#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Lingering objects and replication event 1988
    Fix   : Demote and rebuild rather than repair
    Source: https://jbtecwiz.com/support/srv-id-lingering

    Run as     : Elevated PowerShell
    Expect     : 3-4 hours
    Risk       : high
    Reversible : NO -- read the undo note below before running

    WHEN THIS IS THE RIGHT FIX
    The controller was offline far beyond the tombstone lifetime. This is
    usually the right answer and it is often faster.

    HOW TO UNDO IT
    None. Ensure a current system state backup of a healthy controller
    exists before starting.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 6"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Lingering objects and replication event 1988' -ForegroundColor White
Write-Host '  Demote and rebuild rather than repair' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: high   NOT REVERSIBLE   3-4 hours' -ForegroundColor Yellow
Write-Host ''
Show-Prose 'Undo: None. Ensure a current system state backup of a healthy controller exists before starting.' 'Yellow'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Take it off the network first so it cannot replicate anything outward while you work.' -Manual

Invoke-Step -Number 2 -Do 'Move any FSMO roles it holds to a healthy controller, and check it is not the only global catalog or DNS server for a site.' -Command {
    netdom query fsmo
    Get-ADDomainController -Filter * | Format-Table Name,Site,IsGlobalCatalog,OperationMasterRoles
}

Invoke-Step -Number 3 -Do 'Demote it forcibly, since it cannot replicate the demotion out.' -Why 'A forced demotion does not tell the rest of the domain. That is why the metadata cleanup in the next step is mandatory rather than tidy-up -- without it, every other controller keeps trying to replicate with a machine that no longer exists.' -Command {
    Uninstall-ADDSDomainController -ForceRemoval -DemoteOperationMasterRole -LocalAdministratorPassword (Read-Host -AsSecureString) -Force
}

Invoke-Step -Number 4 -Do 'Clean the metadata from a healthy controller.' -Command {
    Get-ADObject -Filter { Name -eq 'DC03' } -SearchBase (Get-ADDomain).DomainControllersContainer | Remove-ADObject -Recursive -Confirm:$false
}

Invoke-Step -Number 5 -Do 'Rebuild the machine from clean media and promote it again.' -Command {
    Install-ADDSDomainController -DomainName example.local -InstallDns -Credential (Get-Credential) -SafeModeAdministratorPassword (Read-Host -AsSecureString)
}

Invoke-Step -Number 6 -Do 'Verify the new controller replicates in both directions before putting it into service.' -Command {
    repadmin /showrepl
    dcdiag /v | Select-String 'failed|passed test'
}

Write-Rule "  Confirm it worked"
Show-Prose 'dcdiag is clean, replication succeeds both ways, and SYSVOL is shared.' 'White'
Write-Host ''
if (-not $DryRun) {
    dcdiag /test:sysvolcheck /test:advertising /v | Select-String 'passed|failed'
    net share | findstr /i sysvol
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/srv-id-lingering' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: None. Ensure a current system state backup of a healthy controller exists before starting.' 'DarkGray'
Write-Rule