Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I demoted a domain controller and it broke some IIS (running on same machine) permissions in a way I couldn't fix and futzing with things has just made it worse. The idea was to separate stuff and make things more robust and I'd like to try to eventually do that, but right now I need that site back up and running.

If I restore this machine from a backup from back when it was a domain controller, will I have an Active Directory Disaster? I'm pretty sure the backup was done before I transferred the FSMO roles. :(

share|improve this question
Backup your sites, reinstall the OS and install IIS from scratch. – Mathias R. Jessen Apr 4 '12 at 21:18
up vote 6 down vote accepted

You can't do a non-authoritative restore it if it's been demoted. The other domain controllers now no-longer think that it is a DC. If you did an authoritative restore, then all of your AD info will be rolled back to the time of the backup, but your site should work again, but you'd have to demote and re-promote your other DCs (I believe).

This happened because there is no local user database on a Domain Controller. All of the accounts, including the IIS service accounts, become domain accounts when a DC is promoted. When you demote it, you remove this authentication database and replace it with the default one.

Basically, you're kind of screwed. I'd consider taking this time to get the site working on a member server instead of wasting (probably) the same amount of time trying to get everything the way it was the second before you demoted the DC.

share|improve this answer

Just want to expand on MDMarra's response:

Your focus right now should be to work through the problems that IIS is presenting to you. The error log is invaluable in this. If all else fails, set application pools to run as Administrator (DO NOT DO THIS IN PRODUCTION). The finger-of-God approach to the Domain Admin should allow you to at least run the sites and buy you some time to do it correctly.

Filesystem permissions will be the first issue you'll encounter. Depending on how your users authenticate to the site (if at all), authentication will be the next hornet's nest. Rely on the logs, use your friend Google and get it working correctly and securely.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.