DNS zone deleted. After recreation, "lingering objects" message appears in many DC's

hi all,

we're experiencing huge problem replication of ad. let's start beginning, , i'll explain can:

1. week ago, in 1 of our dc's @ remote site, happened domain dns ad integrated zone. zone dissappeared, , in event viewer, following message logged

"the dns server received indication zone mydomain.net deleted the  active directory.  since zone active directory integrated zone, it  has been deleted dns server"

we're investigating why happened, suspect deleted zone or changed primary, causing deletion. anyway, let's continue explanation of current problem.

2. when noticed deletion of zone (because replication arrived our main site), connected 1 dc still didn't replicate deletion, , exported records txt file. later, replication arrived dc , zone deleted.

3. @ our main site, created again zone, naming before. imported records  (a, ns, etc...) txt file usin dnscmd. seemed work, thought problem fixed.

4. 2 days ago, realised zone mydomain.net being deleted again in lot of dc's @ remote sites (about 60, of total of 75). our explanation of there might problems replication dc's, , change of status of zone arrived later.

5. replication of  deletion of zone arrived, expected recreation arrived too, never did.

6. workaround issue on affected dc's, pointed dns servers on nic's dc/dns servers have @ our main site. caused slow logons, @ least, worked.

7. force replication of zone, executed ipconfig /flusdns, ipconfig /registerdns, restarted netlogon on affected dc's, , launched replication through ad sites , services, didn't work.

8. now, getting errors messages on remote , affected dc's, complaining of existence of lingering objects @ our main site.

9. dns zone not being created @ affected dc's, changes in user , computer accounts replicates ok. that's strange, because our dns zone ad integrated and, under our point of view, if replication works something, must work everything.

afraid if clean main site of lingering objects comparing against 1 of affected dc's, situation become more troubled. wondering if there way of forcing replication specifing main site has correct information, , ignore conflicts affected dc's report.

we've readed loose replication (allowing replication corrupt partner), think solution. if enable this, , let affected dc's replicate anyway despite lingering objects, happen when send changes our main site? our dc's @ main site start complaining lingering objects in remote dc's? find big trouble...

can see, demotion , repromotion not option, since number of affected dc's 60.

suggestions?

ps: please, excuse typos , grammar errors, english not mother tongue

the issue sounds replication issue, since stated have loose , strict replication enabled.  going cause headaches (which sounds already).  if go , set strict, find dc's lingering objects , fix (which means demote/promote).

if enable loose replication, go back and clean lingering objects on dc's set strict replication.  strict has helped you, not hurt you.

--
paul bergson
mvp - directory services
mcitp: enterprise administrator
mcts, mct, mcse, mcsa, security+, bs csci
2008, vista, 2003, 2000 (early achiever), nt4
http://www.pbbergs.com    twitter @pbbergs
http://blogs.dirteam.com/blogs/paulbergson

please no e-mails, questions should posted in newsgroup. posting provided "as is" no warranties, , confers no rights.

Windows Server  >  Directory Services