Active Directory Issue – Event ID 1864

My largest site has 28 DCs spread across Australia and New Zealand.  Some of them are in very remote location as they are a mining company.  I was working on some Exchange 2010 migration with them when I happened to see this error in the event logs of one of my servers.  I further checked and found it in the event logs of ALL of my DCs… This put me into a spin initially as it gave me the impression that each of the DCs had stopped replicating with each other.  It was not til I re-read it AND run the commands suggested that I realised it was in fact just ONE DC that was not replicating.  Coincidentally, one of the very remote sites was affected by the flood.  The site itself is fine, but the comms link to the site was severed in the recent floods in Queensland and Northern New South Wales.  Ok – so the pressures off right?  Nope.  As at 25/1 this error was happening for 15 days.  The default tombstone life in AD is 60 days.  That means we have 45 days to get the link to the site back up and running or else that remote DC will need to be totally rebuilt.  Bad news is that the telco – Telstra have advise that they might not make it in that timeframe.  So plan B is to send a Tech to site, pickup the server and take it 4 hours drive away to the nearest site that does have comms.  We’ll reconfigure it’s IP for that site, and allow it to sync up again for 24 hours before then taking it back to the original site.  Not ideal but it will work.  Hopefully by blogging bout this experience will save someone else the panic attack that I had.

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          25/01/2011 6:06:37 AM
Event ID:      1864
Task Category: Replication
Level:         Error
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      server.domain.local
Description:
This is the replication status for the following directory partition on this directory server.
 
Directory partition:
DC=domain,DC=local
 
This directory server has not recently received replication information from a number of directory servers.  The count of directory servers is shown, divided into the following intervals.
 
More than 24 hours:
1
More than a week:
1
More than one month:
0
More than two months:
0
More than a tombstone lifetime:
0
Tombstone lifetime (days):
60
 
Directory servers that do not replicate in a timely manner may encounter errors. They may miss password changes and be unable to authenticate. A DC that has not replicated in a tombstone lifetime may have missed the deletion of some objects, and may be automatically blocked from future replication until it is reconciled.
 
To identify the directory servers by name, use the dcdiag.exe tool.
You can also use the support tool repadmin.exe to display the replication latencies of the directory servers.   The command is "repadmin /showvector /latency <partition-dn>".