NTDS ISAM 467 database corruption

low40p · Guest

Hi

I have this event id NTDS ISAM 467 database corruption error nightmare
about some days ago and I can not get rid of it :(

All DC's are Windows Server 2003 SP2, I have 3 sites. In every site I have 2
DC's. All DC's are GC. At site A is located FSMO DC and Exchange 2003 std.
server. On DC's at this site A I do not have 467 errors. These error is
showing up only on DC's at sites B and C. But detailes of descrpition of
these error I did not see after searching.

Here is the error:
Event Type: Error
Event Source: NTDS ISAM
Event Category: Database Corruption
Event ID: 467
Description:
NTDS (416) NTDSA: Index LCL_ABVIEW_index0000081A of table datatable is
corrupted (0).

After that 467 error I received also these errors:

Event Type: Warning
Event Source: NTDS General
Event Category: Internal Processing
Event ID: 1173
User: NT AUTHORITY\ANONYMOUS LOGON
Description:
Internal event: Active Directory has encountered the following exception and
associated parameters.

Exception:
e0010004
Parameter:
0

Additional Data
Error value:
-1414
Internal ID:
2080490

and error 2041 also internal processing. After that error I have:

Event Type: Error
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1084
User: NT AUTHORITY\ANONYMOUS LOGON
Description:
Internal event: Active Directory could not update the following object with
changes received from the following source domain controller. This is because
an error occurred during the application of the changes to Active Directory
on the domain controller.

Object:
CN=username\0ADEL:dfdd5116-b09d-4f6b-9721-59e93a04379c,CN=Deleted
Objects,DC=domain,DC=sld,DC=tld
Object GUID:
dfdd5116-b09d-4f6b-9721-59e93a04379c
Source domain controller:
2dda290a-fa20-465b-9546-2bb42feaae8a._msdcs.domain.sld.tld

Synchronization of the local domain controller with the source domain
controller is blocked until this update problem is corrected.

This operation will be tried again at the next scheduled replication.

User Action
Restart the local domain controller if this condition appears to be related
to low system resources (for example, low physical or virtual memory).

Additional Data
Error value:
8451 The replication operation encountered a database error.

Event Type: Error
Event Source: NTDS Replication
Event Category: Replication
Event ID: 2108
User: NT AUTHORITY\ANONYMOUS LOGON
Description:
This event contains REPAIR PROCEDURES for the 1084 event which has
previously been logged. This message indicates a specific issue with the
consistency of the Active Directory database on this replication destination.
A database error occurred while applying replicated changes to the following
object. The database had unexpected contents, preventing the change from
being made.

Object:
CN=username\0ADEL:dfdd5116-b09d-4f6b-9721-59e93a04379c,CN=Deleted
Objects,DC=domain,DC=sld,DC=tld
Object GUID:
dfdd5116-b09d-4f6b-9721-59e93a04379c
Source domain controller:
2dda290a-fa20-465b-9546-2bb42feaae8a._msdcs.domain.sld.tld

User Action

.... (deleted because is well known ;)

Additional Data
Primary Error value:
8451 The replication operation encountered a database error.
Secondary Error value:
-1414 JET_errSecondaryIndexCorrupted, Secondary index is corrupt. The
database must be defragmented

and also errors NTDS KCC 1566, 1311, 1865 about replication and topology.

Only thing I tryed is defragmentation of AD database on PDC Root domain
controler in DSRM mode at site A with ntdsutil and it pass ok without errors.
I did not try semantic analysis etc.

Does anyone have suggestion what to do next ? How can I find faulty DC ? Is
it at site A or on other sites. Is it only solution to build whole domain and
network again ?

So far all network activities are ok, users can log in to network but
replication is blocked.

Jorge Silva · Guest

check if no errors on the Disks or any other hardware, also have a look at
your Antiirus configuration and the possibility of server infection.
Then Some possible solutions:
*Solution1:
Perform restore operation to resolve the issue with your lastest Systate
BACKUPS.

*Solution 2:
In case this is not the only DC in the domain, you can simply rebuild it.
At the same time, you will need to perform the steps below before
re-promoting the server:
1. Seize FSMO roles to the existing DC in the domain. For the detailed
steps, you can refer to the following Microsoft Knowledge Base article:
Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
http://support.microsoft.com/?id=255504
2. Remove remnant entries of the corrupted DC from AD database.
How to remove data in Active Directory after an unsuccessful domain
controller demotion
http://support.microsoft.com/?id=216498
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services
"low40p" <low40p@discussions.microsoft.com> wrote in message
news:0D236337-5209-4114-A9A1-3703853821B5@microsoft.com...