Windows 2000 AD Replication Conflict Resolution

Microsoft Windows 2000 Active Directory relies on a multi-master replication model, allowing directory updates to occur on any domain controller. When concurrent modifications occur across different servers, Windows 2000 applies automated conflict resolution rules to maintain directory consistency. This article details the specific mechanisms the operating system uses to resolve attribute updates, object name collisions, and structural directory conflicts without requiring administrative intervention.

Attribute-Level Conflict Resolution

Windows 2000 replicates directory data at the attribute level rather than the object level. Each attribute modification creates replication metadata, which domain controllers compare to determine the winning update. When two domain controllers record conflicting changes to the same attribute, Windows 2000 evaluates three criteria in strict sequential order:

  1. Version Number: Every time an attribute is modified, its Property Version Number (PVN) increments by one. The domain controller compares the version numbers, and the update with the higher version number always wins.
  2. Timestamp: If the version numbers are identical, the domain controller compares the timestamps associated with the changes. The update with the later coordinated universal time (UTC) timestamp wins.
  3. Originating Invocation ID: If both the version numbers and the timestamps match, the system uses a tie-breaker. It compares the globally unique identifiers (Invocation IDs) of the domain controllers where the modifications originated. The change originating from the domain controller with the higher hexadecimal GUID value wins.

The losing update is overwritten and permanently discarded by the winning value across the replica set.

Object Naming Conflicts

A naming collision occurs when administrators create two distinct objects with the identical Relative Distinguished Name (RDN) in the same organizational unit or container on different domain controllers before replication occurs.

Because two objects cannot share the same distinguished name in the same container, Windows 2000 resolves this conflict using the object creation timestamps:

  • The object created first (earliest UTC timestamp) retains its original name.
  • The object created later is deemed the conflict loser and undergoes name mangling.

Windows 2000 renames the losing object by appending a conflict character, the letters "CNF", and the object's unique GUID to its original name in the following format:

OriginalName\0ACNF:GUID

This renaming ensures both objects are preserved in Active Directory, allowing administrators to inspect the conflict and manually delete or rename the duplicate object.

Structural and Containment Conflicts

Structural conflicts arise when an object is manipulated concurrently with its parent container. The most common scenario occurs when an administrator moves or creates an object inside a container on one domain controller, while an administrator on another domain controller deletes that container.

Active Directory cannot place an object into a non-existent parent container. To prevent orphaned or inaccessible objects, Windows 2000 automatically moves the displaced child object to the hidden LostAndFound container located at the root of the naming context (e.g., CN=LostAndFound,DC=domain,DC=com).

Once the replication cycle completes, the displaced object remains safely stored in the LostAndFound container until an administrator manually evaluates the object and moves it to an active organizational unit.