In
seeker01 said:
Hi Ace,
I have no intention to ignore your advice but I am still blur because
of my ignorance. What exactly is this 60days limit may I know? I
thought I am now still within the 60days but why I face so many
errors. Or perhaps I should learn that "nltest" is always the command
to run whenever we restore system state? Because I am on leave next
week so my boss shows great concern I can cause further damage. Also
he argued that we are not any worst because the backup tape from
60days limit is already causing the errors, there is no difference to
even restore it from yesterday's tape now. Does it make sense?
Maybe in all honesty, if you are not trusting what you are hearing, whether
from me or anyone else in this group, I would HIGHLY suggest you call
Microsoft PSS and let them guide you. I believe there will be a charge,
unless you have an MSP agreement. It's your call.
What are you waiting for? Your vacation? You are running Certificate
services. It even complicates it. I would suggest to ACT QUICKLY and forget
your vacation next week and concentrate on this important matter. It seems
like you and your boss are gambling that the tombstone issue doesn't mean
anything to you. I'm just giving you an option before you have no more
options once the 60 Tombstone Lifetime comes up. Your issue is a secure
channel password.
You are not comprehending the seriousness of the 60 day tombstone. Once it
comes up, you will have NO OTHER CHOICE but to trash the server, seize the
FSMO roles over to the existing server, run a metadata cleanup using
ntdsutil, clean up any remaining lingering objects from the old server in
Sites and Services and using ADSI Edit, then re-format the old server and
reinstall it from scratch.
Good luck.
Below taken from:
http://www.microsoft.com/technet/ar...irectory/deploy/adguide/addeploy/addch10.mspx
It is not possible to restore a backup image into a replicated enterprise
that is older than the tombstone lifetime value for the enterprise. When an
Active Directory object is deleted, it is not fully and immediately removed
from Active Directory. Instead the majority of the attributes are stripped
out and the object is moved to the deleted items container. This remaining
object is called a tombstone. This tombstone object is replicated to all
domain controllers in that respective domain so that they can learn of the
object deletion. In this manner, the original object is no longer available
to anyone searching Active Directory for it, but it is tombstoned.
The tombstone lifetime value represents the number of days that the deleted
object (or tombstone) must be retained before it can be permanently removed
from the directory. This value can be set by using the Active Directory
Service Interfaces (ADSI) edit at the directory service path below:
Cn=Directory Services, cn=WindowsNT, cn=Services, cn=Configuration,
dc=<<Domain_Name>>,dc=<<Domain_prefix>>
The default tombstone lifetime value is 60 days. Active Directory will not
allow data to be restored to the directory from a backup image that is older
than the tombstone lifetime. If this were to happen, the restored object
would have an Update Sequence Number (USN) too old to trigger Active
Directory replication. In this scenario, the object would never be
replicated out to other domain controllers, and the restored domain
controller would never replicate in to the necessary information to delete
the object. Active Directory on the local server would thus become
inconsistent.
Ace
