Error code: 8606

Question

Insufficient attributes were given to create an object. Replication inconsistency issues

Answer 1

Hello @Hakim Fahadi ,

Active Directory replication error 8606 may indicate replication inconsistencies or lingering objects.

Please run the following commands in an elevated Command Prompt on a domain controller:

repadmin /replsummary
repadmin /showrepl *

Also, check Event Viewer → Windows Logs → Directory Service for related errors, especially Event IDs 1988 and 2042.

Please share the output and any relevant event details so we can identify the cause and recommend the appropriate fix. Avoid deleting objects or forcing replication before confirming the issue.

Microsoft documentation:

• Troubleshoot replication error 8606
• Troubleshoot Active Directory replication

If this information was helpful, please click Accept Answer.

Thank you for choosing Microsoft Q&A.

Answer 2

Error 8606 means a source domain controller is sending an update for an object that was already created, deleted, and then garbage-collected on the destination domain controller, while the destination DC is using strict replication consistency.

Most common interpretation:

• The blocking object is usually on the source domain controller, even though the error is logged on the destination domain controller.
• This is most often caused by lingering objects after long-term replication failures.
• It can also be transient, especially after introducing the first domain controller in a forest or after changes to the partial attribute set.
• Another cause is an object that was undeleted or restored near tombstone lifetime expiration.

Typical symptoms include:

• dcdiag Replications test fails with 8606.
• repadmin /showrepl, /replsum, or /syncall fail with 8606.
• NTDS Replication Event 1988 appears in the Directory Service log.
• Manual Replicate Now can fail with the same message.

Recommended troubleshooting path:

1. Check the Directory Service log on the destination DC for Event 1988 and identify the object GUID referenced there.
2. On the destination DC, run:

      repadmin /showobject "<GUID=object guid from 1988 event>"
   

   If the object is not found on the destination DC but exists on the source DC, that matches the documented 8606 condition.
3. On the source DC, review object metadata with repadmin /showobjmeta and inspect:
   • LastKnownParent
   • IsDeleted
   • their version numbers and date stamps
4. Interpret the metadata:
   • LastKnownParent = 1 indicates the object was deleted.
   • IsDeleted = 2 or another even-numbered value indicates the object was later reanimated or undeleted.
   • If the delete and reanimation timestamps are around tombstone lifetime expiration, the object may have been restored after some DCs already garbage-collected it.
5. Decide whether the object should remain deleted or should exist on all replicas.

Resolution options based on the condition:

• Permanent lingering object: remove it manually. Common tools are:
  • repadmin /removelingeringobjects
  • repadmin /rehost
  • Lingering Object Liquidator (LoL)
• Transient lingering object: wait for the next garbage collection on the source DC, or manually trigger garbage collection.
• Reanimated/restored object near tombstone lifetime: if the object should exist on all replicas, documented options are:
  1. Enable loose replication on strict mode destination DCs that do not have the object.
  2. Force-demote the DCs that already garbage-collected the object.
  3. Delete the object and then re-create it.

Command example for lingering object cleanup:

repadmin /removelingeringobjects <Dest_DSA_LIST> <Source DSA GUID> <NC> [/ADVISORY_MODE]

/ADVISORY_MODE is the safer starting point because it lets the environment be evaluated before removal.

Additional causes to check:

• A DC was offline or failing replication for longer than tombstone lifetime.
• A time jump caused premature garbage collection of deleted objects.
• Partial attribute set updates created temporary lingering objects.
• A USN bubble caused the object state to diverge.

---

• Active Directory Replication Error 8606: Insufficient attributes were given to create an object
• Troubleshoot common Active Directory replication errors