Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm kinda newbie in this Windows 2008 Server R2 configuration stuff, so I would appreciate any help regards the issue I'm facing.

After a Windows 2008 Server R2 clean install I created a couple of local user accounts and joined them to the administrators group, I tested them and I was able to log on with each one.

Then I installed Active Diectory role (DNS role implied) and runned DCPromo. The domain was created and promoted succesfully and I was able to log on into the domain from a client machine.

The issue began when I realized that I was no longer able to log on locally into the server (meaning LOCALMACHINE\localusername). I looked into domain user accounts and noticed that the local user accounts I created previously were now part of the domain. I consider a bad thing not being able to log on locally anymore, so in a shot to fix it I stopped the Active Directory service... my bad! Now I'm sort of locked up, I can't log either locally or as part of the domain.

Can someone please shed some light in this? What did I miss in the process? I tried googling but could find any straight forward solution or explanation. What concept I'm not catching?How can I promote a server to PDC and still be able to log on locally?

Thanks in advanced.

share|improve this question
Additional advice - get the MS press books that accompany the classes that will get you certified on Win2k8 server. You will learn all about this sort of thing. Some folks may prefer Sybex or other study guides; I've had good luck with the MS Press. – mfinni Nov 22 '10 at 19:54
Actually I'm following the Sybex guide. Thnaks for the advice mfinni – jromero Nov 22 '10 at 20:05
up vote 5 down vote accepted

When you install Active Directory, it removes any local accounts - this is well documented and intended functionality. As an aside, there are no primary and backup domain controllers any more - each DC is equal.

Reboot the machine - Active Directory should start back up again on reboot. If it doesn't, reboot again and keep tapping F8 and boot into Directory Services Restore Mode. You should then be able to log in and interrogate the Event Viewer for any clues why Active Directory isn't starting.

share|improve this answer
I think he disabled the service... +1 for directory restore mode I can't believe I forgot about that option. – Not Kyle stop stalking me Nov 22 '10 at 19:44
If this is the case, hopefully rebooting into Directory Services Restore Mode will allow login and allow the OP to re-enable the service. – Ben Pilbrow Nov 22 '10 at 19:45
Yes, that is correct. – Ben Pilbrow Nov 22 '10 at 19:55
ok, I rebooted and apparently AD service ran again! Now I'm logged on. So no local logon anymore once AD is installed? All is now managed through the domain, am I correct? – jromero Nov 22 '10 at 19:57
alright! Thank you so much Ben, appreciate your help! – jromero Nov 22 '10 at 20:08

Once a member server is promoted to a domain controller it will no longer have local accounts. When you demote the domain controller it will ask you to set a new local administrator password. However I am not sure how you would restart the active directory service if you disabled it entirely. Here is a link for reference about local accounts not being available on a domain controller.

EDIT: like Ben said directory restore mode is your best bet with this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.