1694 error - "Active Directory Domain Services could not update the following object with an attribute value change received from the following source directory service" after adding "Manager" (under Organization Tab) to user object

we get replication errors when updating manager field on random user objects

it not related particular problem domain controller (it moves around other dcs).

we updating manager field via batch script had blank them out in order fix replication.  problem occurs when updating manager field via gui (aduc)….so isolates scripting related errors equation.

we have 4 2008r2 dcs (functional level 2008r2) , there no other active directory issues.....everything revolves around 1 "manager" field under user object's organizational tab.

---

david w king

update:  determined there manager field corruption on undetermined subset of user objects on 1 or 2 of our dcs.  though objects on our dcs showed manager field <unset>....some of them were really "jacked up" , problem reared ugly  when tried set object other "blank"....at time replication stop , we'd have clear them on again.  clearing of course cleared on dcs replicating each other....it never fixed core corruption field on problem dcs in question.

fix:  ran powershell script clear manager field on each , every dc targeting each , every dc (yes this shouldn't ever necessary if replication working)

see script below. 

note: must install quest ad tools first.

-----------------------------------------------------

ctrl script

--------------------------

## blank manager field fix corruption issues

## controls multi-threading

## initialize variables

$basepath =  "c:\scripts"

$inputpath = "$basepath\input\"

$outputpath = "$basepath\output\"

$tstamp = get-date -f yyyymmdd_hhmm

$inputfilename = "newaccts.csv"

$outputfilename = "blankmanager-$tstamp.txt"

$subscript =  "blankmanagerm.ps1"

$inputstr = $inputpath+$inputfilename

$outputstr = $outputpath+$outputfilename

$subscriptstr = "$basepath\$subscript"

$maxjobs=30

$jc = 0

$uc = 0

$erroractionpreference="silentlycontinue"

## read csv file

$users=get-qaduser -searchroot "<context removed>" -service msdc3 -includedproperties samaccountname,dn -sizelimit 0

$us = $users.length

## start processing loop

write-host -fore red "processing....."

"----------------------------------------------------------------------------------"  | out-file $outputstr

"$tstamp"  | out-file $outputstr -append

"----------------------------------------------------------------------------------"  | out-file $outputstr -append

foreach ($user in $users) {

                $uc++

                {

                                $rc=@(get-job -state running).count

                                $currname=$user.samaccountname

                                "$currname --> $rc -- $uc of $us"

                                ## uncomment next line if want space things out bit if worried overwhelming dcs

## start-sleep -seconds 2

                } until (@(get-job -state running).count -le $maxjobs)

               

                start-job -filepath $subscriptstr -argumentlist $user, $outputstr

}

remove-job

## end

processing script

-------

$user = $args[0]

$outputstr = $args[1]

if (-not (get-pssnapin quest.activeroles.admanagement)) {

    add-pssnapin quest.activeroles.admanagement

}

$dcs = @("dc1","dc2","dc3","dc4")

$reccnt = $users.length

$cnt = 0

                $sama = $user.samaccountname

                $dn = $user.dn

                "$sama, $dn"

                foreach ($dc in $dcs) {

                                if (set-qaduser -service $dc -identity $sama -objectattributes @{manager=$null}) {

                                                "$dn --> $dc = successful" | out-file $outputstr -append

                                } else {

                                                "$dn --> $dc = failed" | out-file $outputstr -append

                                }

                }

---

david w king

Windows Server  >  Directory Services