Posts Tagged ‘AD’

How to remove lingering objects from complex environment

Saturday, December 27th, 2014

Based on “Clean that Active Directory forest of lingering objects” article on Glenn LeCheminant’s weblog here is an extract of my own development:


Lingering objects are not desired entities in AD. If one or more domain controllers are disconnected from environment and back after some period of time (called: tombstone), deleted objects can be reintroduced by them. Clearing of AD is serious challenge and requires complex solution in complex environment.

Microsoft prepared simple tool to perform proper removal. However using it depends on design of the environment. Because connections between all sites are not always fully meshed, lacks in “seeing” domain controllers each other is mitigated by simple trick: one domain controller in particular domains is chosen as reference server for its own domain partition and is used by any other domain controller with global catalog function from other domains as reference source. The best is PDC because it should be accessible at least from any domain controller in its own domain and in theory from other domains. However it’s not really manadatory and any DC can be used. In rare cases of communication issue there is needed additional step described below.


Below procedure can be used for effective removal of lingering objects in entire forest. It bases on preparing reference domain controller with clean, writable domain partition, and using it as an authoritative source for any other domain controller holding write (DC) or read-only (GC) version of this partition.

Solution is covered by using following command:


sourceDCGUID can be found in several ways:

This procedure requires to finish three steps in every domain in entire forest:

Step 1: Cleaning up domain partition on reference DC

Series of commands run against one choosen DC allow to clean up its partition in reference to all other DCs in this domain:

In case of communication issue (because of firewall restriction, etc.) finish clearing process of chosen DC with the rest of DCs and begin again Step 1 with failured ones:


Step 2: Cleaning up writable version of domain partition on remaining DCs

Series of commands run against all other DCs of affected domain allow to clean up their partitions in reference to DC choosen in Step 1:

In case of communication issue repeat Step 2 with failured DCs:



Step 3: Cleaning up read-only version of domain partition on all GCs in entire forest

Series of commands run against all GCs located in different domains allow to clean up their read-only version of affected domain partitions in reference to any DCs from Step 1 or Step 2.

In case of communication issue replace DC1guid with any other one from Step 1 or 2. If all DC guids don’t allow to establish proper communication between GC under clearing process and any DC which is owner of affected domain partition, use the nearest last GC which walked through Step 3 without failure, to re-host this partition:




The following events are logged during clearing lingering objects:

Events logged on DC without lingering objects:

1388: SRC is off, lingering objects appeared

1988: SRC is on, lingering objects blocked

2042: Too long since source replication

Events logged on DC with lingering objects during:

repadmin /removelingeringobjects … /advisory_mode

1938: Starting detection summary

1946: For each lingering object detected

1942: Final detection summary

Events logged on DC with lingering objects during:

repadmin /removelingeringobjects …

1937: Starting removal summary

1945: For each lingering object detected and removed

1939: Final removal summary

Reference articles:

Fixing Replication Lingering Object Problems (Event IDs 1388, 1988, 2042)

Event ID 1388 or 1988: A lingering object is detected

Lingering objects may remain after you bring an out-of-date global catalog server back online

Outdated Active Directory objects generate event ID 1988 in Windows Server 2003

How to find and remove lingering objects in Active Directory

Clean that Active Directory forest of lingering objects

Repadmin for Experts

Enable strict replication consistency


VBS scripts to query everything

Wednesday, December 24th, 2014

There are a few simple scripts developed by me to automate somehow regular reporting against set of servers. Result is usually presented in csv file to use it quickly in Excel or similar calculation software.

Scripts to query WMI:

Script to report installed roles and features:

usage: cscript /nologo getRoles.vbs servers.txt

Example of input file: servers.txt

Example of output file: getRoles_26-09-2014_12-30-14.csv

Script to report info about installed services:

usage: cscript /nologo getServices.vbs servers.txt

Example of input file: servers.txt

Example of output file: getServices_19-11-2013_07-30-15.csv

Script to report information about capacity of local disks:

usage: cscript /nologo getCapacity.vbs servers.txt

Example of input file: servers.txt

Example of output file: getCapacity_01-10-2013_13-01-51.csv

Script to report activation status:

usage: cscript /nologo getActivationStatus.vbs servers.txt

Example of input file: servers.txt

Example of output file: getActivationStatus_17-06-2013_10-12-18.csv

Script to report about sharings:

usage: cscript /nologo getSharings.vbs servers.txt

Example of input file: servers.txt

Example of output:

Scripts to query registry:

Script to report installed software:

usage: cscript /nologo getSoftware.vbs servers.txt

Example of input file: servers.txt

Example of output file: getSoftware_12-06-2013_13-51-58.csv

Script to report status of WSUS:

usage: cscript /nologo getWSUS.vbs servers.txt

Example of input file: servers.txt

Example of output:

Scripts to query LDAP:

Script to enumarate groups where user, specified in input file, belongs to directly (nesting level = 0) and indirectly (nesting level > 0):

usage: cscript /nologo getMemberOf.vbs users.txt

Example of input file: users.txt

Example of output:

Feel free to use them.


Site links topology

Saturday, May 4th, 2013

Based on solution developed for Active Directory Topology Visualization part 1 purpose I’ve made very similar script to have nice picture of defined site links in AD.

I think it’s quite good to know if gap in replication is not caused by lack of site link, etc.


Nothing special was developed by me. I simply query via vbs script this DN:

CN=IP,CN=Inter-Site Transports,CN=Sites,CN=Configuration,DC=my,DC=domain

and result is presented in dot language formatted file.

Vbs code can be downloaded here and feel free to use it:



Result of above vbs script can look like as follow:

and based on it GraphViz can generate:

dot diagram layout (command: dot *.dot -Tjpg -odot.jpg):


fdp diagram layout (command: fdp *.dot -Tjpg -ofdp.jpg):


sfdp diagram layout (command: sfdp *.dot -Tjpg -osfdp.jpg):


Example of site node picture:


There is possible to use any other picture to present site in diagram than above one. The most important is to put picture file of site (site.png in this case) in the same location where dot file is stored before compilation.


Active Directory Topology Visualization part 1

Saturday, May 4th, 2013


Except of Microsoft Active Directory Topology Diagrammer, which requires licensed MS Visio installed, there is no easy way to show how physical topology of Active Directory looks like. As the Chinese proverb goes, “A picture is worth a thousand words”, result of 17 repadmin /replsum <DC> commands even prepared in MS Excel will not tell as much as below screen:



GraphViz is open-source tool based on dot language dedicated for drawing diagrams. It allows to present any graph or network in simple static form with information like direction of flow between nodes or node specific details. It is perfect tool to show how Active Directory Domain Controllers replicate each other and allows to find bottleneck or critical paths in AD physical topology.

Usage is very simple and requires GraphViz package installed locally and own developed script to prepare input for this tool based on dot language.

1. Below code is dot language script used as input for GraphViz package to generate nice diagram:


– AD Sites: EU, US and AS are specified as SUBGRAPH cluster_XX and are presented as rectangles in final diagram

– AD DCs: EUDC014, USDC014 and ASDC015 are simply nodes in diagram

– example of server picture to put into the same folder where is located:


2. Command to generate picture of dot diagram layout:

 and result:


3. Examples of commands to generate all kind of diagram layouts:


Dot file can be prepared manually or a bit smarter. Below vbs is my own developed and many time used script which queries AD regarding to sites, domain controllers and connection objects and generates dot launguage file used later in GraphViz package.

Vbs script is available to download here and feel free to use it:



Below diagrams are examples of AD replication topology:


fdp1However more complex environments (>100 DCs) require a few tricks to make pictures more readable. I usually add dotted style for connections for example:

or trying to generate all kind of diagram layouts to choose the most suitable to study. In most cases huge networks need specific approach.

A few useful links:

1. Official GraphViz web site:

2. Dot guide:

3. Wikipedia about GraphViz:

4. Active Directory Topology Visualization part 2

Let the “more readable replication topology” be with you.