Stopping Continuous Event 1955 and 1083

Hi:

On one of my domain controllers we repeatedly get 1955 and 1083 events on a
particular user account. The actual user complains that his account gets
locked out and then unlocks itself. We are running 2003 sp2 in Windows 2003
domain and forrest. I've couldn't find any duplicate accounts and also have
tried moving the account to another OU and did a sync to the DC's replication
partner.

Any ideas on how I could remove/delete this continuing DS_Writ on the source
domain controller? I don't know if there is a way to enter the directory to
see outstanding writes and just delete it. Or maybe need to go into ntdsutil
and make the account and all of its properties authoritative on the
destination domain controller thinking that would kill the request coming
from the other domain controller?

Thanks in advance.

Charles

Meinolf
Thu Jun 19 15:13:01 PDT 2008

Hello Charles,

Start here:
http://www.eventid.net/display.asp?eventid=1083&eventno=919&source=NTDS%20Replication&phase=1

http://www.eventid.net/display.asp?eventid=1955&eventno=4301&source=NTDS%20Replication&phase=1

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hi:
>
> On one of my domain controllers we repeatedly get 1955 and 1083 events
> on a particular user account. The actual user complains that his
> account gets locked out and then unlocks itself. We are running 2003
> sp2 in Windows 2003 domain and forrest. I've couldn't find any
> duplicate accounts and also have tried moving the account to another
> OU and did a sync to the DC's replication partner.
>
> Any ideas on how I could remove/delete this continuing DS_Writ on the
> source domain controller? I don't know if there is a way to enter the
> directory to see outstanding writes and just delete it. Or maybe need
> to go into ntdsutil and make the account and all of its properties
> authoritative on the destination domain controller thinking that would
> kill the request coming from the other domain controller?
>
> Thanks in advance.
>
> Charles
>

Charles
Sun Jun 22 07:43:01 PDT 2008

Thanks for the links. I'm actually thinking that this is due to intersite
replicaiton configuration. We have a few slow site to site communication
links that could be making us have lots of collisions.

"Meinolf Weber" wrote:

> Hello Charles,
>
> Start here:
> http://www.eventid.net/display.asp?eventid=1083&eventno=919&source=NTDS%20Replication&phase=1
>
> http://www.eventid.net/display.asp?eventid=1955&eventno=4301&source=NTDS%20Replication&phase=1
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > Hi:
> >
> > On one of my domain controllers we repeatedly get 1955 and 1083 events
> > on a particular user account. The actual user complains that his
> > account gets locked out and then unlocks itself. We are running 2003
> > sp2 in Windows 2003 domain and forrest. I've couldn't find any
> > duplicate accounts and also have tried moving the account to another
> > OU and did a sync to the DC's replication partner.
> >
> > Any ideas on how I could remove/delete this continuing DS_Writ on the
> > source domain controller? I don't know if there is a way to enter the
> > directory to see outstanding writes and just delete it. Or maybe need
> > to go into ntdsutil and make the account and all of its properties
> > authoritative on the destination domain controller thinking that would
> > kill the request coming from the other domain controller?
> >
> > Thanks in advance.
> >
> > Charles
> >
>
>
>