Repadmin /replsum (8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.

In my production environment, when I perform "repadmin /replsum", I get the following error from one of my domain controller.

(8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.

Remark: This is the example of my production domain controllers.

Then, I perform "repadmin /showrepl".

There is a problem of ForestDnsZones in CONDC01.

I checked the Event log of Directory Services. I found there are a lot of event logs which are Event ID 1988 in CONDC02.

By default, Windows Server 2003 SP1 or later which is a domain controller is enabled "Strict Replication" to prevent to replicate the lingering objects.

For more information about "Strict Replication", please read the following web sites.

Enable Strict Replication Consistency (Windows Server 2008 or Windows Server 2008 R2)

http://technet.microsoft.com/en-us/library/cc816938(WS.10).aspx

Enable Strict replication consistency (Windows Server 2003)

http://technet.microsoft.com/en-us/library/cc784245(WS.10).aspx

Then, I followed the KB2028495 to try to fix the problem of the DC, CONDC01.

According to KB2028495, there are some Lingering objects in the Forest DNS Zones of CONDC01.

For more information about "Lingering objects", please read the following web sites.

Information about lingering objects in a Windows Server Active Directory forest

http://support.microsoft.com/kb/910205/en-us

Lingering Objects

http://blogs.dirteam.com/blogs/jorge/archive/2006/05/08/Lingering-objects.aspx

Then, I perform "repadmin /removelingeringobjects CONDC01 1fcb48fb-c7f7-4281-9fcc-10987772ae9a  DC=ForestDnsZones, DC=CORP,DC=CONTOSO,DC=COM /advisory_ mode" in CONDC02 to detect the lingering objects in CONDC01.

Example: "repadmin /removelingeringobjects <Bad DC> <GUID of DC with correct data> <Naming Context of the lingering objects partition> /advisory_mode

Remark: "1fcb48fb-c7f7-4281-9fcc-10987772ae9a" is the GUID of CONDC02.

There are a lot of Event log of Directory Services in CONDC01. The Event ID is 1946.

It means the lingering object is detected.

When the detection finished, there is an event log with the Event ID 1942 in Directory Services.

Back to CONDC02, I perform "repadmin /removelingeringobjects CONDC01 1fcb48fb-c7f7-4281-9fcc-10987772ae9a DC=ForestDnsZones, DC=CORP,DC=CONTOSO,DC=COM" to delete the lingering objects in CONDC01.

Back to CONDC01, there are a lot of Event log of Directory Services. The Event ID is 1945.

When all the lingering objects were deleted, there is an event log with the Event ID 1939 in Directory Services.

After all lingering objects were deleted, the AD replication resumed normal in my production environment.

Reference:

Clean that Active Directory forest of lingering objects

http://blogs.technet.com/b/glennl/archive/2007/07/26/clean-that-active-directory-forest-of-lingering-objects.aspx

Lingering objects

http://blogs.dirteam.com/blogs/jorge/archive/2006/05/08/Lingering-objects.aspx

This posting is provided “AS IS” with no warranties, and confers no rights!