Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Assuming that at least two domain controllers were present in the domain to start with, what steps need to be taken to make Active Directory healthy after a domain controller crash?

share|improve this question
    
How do you define "Crashed"? Did it just BSOD, or is it totally dead? –  Mark Henderson Mar 14 '10 at 22:13
    
Totally dead. In my case, both the power supply and motherboard failed. –  Nic Mar 15 '10 at 4:09
add comment

1 Answer

up vote 25 down vote accepted

Step 0: Have at least two domain controllers.
If you only have one domain controller and it fails in such a way that you cannot recover it, then your domain no longer exists; your only option is to create a completely new domain. This is a painful process that involves recreating users, rejoining client computers and servers, and even recreating every security setting you ever used.


If the server is absolutely unrecoverable, such as due to hardware failure that cannot be easily repaired, then here is how to go about purging it from the domain completely. Once the FSMO roles have been seized, it is critical that the old server is never brought back online. Seriously consider wiping the harddrives to ensure that this can never happen.

  1. Determine which servers were holding the FSMO (Flexible Single Master Operations) roles for the domain and forest. Microsoft has a great article on finding FSMO roles.

  2. Any FSMO roles that were held by the crashed server should be seized on a healthy domain controller. Another Microsoft article for this one.

  3. The "Infrastructure" FSMO role is special, and is actually specified for each application partition. If the crashed server held DNS, you will need to verify that the record in each application partition (DomainDnsZones, ForestDnsZones) has been updated. Better explanation here and official fix here.

  4. Perform a metadata cleanup to remove remnants from Active Directory. Deleting extinct server metadata.

  5. Inspect "Active Directory Users & Computers" and "Active Directory Sites & Services" to ensure that all entries for the extinct server have been removed.

  6. Inspect DNS to find any static entries that were related to the extinct server, and either delete them, reassign them, or put a new server at the same address.

  7. If the crashed server was an authorized DHCP server, check to see if it's still listed as an authorized server. If yes, you may need to use ADSI Edit to remove it from the list of DHCP roots.

(Edit 2010-03-14: Added Graeme's comment about step 0)

share|improve this answer
    
I had to find out all of this the hard way, so hopefully this can help somebody else who ends up in my position. –  Nic Mar 14 '10 at 16:26
    
Sound like a crappy weekend, but thanks for sharing the great checklist. –  Gomibushi Mar 14 '10 at 16:29
    
Unfortunately I'm too familiar with these steps... –  emgee Mar 14 '10 at 16:43
    
I think I might just print out this post and hang it in the server room. Thanks! –  Matt Simmons Mar 14 '10 at 16:50
4  
+1, this is a great answer. You've covered pretty much everything. I would add a "Step 0" for those who haven't had to deal with this.... "Always have at least 2 DCs". It's scary how many environments are out there with only one. –  ThatGraemeGuy Mar 14 '10 at 18:20
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.