powershell script that performs metadata cleanup and prepares a tombstoned DC for re-promotion?

Hello @Oliver Mitchell

If the DC has been offline longer than the tombstone lifetime and is generating Event ID 2042, I would not try to “repair” it and resume replication with a generic PowerShell cleanup script. Microsoft treats that condition as potentially unsafe because the DC may contain lingering objects and stale replication state. Event ID 2042 specifically exists to stop replication after the tombstone lifetime has been exceeded.

The safer approach is usually:

1. Do not re-enable replication on the stale DC.
2. Confirm that healthy DCs hold the FSMO roles and that DNS/GC services are available elsewhere.
3. Force-demote or remove the stale DC if normal demotion is no longer possible.
4. Perform metadata cleanup from a healthy DC.
5. Remove any remaining DNS, Sites and Services, and replication references.
6. Reinstall/rebuild the server if necessary and promote it again as a new DC.

Microsoft explicitly states that after a forced demotion, metadata cleanup must be performed immediately.

For metadata cleanup, use supported AD tools rather than scripting deletions manually. For example, after you demote/remove the old DC, use Active Directory Users and Computers or Active Directory Sites and Services to delete the old DC object; modern AD tools automatically perform metadata cleanup as part of that deletion. You can then verify with:

repadmin /replsummary
repadmin /showrepl *
dcdiag /e /v

If lingering objects exist on healthy remaining DCs, Microsoft recommends using repadmin /removelingeringobjects or the Lingering Object Liquidator rather than deleting directory objects with custom PowerShell.

So I would avoid a script that tries to automate all of this in one pass. Metadata cleanup, lingering-object removal, and re-promotion are separate operations, and automating object deletion without first identifying the authoritative DC can make the directory inconsistency worse.

If your goal is specifically to reuse the same server name, that is fine after you completely remove the old DC metadata and replication is healthy. Rebuild/rejoin the server, then promote it normally again.

Sharing these references with you:

Microsoft Learn – Active Directory replication Event ID 2042 | https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/active-directory-replication-event-id-2042

Microsoft Learn – Manually remove lingering objects | https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/manually-remove-lingering-objects

Microsoft Learn – Demote domain controllers and domains | https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/demoting-domain-controllers-and-domains--level-200-

If you can share whether the stale DC is still online, already force-demoted, or completely dead, I can give you the exact supported cleanup sequence for that state.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.