2

I demoted a domain controller and it broke some IIS (running on same machine) permissions in a way I couldn't fix and futzing with things has just made it worse. The idea was to separate stuff and make things more robust and I'd like to try to eventually do that, but right now I need that site back up and running.

If I restore this machine from a backup from back when it was a domain controller, will I have an Active Directory Disaster? I'm pretty sure the backup was done before I transferred the FSMO roles. :(

1
  • 1
    Backup your sites, reinstall the OS and install IIS from scratch. Apr 4, 2012 at 21:18

2 Answers 2

6

You can't do a non-authoritative restore it if it's been demoted. The other domain controllers now no-longer think that it is a DC. If you did an authoritative restore, then all of your AD info will be rolled back to the time of the backup, but your site should work again, but you'd have to demote and re-promote your other DCs (I believe).

This happened because there is no local user database on a Domain Controller. All of the accounts, including the IIS service accounts, become domain accounts when a DC is promoted. When you demote it, you remove this authentication database and replace it with the default one.

Basically, you're kind of screwed. I'd consider taking this time to get the site working on a member server instead of wasting (probably) the same amount of time trying to get everything the way it was the second before you demoted the DC.

3

Just want to expand on MDMarra's response:

Your focus right now should be to work through the problems that IIS is presenting to you. The error log is invaluable in this. If all else fails, set application pools to run as Administrator (DO NOT DO THIS IN PRODUCTION). The finger-of-God approach to the Domain Admin should allow you to at least run the sites and buy you some time to do it correctly.

Filesystem permissions will be the first issue you'll encounter. Depending on how your users authenticate to the site (if at all), authentication will be the next hornet's nest. Rely on the logs, use your friend Google and get it working correctly and securely.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .