Lingering objects may remain after you bring an out-of-date global catalog server back online (314282)

MORE INFORMATION

1. Start Ldp.exe.
2. On the Connection menu, click Connect.
3. Type the name of a global catalog. Type 3268 as the port to which to connect. Click OK.
4. On the Connection menu, click Bind. Type valid credentials if your current credentials are not sufficient to query all of the global catalog contents. Click OK.
5. On the View menu, click Tree. Type the distinguished name of the forest root. Click OK.
6. Right-click the forest root in the tree list, and then click Search.
7. Create a filter of the following form:

   ([attribute]=[value])

   Substitute appropriate data for [attribute] and [value]. For example, to create a filter to return results where the sAMAccountName attribute has a value that is set to a user account named "testuser", type (sAMAccountName=testuser) in the Filter box. The cn, the userPrincipalName, the sAMAccountName, the name, the mail, and the sn attributes are good candidates for finding a user object. For group objects, use cn, sAMAccountName, or name. Note that you can use asterisks (*) in the [value] field if required.
   
   For more information on Lightweight Directory Access Protocol (LDAP) filter syntax, visit the following Microsoft Web site:

   http://msdn.microsoft.com/library/default.asp?url=/library/en-us/adsi/adsi/search_filter_syntax.asp

8. Click Subtree as the search scope.
9. Click Options. In the Search Options dialog box, move to the end of the Attributes control.
10. Append objectGUID; to the list. Click OK.
11. Click Run to run the query.
12. View the results. You must identify which of the displayed objects should be removed from the global catalog. One indication that you have found a bad object is that the object does not exist on a read/write copy of the naming context.
13. If it is required, rephrase the query and run it again.
14. If you have identified the lingering object, note its distinguished name and objectGUID.

For few objects

1. Log on to each global catalog server that has the hotfix installed (and that contains a copy of the lingering object) by using Enterprise Administrator credentials.
2. Start Ldp.exe and connect to port 389 on the local domain controller (leave the Server box empty).
3. On the Connection menu, click Bind. Leave all of the boxes empty (you are already logged on as an Enterprise Administrator).
4. On the Browse menu, click Modify.
5. Leave the Dn box empty.
6. In the Attribute box, type RemoveLingeringObject.
7. Type <GUID= as the value.
8. Append the GUID of the domain controller that you obtained from the command repadmin /showreps dcname earlier.
   
   Note In this example, dcname is a domain controller that hosts the writable naming context of the lingering object.
9. Append > : <GUID=. Do not omit the spaces.
10. Append the GUID of the lingering object.
11. Append >.
12. The complete value should look similar to:

    <GUID=85dd0fee-de1b-461c-b9c0-27e9e8249484> : <GUID=eeeb70e5-4501-4895-a572-94a87e8f8ac7>

13. Click the Replace operation, and then click Enter on the interface. Now the command appears in the Entry list.
14. Click Run to run the request. The right side of the Ldp.exe window contains the result of the request. It should look similar to this:

    ***Call Modify...
    ldap_modify_s(ld, '(null)',[1] attrs);
    Modified "".

For many objects

1. Paste the following text below into a new file named Walkservers.cmd in a new folder:

   for /f %%j in (server-list.txt) do walkobjects %%j

2. Paste the following text into a file named Walkobjects.cmd:

   for /f "delims=@" %%i in (object-list.txt) do cscript //NoLogo MODIFYROOTDSE.VBS %1 "%%i" >>update-%1.log

   
   
   Note This is a single command line. Line breaks are inserted here for readability.
3. Paste the following text into a file named Modifyrootdse.vbs:

   '********************************************************************
   '*
   '* File:        MODIFYROOTDSE.VBS
   '* Created:     January 2002
   '* Version:     1.0
   '*
   '* Main Function: Writes Active Directory information to clean up 
   '* objects as per: Q314282.
   '* Usage: Modifyrootdse.vbs <TargetServer> <GUID PAIR>
   '* Parameter are fed into the script using a pair of batch files.
   '*
   '* Copyright (C) 2002 Microsoft Corporation
   '*
   '********************************************************************
   
   OPTION EXPLICIT
   ON ERROR RESUME NEXT
   
   Dim objDomain
   Dim ObjValue, strServerName, adsLdapPath 
   Dim i
   
   'Get the command-line arguments
       if Wscript.arguments.count <> 2 Then
        Print "Invalid Number of Parameters. Use with WalkServers.CMD and WalkObjects.CMD"
       WScript.quit
   End If
   
       strServerName = Wscript.arguments.item(0)
       ObjValue = Wscript.arguments.item(1)
   
       adsLdapPath = "LDAP://" & strServerName & "/RootDSE"
   
       Set objDomain = GetObject(adsLdapPath)
       If Err.Number <> 0 Then
           WScript.Echo "Error opening ROOTDSE. Error number is: " & Err.Number & ". Error description is: " & Err.Description & "."
       Set objDomain = Nothing
           WScript.quit
       End If
   
       objDomain.Put "RemoveLingeringObject", ObjValue
       objDomain.Setinfo
   
       If Err.Number = 0 Then
          WScript.Echo "Object " & ObjValue & " was removed."
   Else
          WScript.Echo "Object " & ObjValue & " could not be removed. Error number is: " & Err.Number & ". Error description is: " & Err.Description & "."
       End If
   WScript.Quit
   						

   NOTE: If you start Modifyrootdse.vbs manually, make sure to enclose in quotation marks any parameters that contain spaces.
   
   
4. Create a list of all of the global catalog servers that contain the lingering objects. Place the server names in a Server-list.txt file in the same folder. Use the fully qualified domain names to avoid DNS suffix searches.
5. Add the GUID pairs that you obtained earlier in this procedure to an Object-list.txt file. Add one pair per line. Use the following syntax:

   <GUID = DC GUID> : <GUID = object GUID>

   A sample entry looks resembles the following:

   <GUID=85dd0fee-de1b-461c-b9c0-27e9e8249484> : <GUID=eeeb70e5-4501-4895-a572-94a87e8f8ac7>

   Here, the first value is the GUID of the writable domain controller that is used to confirm that the original object no longer exists. The second value is the GUID of the lingering object to be removed.
6. Run the Walk-servers.cmd file. The scripts generate a log file that is named Update-server-name.log for each global catalog server that is listed in the Server-list.txt file. The log files contain a line for each object that is to be deleted.

• Make sure that the domain controller GUIDs are the correct GUIDs for domain controllers that contain a writable copy of the domain that contains the object.
• Make sure that the object GUIDs identify lingering objects in global catalog (read-only) naming contexts.
• Verify that the hotfix is installed on all of the domain controllers and global catalog servers that you use in this procedure. Verify that you restarted the servers after you installed the hotfix.

Error message when running Walkservers.cmd to modify many lingering objects in the environment

Cause

Example

ldap_search_s(ld, "DC=company,DC=local", 2, "(cn=User*)", attrList,  0, &msg)
Result <0>: (null)
Matched DNs: 
Getting 4 entries:
>> Dn: CN=User\, Joe,OU=Exec,OU=Corporate Users,DC=corp,DC=company,DC=local
	1> canonicalName: corp.company.local/Corporate Users/Exec/User, Joe; 
	1> cn: User, Joe; 
	1> description: CEO; 
	1> displayName: User, Joe; 
	1> distinguishedName: CN=User\, Joe,OU=Exec,OU=Corporate Users,DC=corp,DC=company,DC=local; 
	4> objectClass: top; person; organizationalPerson; user; 
	1> objectGUID: 814226ed-3414-4193-b96d-3a5ea4bf9351; 
	1> name: User, Joe; 
>> Dn: CN=User\, Joe,OU=Migration,DC=corp,DC=company,DC=local
	1> canonicalName: corp.company.local/Migration/User, Joe; 
	1> cn: User, Joe; 
	1> description: Disabled Account; 
	1> displayName: User, Joe; 
	1> distinguishedName: CN=User\, Joe,OU=Migration,DC=corp,DC=company,DC=local; 
	4> objectClass: top; person; organizationalPerson; user; 
	1> objectGUID: 514f7510-451a-4297-8129-9b4c8ab79axx; 
	1> name: User, Joe; 

<GUID=c4fd9c30-b433-40a1-a862-9fdf1f804dc8> : <GUID=514f7510-451a-4297-8129-9b4c8ab79a7c>