up vote 1 down vote favorite
share [g+] share [fb]

So... was trying to add in a 2008 DC to a single 2003/exchange 2007 setup. ran adprep and updated schema, and joined the new DC to the AD... then 6 hours later noticed everything was not working. Restore tapes are offsite and not available for a few days so no easy option.

The gist is the GC is not locatable and the sysvol isn't being shared. If you connect directly to the DC you can query all objects inside the AD properly, but nothing that queries the root domain itself works. went through the dns tree and eveyrthing seems proper. the server is pointing to itself for dns.

dcdiag shows: Starting test: FsmoCheck Warning: DcGetDcName(GC_SERVER_REQUIRED) call failed, error 1355 A Global Catalog Server could not be located - All GC's are down. Warning: DcGetDcName(TIME_SERVER) call failed, error 1355 A Time Server could not be located. The server holding the PDC role is down. Warning: DcGetDcName(GOOD_TIME_SERVER_PREFERRED) call failed, error 1355 A Good Time Server could not be located. Warning: DcGetDcName(KDC_REQUIRED) call failed, error 1355 A KDC could not be located - All the KDCs are down.

i have done ntdsutil and seized all roles anyway, confirmed under sites that the DC is a GC. it should work...google doesnt show what i want.... i'm good with AD but not good enough ;)

Where do i go from here?

link|improve this question
1  
You seized roles from a server that's still online? Uh oh. – Miles Erickson Oct 3 '11 at 20:50
to clarify, the 2008 server was removed and a restoration of AD was going to be done. turns out we couldnt do a restore. – DuPie Oct 3 '11 at 20:56
3  
This may be a good time to call MS PPS for $250 (IIRC) if this is impacting your business. Otherwise, if you have the time to fix it on your own, it'll be a great learning experience! Actually, either way this is going to be a good learning experience .... – mfinni Oct 3 '11 at 20:57
feedback

2 Answers

up vote 1 down vote

You were mistaken to seize the roles. You effectively blew away any DCs that were role holders before. By seizing the roles, you are saying that these servers are no longer available, and won't be available. You will need to clean-up the meta data for any DCs that were previously FSMO role holders, and then re-do those servers. I would use different names, then re-add them as DCs after re-doing them.

Please read the "Seize FSMO Roles" section in KB 25504

You will also want to look at KB 216498 for how to remove the meta-data.

Congrats, you're now in disaster recovery.

link|improve this answer
have confirmed via aduc connected to the DC (cannot connect to domain itself) that rid,pdc, and infrastructure all point to the 2003 DC – DuPie Oct 3 '11 at 20:59
You didn't DCPromo out your new 2008 DC did you? Do you have other DCs available that weren't FSMO role holders? – Cheekaleak Oct 3 '11 at 21:17
feedback
up vote 0 down vote

Well, we eventually couldnt figure it out and ended up to making someone drive 9 hours to get last known backup tapes :p

Not fun at all. Moral of story: 1.) have more than 1 DC at all times 2.) back the systemstate up constantly and verify!

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.