Reenable Move Warning for Active Directory Objects

These entries are likely inherited from the top of your AD. Using Active Directory USer and Computers, open up properties on your top level domain and remove the old entries from the security tab there. That should clean up the all the objects.

You know you've gotten yourself into a pickle if the only relevant search result to your problem is the Serverfault question you just asked.

Give this a try:

HKLM\System\CurrentControlSet\services\NTDS\Parameters\Maximum Audit Queue Size

You'll have to create the key as it most likely won't exist. It's completely undocumented (publicly) by Microsoft, and therefore most likely not supportable. The only reason I know that Directory Services checks for the existence of that key is because I ran Procmon and restarted AD DS to see what reg keys it searches for.

I haven't tested it out nor do I have an Active Directory as crazy as yours to test it on, but I doubt you'll get a better answer without contacting Microsoft support.

Most of the other keys there seem to be DWORDS, so I would start with that.

lsass.exe searches for it during AD DS startup using the function RegQueryValueExA. Unfortunately I can't see the parameters passed to the function so I can't tell you exactly what type of registry key it'll need to be. You'll just have to test.