1

Hello Im using Windows Server 2008 R2, yesterday I notice that my AD was not working propertly cause I cant manage users and mmc console dont allow me to work with any ad, dns relative consoles.

So I found unknows IPs on DNS Propertyes (in the tab where are two radio buttons : all ips and select ips)

so I notice that my Domain Administrator has become a "GUEST" and I lost my Local Administrator (was removed or maybe renamed).

Today I remove the AD with dcpromo /forceremoval , and now I cant enter with any administrator account on my server.

Login screen appears without the computername.

I want to enter with some trick or hack it for recover my information is an Windows Server 2008 R2 Enterprise RC1 Build 7100

Help me please, thanks to anyone

Improve this question

3 Answers 3

Reset to default
4

You might have to restore from backup.

Even that would be tricky because of active directory not liking the previous database appearing on the network, though.

Is this the only AD server you had? Are there backup servers? If this was JUST an AD server you might get away with rebuilding the box and re-joining it to the domain as an AD server.

You also need to investigate how you lost those privileges in the first place! Hack? Missing updates? Admin user gone rogue? If someone IS in your system with admin privileges there's a good chance you have other problems with trojans, corruption, stolen data...you really need to stop and audit everything in your network to find out what happened or this issue you're troubleshooting is akin to fixing a hangnail on a guy that just had his foot severed.

Improve this answer
5
  • @Bart Thanks for comments, but I can't enter to the server to perform a BackUp :S
    – Jonathan Escobedo
    Dec 10, 2009 at 14:36
  • Server was updated ever
    – Jonathan Escobedo
    Dec 10, 2009 at 14:37
  • I meant you'd have to restore from a previous backup, maybe from bare metal recovery. Wipe and restore, as if the hard disk(s) had failed.
    – Bart Silverstrim
    Dec 10, 2009 at 14:52
  • 3
    Problem is that doing a recovery on an AD system can cause issues with other AD servers as that causes temporal issues with their syncing. They don't like seeing a member server appear with updates that are tagged from back when you did your last backup. Another reason AD servers should just be used for AD...fail, build a new one and re-join as an AD server so it resyncs properly. It's quite a procedure to recover from a backup with other AD servers.
    – Bart Silverstrim
    Dec 10, 2009 at 14:54
  • Bart is right. Been there done that, won't do it again. DC's are DC's not file servers.
    – BillN
    Dec 11, 2009 at 2:09
1

I might be wrong but I remember that 2008 R2 RC1 was having a curious bug that was causing the symptoms you are experiencing right now... If you rebuild you server at the end, go for the RTM version, anyway RC1 will be dropped soon or later by Microsoft...

Improve this answer
1

With the server no longer a DC then you can enable and reset the local Administrator account password by booting from a live rescue CD. There are many live CD's that have these tools: UBCD4Win (requires an XP CD to create the ISO but has other Windows tools), Trinity Rescue Kit, Offline NT Password and Registry Editor, etc.

Since the server was compromised you'll have to format and reinstall once you get what you need off of it or you'll never be sure the system is clean and undamaged.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .