RE: [ActiveDir] Contents of GC

[joe]

Title: Contents of GC

I finally remembered!!!

 

Lingering Objects!

 

Once I had that I found the KB article quickly enough. Thank Google...

 

 

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314282

 

 

   joe

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe
Sent: Thursday, January 29, 2004 9:55 PM
To: [EMAIL PROTECTED]
Subject: RE: [ActiveDir] Contents of GC

Oh what an interesting scenario....

 

You are an evil person.

 

The fact that you don't have references to the objects in the main domain means they will never automatically get updated since that is all GUID/USN based...

 

You need to clean out the GC partitions. You can do that by wiping them but that would be painful. I do believe MS has another process for this but as a last resort kind of thing. I am barely remembering a conversation with one of the Alliance PSS guys once that they have a method to delete objects out of the GC partitions it had something to do with something they fixed in W2K3 and one of the W2K SP's. I bet Dean would spit this one out in like 10 seconds.

 

Crap I hate it when I can't remember things like this...

 

One additional evil test I would try to do is to recreate the object and see how the GCs handle it. And then delete the object. It shouldn't touch the existing ones but I would be interested to know what it would do with that add... Could possibly throw the GCs over the edge because you would be violating the consistency rules and the GC partitions shouldn't be able to rename an object name with the GUID like the default partition can...

 

There is some replication issue thing that can get garbage into the GC that you can't get back out... It is on the tip of my frontal lobe...

 

Hmm let me watch ER and think about it... I know I don't know the method to do the delete, but if I can recall what the original issue is maybe I can find info about the backdoor fix or search keywords...

 

  joe

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jorge de Almeida Pinto
Sent: Thursday, January 29, 2004 7:56 AM
To: [EMAIL PROTECTED]
Subject: [ActiveDir] Contents of GC

Hi Everyone,

The following situation....

THE FOLLOWING ENVIRONMENT IS AN EXAMPLE:
* 1 forest with 3 domains (W2K Native Mode)
        * DOM_A is forest root
        * DOM_B is a child domain of DOM_A
        * DOM_C is a child domain of DOM_A
* Each domain has 5 DCs
* Each DC = GC

On
T=0     : all DCs/GCs are in sync
T=1     : backup made of all DCs in forest (system state)
T=2     : addition of 10000 objects to DOM_B
T=3     : all DCs/GCs are in sync again (all GCs in DOM_A & DOM_C contain the 10000 objects from DOM_B)
T=4     : some time later
T=5     : ALL DCs in DOM_B crash or dy or whatever (don't function anymore)
T=6     : Restore all DCs in DOM_B from the backup made in T=1

After the restore is finished al DCs from DOM_B boot and are OK again

SITUATION:
All GCs from DOM_A & DOM_C contain information about the 10000 objects from DOM_B. These objects reside in the GC data but the domain data (DOM_B) does not even know of the existance of those objects because all DCs have been restored. The GC data is newer than the domain data.

How to deal with?
SOLUTION 1: (I know this one works, but with a forest containing a lot of DCs/GCs I'd rather not do this)
* Demote all GCs in the forest? (wait until all GCs are fully demoted)
* Promote all DCs to GC again

SOLUTION 2: (I hope something like this works)
Is it possible to say:
* Tell all GCs to remove the read-only naming context of DOM_B and rebuild it again (is REPADMIN able to do this?)

SOLUTION 3:(I hope something like this works)
Is it possible to say:
* Tell all GCs to check the read-only naming context of DOM_B against the DCs of DOM_B and remove all objects from the GC data that do not exist in DOM_B

SOLUTION 4:
Something else?????

I hope someone can answer this

Thanx in advance!

Regards,
Jorge

Does somebody know how or which tool is able to check if a certain object is stored in de read-only naming context (of a certain domain) of the GC?

Environment:
* W2K3
* 3 domains
* 1 DC per domain
* Each DC = GC
* No Exchange

Met vriendelijke groet / Kind regards,

Jorge de Almeida Pinto
Microsoft Infrastructure Consultant
__________________________________________

<<...OLE_Obj...>>

LogicaCMG Nederland B.V. (BU SD/AT)
Division Industry, Distribution and Transport (ID&T)
Kennedyplein 248, 5611 ZT, Eindhoven
.       Postbus 7089
        5605 JB Eindhoven
(       Tel             : +31-(0)40-2957777
2       Fax     : +31-(0)40-2957630
(       Mobile  : +31-(0)6-29067977
*       E-mail  : [EMAIL PROTECTED]
"       <http://www.logicacmg.com/> - Solutions that matter -

This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.