ADSIEdit and system values

[BliarOut]

Nice one this... One of my customers has an AD replication issue. I've tracked it down to a corrupt value in one of the DC's. Great, delete it with ADSIEdit and away we go. Except ADSIEdit won't let me It says it's a system value.

Great, the system is refusing to allow me to repair it. Harrumph. Anyone found a way to force edit a system value with ADSIEdit? Yes, I know what I'm doing, but I can't bloody do it.

[TheExcession]

Have you tried using a 2Gb dial-up-radio-cable-modem?

That'll surely fix it?

[BliarOut]

And to think when I saw your name I thought it would be a definitive post on programmatically editing the FRSComputerBL in AD using native API calls... lol

So they've reconnected Ireland to the interweb then

Still not fixed it if anyone's listening... NTDSUtil?

[TheExcession]

BliarOut said:

And to think when I saw your name I thought it would be a definitive post on programmatically editing the FRSComputerBL in AD using native API calls... lol

yup... sorry about that... I thought it would get you excited. I know nothing about AD..... so my only suggestion would be bin it and use Linux

[225]

try using ldp.exe

[_DeeJay_]

BliarOut said:

Nice one this... One of my customers has an AD replication issue. I've tracked it down to a corrupt value in one of the DC's. Great, delete it with ADSIEdit and away we go. Except ADSIEdit won't let me It says it's a system value. Great, the system is refusing to allow me to repair it. Harrumph. Anyone found a way to force edit a system value with ADSIEdit? Yes, I know what I'm doing, but I can't bloody do it.

DCPROMO.EXE -> NEXT -> NEXT -> NEXT -> NEXT -> OK -> DCPROMO.EXE -> NEXT -> NEXT -> NEXT -> NEXT -> OK should do it.

I've had the same issue and after escalation through HP and Microsoft we eventually gave up.
What's the attribute you'd identified called? We ended up with an invalid cross reference to a non existent domain partition. It didn't like that, at all..

D

edited to say: LDP is unlikely to help, the query is being made correctly it's just AD refuses to do it because it knows better.... . It DCPROMO doesn't work, you'll have to remove AD forcefully on that DC and follow the MS process for getting rid of the mess it leaves behind. Either way, I reckon you're best just junking that replica.


>> Edited by _DeeJay_ on Wednesday 29th March 15:27

[BliarOut]

DCDiag said:

Starting test: VerifyReferences Some objects relating to the DC Server-1 have problems: The system object reference attribute frsComputerReferenceBL on object Server-1,OU=Domain Controllers,DC=SubDomain,DC=Domain DC=com did not point to an object that had a valid back link. ......................... Server-1 failed test VerifyReferences

I'm not DCPromoing at the mo, there are GPO replication issues. I *think* the problem relates to a redundant DFS share that they had but somehow there is a mangled value in there... I think it is the value below that's giving me jip.

CN={1defc122-4e00-49bc-9068-124b5c9624a7},CN=GEN|HR,CN=GEN,CN=DFS Volumes,CN=File Replication Service,CN=System,DC=Domain,DC=com

Bottom line is I need to try to find a way to fix the invalid backlink but it's not coming up. Google has revealed a few similar problems and as yet I haven't found a solution.

Any help greatly appreciated as I'm on this one at the moment.

[_DeeJay_]

BliarOut said:

DCDiag said: Starting test: VerifyReferences Some objects relating to the DC Server-1 have problems: The system object reference attribute frsComputerReferenceBL on object Server-1,OU=Domain Controllers,DC=SubDomain,DC=Domain DC=com did not point to an object that had a valid back link. ......................... Server-1 failed test VerifyReferences I'm not DCPromoing at the mo, there are GPO replication issues. I *think* the problem relates to a redundant DFS share that they had but somehow there is a mangled value in there... I think it is the value below that's giving me jip. CN={1defc122-4e00-49bc-9068-124b5c9624a7},CN=GEN|HR,CN=GEN,CN=DFS Volumes,CN=File Replication Service,CN=System,DC=Domain,DC=com Bottom line is I need to try to find a way to fix the invalid backlink but it's not coming up. Google has revealed a few similar problems and as yet I haven't found a solution. Any help greatly appreciated as I'm on this one at the moment.

Sorry, I meant if you have multiple domain controllers and one of them is not replicating the simplest fix is to remove AD from that machine, then DCPROMO it again.

If you cannot do that (for whatever reason) you'll need to supply more information on the problem. Any event logs relating to this?

D