Reconnect child domain to AD forest after tombstone period without demoting child domain DCs

Frankly information on how to fix this problem IS available. It's just that Microsoft's support site contains KB articles that haven't been fully updated.

See this article: Orphaned child domain controller information may not be replicated to other Windows 2000 Server-based domain controllers

To resolve this issue, you must create a replication link, and you must enable one-way authentication instead of two-way authentication. To do this, follow these steps:

1. On a domain controller in the root domain, add the Replicator Allow SPN Fallback registry value. To do this, follow these steps.
   
   Note Perform steps 1 through 6 on this same domain controller.
   
   1. Click Start, click Run, type regedit, and then click OK.
   2. Locate and then click the following registry subkey:
      
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
   3. On the Edit menu, point to New, and then click DWORD Value.
   4. Type Replicator Allow SPN Fallback, and then press ENTER.
   5. Double-click Replicator Allow SPN Fallback in the right-pane, type 1 in the Value data box, and then click OK.
   6. Restart the domain controller.
2. At a command prompt, type the following:
   
   repadmin /optionsfully_qualified_domain_name_(FQDN)_of_the_root_domain_controller+DISABLE_NTDSCONN_XLATE
   
   
   Note The Repadmin.exe tool is located in the Windows 2000 Support Tools. 
   
   For additional information about how to install the Windows 2000 Support Tools, click the following article number to view the article in the Microsoft Knowledge Base:
   
   301423  How to install the Windows 2000 support tools to a Windows 2000 Server-based computer
3. At a command prompt, type the following:
   
   repadmin /add CN=Configuration,DC=Domain_Name,DC=Domain_NameFQDN_of_the_root_domain_controller FQDN_of_the_child_domain_controller
4. At a command prompt, type repadmin /showreps. A successful incoming connection should be displayed for the configuration naming context from the child domain controller.
5. At a command prompt, type the following:
   
   repadmin /options FQDN_of_the_root_domain_controller -DISABLE_NTDSCONN_XLATE
6. Remove the Replicator Allow SPN Fallback registry entry. To do this, follow these steps:
   
   1. Click Start, click Run, type regedit, and then click OK.
   2. Locate and then click the following registry subkey:
      
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
   3. Right-click Replicator Allow SPN Fallback, click Delete, and then click OK.
7. Force replication between all domain controllers in the root domain. To do this, follow these steps:
   
   1. On a domain controller in the root domain, click Start, point to Programs, point toAdministrative Tools, and then click Active Directory Sites and Services.
   2. Expand Sites, expand Servers, expand your Server_Name folder, and then click NTDS Settings.
   3. If there are other domain controllers in your environment to replicate, they will be listed in the right pane. Right-click the first domain controller in the list, click All Tasks, and then click Check Replication Topology to start the Knowledge Consistency Checker (KCC). 
      
      An incoming connection object from one or more of the child domain controllers is displayed. You may have to update the display by pressing F5.
      
      Note You must perform this step for each domain controller in the root domain.
8. Allow replication to occur throughout the forest. Then, run the repadmin /showreps command on the root domain controller and on the child domain controllers. This step makes sure that Active Directory directory service replication is successful. 
   
   Note The "Replication Allow SPN Fallback" registry entry enables the Active Directory to use one-way authentication if two-way authentication cannot be performed because of a failure to resolve a Service Principle Name (SPN) to a computer account.

@ARK-DS

Problem is almost resolved.  Been talking to Microsoft these last two weeks - we are at the last stage of monitoring replication and cleaning up.

And yes, you are right about KB http://support.microsoft.com/kb/887430. It's the first step required to rejoin the orphaned domain to parent. Unfortunately, I didn't get confirmation that this would work with Windows 2008 servers and in Windows 2003 Forest/Domain level installations - if I had, it would have saved a call to Microsoft. :-)  AND Microsoft's KB article was updated (APPLIES TO doesn't mention anything other than Windows 2000 Servers!!) See attached image kb887430.jpg

However, the whole process isn't as simple and involves many steps.

OK people, this is for the benefit of the masses.

From watching Microsoft troubleshoot the problem, besides the SOPs they ask you to do, (MPSReport, Network analyser captures, etc), these are the steps and things to take note of if you have a situation such as this.

1. You need to run the commands on the PDC.
2. You need to double-check using regedit even after using the "repadmin /regkey " - If you don't do that, although the command returns successful execution, the key might still be there.

www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_25306989.html#a30815303