Windows Server  ·  critical  ·  Active Directory deep faults

USN rollback — event 2095 and a controller that stops replicating

A domain controller was restored by a method that does not understand Active Directory, so its update sequence numbers went backwards. Replication is disabled to protect the domain.

What you see

Event 2095 in the Directory Service log, inbound and outbound replication disabled on that controller, and objects that exist there and nowhere else.

What is actually wrong

A virtual machine snapshot rolled back, a disk image restored, or a P2V conversion of a live controller. Any of these can reuse USNs the domain has already seen.

Codes and articles

Event 2095USN rollbackEvent 2103replication has been disabledEvent 1113

The fix

Take it out of service and rebuild it
Elevated PowerShell3–4 hourshigh risknot reversible

Event 2095 has been logged. There is no supported repair; this is the procedure.

  1. Disconnect the affected controller from the network immediately.

    Objects created on it since the rollback exist nowhere else, and objects deleted elsewhere may still exist on it. Every minute it stays connected increases the divergence.

  2. Confirm the diagnosis.

    PowerShell
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 100 | Where-Object Id -in 2095,2103,1113 | Format-List TimeCreated,Id,Message

  3. Identify anything created on this controller since the rollback, so it can be recreated afterwards.

    PowerShell
    Get-ADObject -Filter { whenCreated -gt $((Get-Date).AddDays(-7)) } -Properties whenCreated,whenChanged | Format-Table Name,ObjectClass,whenCreated

  4. Check whether it holds any FSMO roles or is the only global catalog for its site.

    PowerShell
    netdom query fsmoGet-ADDomainController -Filter * | Format-Table Name,Site,IsGlobalCatalog,OperationMasterRoles

  5. Force-demote it, clean the metadata from a healthy controller, then rebuild and re-promote from clean media.

    PowerShell
    Uninstall-ADDSDomainController -ForceRemoval -Force -LocalAdministratorPassword (Read-Host -AsSecureString)

  6. Change how this controller is backed up. Snapshots are not a backup for a domain controller — use Windows Server Backup with system state, or a backup product that is Active Directory aware and uses the VM Generation ID.

    Without changing the backup method, this will happen again the next time somebody rolls back a snapshot to test something. That is by far the most common cause.

Confirm it workedThe rebuilt controller replicates in both directions and no 2095 events appear.
PowerShell
repadmin /replsummaryGet-WinEvent -LogName 'Directory Service' -MaxEvents 50 | Where-Object Id -eq 2095 | Measure-Object
If you need to undo itNone. This is a rebuild by design.

Related faults

Lingering objects and replication event 1988Windows ServerAD replication error 8524 — the DSA operation cannot continue (DNS lookup failure)Windows ServerError 1722 — the RPC server is unavailableWindows ServerDNS event 4013 — waiting for Active Directory to signal it has completed initial synchronisationWindows ServerNTDS events 2087 and 2088 — DNS lookup failure caused replication to failWindows Server

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.