The Ntdsutil.exe Semantic Checker Cannot Rename Conflict-Mangled Phantom Names (814202)

SYMPTOMS

When you use the Ntdsutil.exe go fix command to run the semantic checker on the Ntds.dit database, you may receive a "Manual intervention required" error message in a context that is similar to this:

C:\WINNT\system32>ntdsutil
ntdsutil: sem d a
semantic checker: go fix
Fixup mode is turned on

Opening DIT database... Done.

Fixing conflict mangled name: domainnameCNF:########-####-####-####-#_OLD_GUID_#
Fixing by rename with structural collision.
Could not update "datatable" table: key already exists.
Error<8000ffff>: failed to fix mangled dn domainname. Retrying.

***Manual intervention required***

Error <0>: non mangled name has guid
The phantom currently using name DC=domainname,DC=com has a guid. Remove all references to this phantom. If you believe that the phantom has the wrong guid, try authoritative restore of a good copy of the object that contains the phantom.
Allow garbage collection to run so that this phantom is removed.
The guid of the phantom holding the non-mangled name is ########-####-####-####-#_NEW_GUID_#.
DBG: Rolling back transaction due to error 80004005.
Can't fix Mangled NC
Failed.

For additional information, see the "References" section in this article.

CAUSE

Inbound replication of a new crossRef object is delayed when the nCName value matches an existing object. However, if the nCName value matches an existing phantom, the value may be attached to an old naming context. When later references to the correct (new) naming context are replicated in, the existing name is "mangled" to reflect that the name is in conflict. Previous versions of Ntdsutil.exe cannot detect and repair this specific problem.

For additional information about a preventative update, click the following article number to view the article in the Microsoft Knowledge Base:

810089 Cannot Promote New Global Catalog When Conflict Naming Contexts Exist

RESOLUTION

A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem. This fix may receive additional testing. Therefore, if you are not severely affected by this problem, Microsoft recommends that you wait for the next Windows 2000 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

   Date         Time   Version        Size     File name
   --------------------------------------------------------
   06-Mar-2003  10:26  5.0.2195.6680  165,136  Ntdsutil.exe

Note Use the update that this article describes on the computer that holds the Domain Naming Master role to repair the conflicted phantom. It is a good idea to also deploy this update on all domain controllers. For information about how to determine which computer holds the Domain Naming Master role, see the "How to Identify the Domain Naming Master" section in this article.

MORE INFORMATION

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

How to Identify the Domain Naming Master

Run the Active Directory Domains and Trusts snap-in.
In the left pane, right-click Active Directory Domains and Trusts, and then click Operations Master to view the name of the server that holds the domain naming master role in the current forest.

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

234790 HOW TO: Find Servers That Hold Flexible Single Master Operations Roles

297230 HOW TO: Use the Replication Monitor to Determine the Operations Master and Global Catalog Roles

REFERENCES

For additional information about related problems, click the following article numbers to view the articles in the Microsoft Knowledge Base:

281485 Name Collision in Active Directory Causes Replication Errors

319622 Ntdsutil.exe Semantic Checker "Can't Fix Mangled NC" Error Message in Windows 2000

810089 Cannot Promote New Global Catalog When Conflict Naming Contexts Exist

For additional information about related items, click the following article numbers to view the articles in the Microsoft Knowledge Base:

258310 Viewing Deleted Objects in Active Directory

248047 Phantoms, Tombstones and the Infrastructure Master