| Event Id | 1937 |
| Source | NTDS |
| Description | Lingering Object Removal has been initiated on this domain controller (DC). All objects on this DC will have their existence verified on the following source DC. Objects that have been deleted and garbage collected from the source DC will be DELETED from this DC if they still exist.Subsequent event logs will list all deleted objects.Source DC: Source_domain_controller_GUID._msdcs.forest_root |
| Event Information | According to Microsoft: CAUSE: This issue occurs if the source domain controller has outdated objects that have been out of replication for more than one tombstone lifetime. The source domain controller is identified in the event message. These outdated objects are referred to as lingering objects. A domain controller that was offline for longer than the value of the tombstone lifetime setting may contain objects that have been deleted on other domain controllers or global catalog servers. The default tombstone lifetime value is 60 days. Additionally, tombstones for these objects may no longer exist. When you bring the outdated domain controller back online, it cannot be notified of the object deletions. RESOLUTION: To resolve this issue, you can use the Repadmin tool to remove lingering objects from a directory partition. The repadmin /removelingeringobjects command does the following: 1. Designates an up-to-date domain controller as the authority. This domain controller acts as the authoritative directory replica. 2. Compares the Active Directory Directory service database objects on the authoritative server with the objects that are on the source replication partner that contains the lingering objects. 3. Either removes the lingering objects or logs the potential deletions to the Directory Services event log. The behavior depends on whether you use the /advisory_mode parameter. To use the repadmin /removelingeringobjects command, follow these steps. 1. Install the Repadmin tool. The Repadmin tool is included with the Windows Server 2003 Support Tools that are included with the Windows Server 2003 CD-ROM. To install the support tools, double-click Suptools.msi in the CD_Drive:\Support\Tools folder. 2. At the command prompt, type repadmin /removelingeringobjects Destination_domain_controller Source_domain_controller_GUID Directory_partition /advisory_mode, and then press ENTER. • Destination_domain_controller is the do |
| Reference Links | Outdated Active Directory objects generate event ID 1988 in Windows Server 2003 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.