be safe, run the same test against all replication partners (DCs 3, 4, 5 and 6), but it looks like the clone of DC1 you brought online was either rejected as a replication partner, or the IP conflict situation prevented replication.

  • Sorry for my verbiage. My message may show it, but I'm not very good in English and that's why I had some doubt about my understanding of linked article! By the way, I don't know how, but I would like to thanks jscott who edited my message to correct a huge number of mistake. Have a nice day – Brice Feb 26 '14 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.