2

I've managed to get into a loop hole and cannot find a way out.

I have a server using Microsoft Virtual Server 2005 that I recently had to restart, so I shutdown all of the guests Virtual Machines and then restarted the host.

There are about 8 virtual machines in total, one of which is an Active Directory domain controller.

About a week ago, I also went around all of the servers (both physical and virtual) to disable the local accounts, including Administrator, as the domain appeared to be working fine.

However, now that the physical host server has restarted, I cannot logon any longer via remote desktop - as the domain is not contactable (due to the virtual machine being powered down) and the local administrator account is disabled.

I have tried connecting from another physical server (via Computer Management) to try and re-enable the local accounts, but I don't have permission (and/or RPC appears to be blocked - again, via Domain Controller group policy). I've tried connecting to Virtual Server 2005 to switch on the Domain Controller VM - but again, no accounts with access.

How can I get out of this? I need to switch all of the VMs on ASAP!

2
  • To clarify - this isn't a mission critical server, but it does host my email and various personal websites. I'll try methods that require physical access once I return home.
    – Lazlow
    Jun 24, 2009 at 11:03
  • pauska's suggestion of booting into Safe Mode resolved the issue. I've re-enabled the local administrator account on both physical servers, so that this doesn't happen in future!
    – Lazlow
    Jun 24, 2009 at 19:33

5 Answers 5

5

Boot it up in safe mode and re-enable the local Administrator account.

Do-not-ever disable it again, assign it a crazy password, write it down on a note and lock it away if something like this happends again.

Also, don't virtualize all your basic networking services (like a domain controller). Install windows server on a old PC, configure it as a domain controller, global catalog, DNS and DHCP (if you use DHCP), and place the PC somewhere else in the building.

5
  • Great suggestion, if all else fails I'll do this tonight. Slight problem - I'm working remotely via Remote Desktop (and VMRC for Virtual Server), so cannot use safe mode (as far as I'm aware).
    – Lazlow
    Jun 24, 2009 at 10:55
  • You don't have physical access at all to the server? Can you call someone to do this for you?
    – pauska
    Jun 24, 2009 at 10:56
  • I can call my wife, but explaining how to boot into safe mode is a bit too far - hitting the reset button is as far as it goes.
    – Lazlow
    Jun 24, 2009 at 11:02
  • At the very least, have multiple domain controllers running on separate virtual hosts Jun 24, 2009 at 11:44
  • This is why you should always have at least one physical domain controller, or use a VM solution that doesn't rely on your DCs being online.
    – mrdenny
    Jun 24, 2009 at 15:34
2

(I didn't even think of safe mode!)

You could try using EBCD to re-enable the admin account. I've used it in the past when i've lost local admin passwords, works great.

As the other post says - you shouldn't disable the local admin accounts - rename the account to something random and put a very strong password on it if you're concerned. Also, you really should consider maintaining a physical domain controller - perhaps the host machine itself?

3
  • Are you referring to Emergency Boot CD (prime-expert.com/ebcd)? If so, again I'll try that if all else fails remotely.
    – Lazlow
    Jun 24, 2009 at 10:56
  • 1
    Safe mode is sufficient for re-enabling it, as it allows local logon even if the account is disabled.
    – pauska
    Jun 24, 2009 at 10:58
  • You can get free versions of EBCD if you look around - or try pcloginnow.com
    – Chris W
    Jun 24, 2009 at 11:03
1

Petter Nordahl's Offline NT Password & Registry Editor can re-enable the Administrator account and assign it a new password. The safest method is to disconnect the network and give the account a blank password (by entering an asterisk ... * ), then change to a better password on boot, and then reconnect network.

It takes about ten minutes to download and burn the disk; less if you use the floppy version.

Since you're using virtual systems, you don't even have to burn. Just boot from the .iso file.

1
  • I'm not sure if it would provide any benefit over using Safe Mode to re-enable the local administrator account. However, thanks for the answer.
    – Lazlow
    Jun 24, 2009 at 11:30
1

When you get back to physically infront of the host machine, unplug the network cable.

Then try to login using the domain administrator account again

Windows should use the cached domain login (assuming you've logged in using administrator atleast once recently to it, and you don't have some GPO preventing login if no DC is online) Much like when a laptop is not on the network, once in get things working again.

Once done, as a thought, does the host machine need to be one the domain?

Could it simply be a workgroup computer & then you have a renamed admin account and a crazy password?

That way you'll always have access to it regardless of what the domain is doing.

4
  • Hrm, since the DC VM is powered down, it should be behaving as if it's unplugged anyway, I'd think? Jun 24, 2009 at 12:17
  • For the first 6 months of operating, the host machine wasn't on the domain - and no virtual/physical machines on the network accessed it. However I recently added it to the domain to gain the benefits of the domain group policy and firewall rules. I may remove it completely from the domain, or move AD to another dedicated physical server.
    – Lazlow
    Jun 24, 2009 at 12:18
  • Kara - I thought exactly the same thing. However, I've had the same issue in the past with it not being able to logon using a domain account after restart - in those sitatuons I logged on as the local administrator.
    – Lazlow
    Jun 24, 2009 at 12:20
  • If the VM DC is powered down, not always :) Since it's detecting a network it may trying to look for it and think it is on the network and give you the domain controller un-available. In which case its not using the cached login. I had this happen to be once when I forgot the local password for a workstation at a remote site with no DC. Even though the VPN was down (and as such no DC) until I unplugged the network it wouldn't use the cached login. Jun 24, 2009 at 12:55
1

Her's a little trick, you boot a livecd (take a look at backtrack) with read/write access to the ntfs volume, then you rename windows/system32/logon.scr to logon.bak and copy cmd.exe to logon.scr.

You reboot the machine and wait a few minutes, instead of launching the logon screensaver , it will launch a shell under system credentials. then:

c:>net user new_account new_password /add
c:>net localgroup administrators new_account /add

now you got a new local admin account on the box.

By the way i think it is a good practice to make a second local admin account and disable the original one

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .