#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Lingering objects and replication event 1988
    Fix   : Identify and remove the lingering objects
    Source: https://jbtecwiz.com/support/srv-id-lingering

    Run as     : Elevated PowerShell
    Expect     : 90 minutes
    Risk       : high
    Reversible : NO -- read the undo note below before running

    WHEN THIS IS THE RIGHT FIX
    The controller is otherwise healthy and you want to keep it.

    HOW TO UNDO IT
    Removed objects are gone. Restore from a system state backup if the
    wrong objects were removed.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # <source-DC-GUID> from the write-up. PowerShell prompts for this
    # by name if you do not pass it on the command line.
    [Parameter(Mandatory = $true)][string]$sourceDCGUID,
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 6"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Lingering objects and replication event 1988' -ForegroundColor White
Write-Host '  Identify and remove the lingering objects' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: high   NOT REVERSIBLE   90 minutes' -ForegroundColor Yellow
Write-Host ''
Show-Prose 'Undo: Removed objects are gone. Restore from a system state backup if the wrong objects were removed.' 'Yellow'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Find the tombstone lifetime for this forest -- it governs everything below.' -Command {
    Get-ADObject -Identity "CN=Directory Service,CN=Windows NT,CN=Services,$((Get-ADRootDSE).configurationNamingContext)" -Properties tombstoneLifetime | Format-List tombstoneLifetime
}

Invoke-Step -Number 2 -Do 'Check the replication state to see which partners are blocked.' -Command {
    repadmin /replsummary
    repadmin /showrepl * /csv | ConvertFrom-Csv | Where-Object 'Number of Failures' -gt 0 | Format-Table
}

Invoke-Step -Number 3 -Do 'List the lingering objects without removing anything -- the /advisory_mode flag is what makes this safe.' -Why 'Advisory mode writes event 1946 for every object it would remove, into the Directory Service log. Read that list before running it for real -- this is a deletion and it is not reversible.' -Command {
    repadmin /removelingeringobjects DC02 $sourceDCGUID dc=example,dc=local /advisory_mode
}

Invoke-Step -Number 4 -Do 'Read the resulting events to see exactly what would go.' -Command {
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 200 | Where-Object Id -in 1938,1942,1946 | Format-List TimeCreated,Id,Message
}

Invoke-Step -Number 5 -Do 'Remove them once the list is understood.' -Command {
    repadmin /removelingeringobjects DC02 $sourceDCGUID dc=example,dc=local
}

Invoke-Step -Number 6 -Do 'Re-enable strict replication consistency so this cannot recur silently.' -Command {
    repadmin /regkey * +strict
    repadmin /replsummary
}

Write-Rule "  Confirm it worked"
Show-Prose 'Replication resumes with no failures and no further 1988 events.' 'White'
Write-Host ''
if (-not $DryRun) {
    repadmin /replsummary; repadmin /showrepl DC02
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/srv-id-lingering' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Removed objects are gone. Restore from a system state backup if the wrong objects were removed.' 'DarkGray'
Write-Rule