repadmin /removelingeringobjects

Here's one for you AD guys out there. Maybe my approach is all wrong...

I want to run repadmin /removelingeringobjects for all my DCs going to one
other DC. To do that, I need to run the command once for every NTDS object.
So I create a collection of the NTDS objects (note: I'm using Quest's
ActiveRoles cmdlets):

$colNtdsObjs = get-qadobject -searchroot
'CN=Sites,CN=Configuration,DC=myforest,DC=com'

To verify I got what I need, I see if I can return all the GUIDs (this is in
a test forest, so these aren't my actual production DC GUIDs):

$colNtdsObjs | %{write-host $_.guid}

d2ccf1fc-f976-4960-86be-eb447b52cb70
29213079-c590-4620-ac19-ffb26d6629fb
e090823d-31a6-4885-87fc-ed6a15fa7944
7e038d81-642e-4a8d-be45-be7f64d8a7e0
75ad6344-cf22-4db3-ba6e-94ad6bde4f2e
8a863f3b-0616-4159-8daa-69528d7ce991
73a86a5f-de47-4cf8-8409-085c062ec989
4d1cf290-1fd5-46fe-baee-629cc946bc71
0e192f87-5ff5-440c-9e72-baef262a83d2
1cf95256-30ba-4745-9885-eedfddd409c7
62a74862-37c5-4e99-9cd3-21f17230585e
946df72d-accb-4241-8f50-b763ee62841d
63434741-b56e-4534-9619-6570ead1afe5
0c1bda8b-e665-4b60-b502-9a96b55110ad
b90231d1-90bd-4bfb-a81c-983f6812d69b
b80855eb-59ea-405e-bf63-d1bb3cab0de2
93d25a1c-f703-4e91-9213-bff44025a12c
4844923b-70c6-46f0-923d-1c647c6882ba
a3ceb37f-1c34-4930-ab53-e4da62b78071
0a3e6cde-67ce-4e3b-b5c4-12f8c4c6983a
e8a76464-aa9b-4b47-8712-6c307351d4ce
f62a86dd-0acd-47c0-8cf3-66715b3e15e8
80ec2e77-273d-4664-9958-83eaf97b83ed
e23a8fd1-0734-4d42-af63-ea2d0956f182

Ok so there are all the GUIDs. Fantastic. Now I want to run the repadmin
command for each of those:

$colNtdsObjs | %{repadmin /removelingeringobjects DC1
$_.guidDC=mydomain,DC=com /advisory_mode}

I get 'Invalid Arguments' returned for each iteration.

Any thoughts on this?

Try:

$colNtdsObjs | foreach { repadmin "/removelingeringobjects" DC1 "$_.guidDC=mydomain,DC=com"
"/advisory_mode"}

If it doesn't work, try with the Call operator

$colNtdsObjs | foreach {& repadmin "/removelingeringobjects" DC1 "$_.guidDC=mydomain,DC=com"
"/advisory_mode"}


HTH

Shay
http://scriptolog.blogspot.com

Thanks for the reply. I tried both those options and still get 'Invalid
Arguments." I did try a write-host of the command as assembled in the
for-each and it comes out the way it should look. I also tried running a few
of them individually (copy and pasted) and they do work.


"Shay Levi" wrote:

I think the GUID is invalid
Try to change it to "CN=$($_.guidDC),DC=mydomain,DC=com"




Shay
http://scriptolog.blogspot.com

Sorry, I meant DistinguishedName (insted of GUID)

Shay
http://scriptolog.blogspot.com

No this command uses the GUID of the NTDS Settings object. See:

http://technet2.microsoft.com/window....mspx?mfr=true

And as I said earlier, to check what the foreach produces, I did a
write-host and put the command in quotes and it produced this:

repadmin /removelingeringobjects DC1 d2ccf1fc-f976-4960-86be-eb447b52cb70
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 29213079-c590-4620-ac19-ffb26d6629fb
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 e090823d-31a6-4885-87fc-ed6a15fa7944
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 7e038d81-642e-4a8d-be45-be7f64d8a7e0
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 75ad6344-cf22-4db3-ba6e-94ad6bde4f2e
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 8a863f3b-0616-4159-8daa-69528d7ce991
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 73a86a5f-de47-4cf8-8409-085c062ec989
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 4d1cf290-1fd5-46fe-baee-629cc946bc71
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 0e192f87-5ff5-440c-9e72-baef262a83d2
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 1cf95256-30ba-4745-9885-eedfddd409c7
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 62a74862-37c5-4e99-9cd3-21f17230585e
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 946df72d-accb-4241-8f50-b763ee62841d
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 63434741-b56e-4534-9619-6570ead1afe5
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 0c1bda8b-e665-4b60-b502-9a96b55110ad
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 b90231d1-90bd-4bfb-a81c-983f6812d69b
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 b80855eb-59ea-405e-bf63-d1bb3cab0de2
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 93d25a1c-f703-4e91-9213-bff44025a12c
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 4844923b-70c6-46f0-923d-1c647c6882ba
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 a3ceb37f-1c34-4930-ab53-e4da62b78071
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 0a3e6cde-67ce-4e3b-b5c4-12f8c4c6983a
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 e8a76464-aa9b-4b47-8712-6c307351d4ce
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 f62a86dd-0acd-47c0-8cf3-66715b3e15e8
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 80ec2e77-273d-4664-9958-83eaf97b83ed
DC=mydomain,DC=com /advisory_mode
repadmin /removelingeringobjects DC1 e23a8fd1-0734-4d42-af63-ea2d0956f182
DC=mydomain,DC=com /advisory_mode

And I ran a couple of those individually and got the correct results.

Thanks,
Ryan



"Shay Levi" wrote:

I think maybe there is a little confusion on how repadmin works.

The Syntax of the command is so
repadmin /removelingeringobjects ServerName ServerGUID DirectoryPartition
/advisory_mode
===================================================================
ServerName = The DNS name or the distinguished name of the domain controller
that has or might have lingering objects.
ServerGUID = The GUID of a domain controller that has an up-to-date writable
replica of the directory partition
DirectoryPartition = The distinguished name of the domain directory
partition that might have lingering objects
===================================================================

You just need one GUID as a "master" . The GUID should be the GUID of a
known good DC. Then you loop through the DNS names.

btw... I am working on a Powershell version of repadmin so stay tuned to my
blog www.bsonposh.com


"Ryan" <Ryan@xxxxxx> wrote in message
news:C975B2AF-809B-4461-9350-B542E9B3BC95@xxxxxx

Any errors in the event log?

Shay
http://scriptolog.blogspot.com

/removelingeringobjects can be used to detect and remove lingering objects
from a directory partition
when source and destination domain controllers are Windows Server 2003.

Syntax:
repadmin /removelingeringobjects <Dest_DC_LIST> <Source DCGUID> <NC> [/ADVISORY_MODE]

Common Syntax:
repadmin /removelingeringobjects <Dest_DC_LIST> <Source DCGUID> <NC>

Dest_DC_LIST - DC suspected to have lingering objects
Source DCGUID - Source DC GUID used to compare with the suspected DC
NC - Specifies the distinguished name of the directory partition
ADVISORY_MODE - Read-only mode.

As Brandon said, you need only one source DC and a list of Destination DCs

I'll try to find out more on this, my environment is not so full of DCs

Shay
http://scriptolog.blogspot.com