Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We had a 2008 R2 domain controller begin failing recently, the backups all became corrupted and the system drive contained CRC errors. (thus preventing further backups).

We were able to promote a new domain controller with all the fsmo roles, but the sysvol/netlogon replication did not fully happen before the original domain controller failed into an unbootable mode.

Is it possible to recover the domain at this point? It seems the new domain controller contains all DNS and AD replications. Only thing it's missing is the SYSVOL and NETLOGON shares.

How would I go about manually removing all traces of the prior domain controller?

update According to Microsoft KB, there's a way to manually recreate the sysvol/netlogon shares. I think I may try that on the new DC. See what happens.

update2 Well, I managed to get the SYSVOL/NETLOGON shares up and running and the new DC seems to be running just fine. The old DC is unbootable. Now I have to figure how to decommission and remove the old DC without it being bootable.

share|improve this question
    
Don't forget to seize the FSMO roles if the other DC is gone for good. –  SpacemanSpiff Apr 23 '12 at 18:12
    
Yea. All roles have already been seized. –  Matias Nino Apr 23 '12 at 18:17
    
I presume you had a small environment with only 1 DC. Is it worth spending the time on trying to recover, or is your time better spent creating a new AD structure? –  Jim B Apr 23 '12 at 18:35
    
You make a good point. Had I just scrapped the servers immediately and rebuilt the domain from scratch, I probably would be restored after the amount of hours I poured in trying to rescue the domain. The most annoying part is the PST transfer of about 10 exchange mailboxes. At this point, if the domain doesn't behave after manual replication of the sysvol. I'm just going to scrap and recreate. Exchange be damned. –  Matias Nino Apr 23 '12 at 19:08
add comment

1 Answer

up vote 2 down vote accepted

To clean out the old DC, you will want to delete the DC's metadata. You can use the ntdsutil.exe as described in How to remove data in Active Directory after an unsuccessful demotion.

Verify that the following objects have been deleted (if not, delete them):

  • The Computer object for the DC in ADUC
  • The NTDS Settings object and DC object in AD Sites & Subnets (if deleting manually, delete the NTDS Settings object first.

You'll need to manual delete any reference to the DC in DNS (including any in _msdcs and all sub-zones)

With all that being said, you should really consider setting up an additional DC for redundancy. That way if you have a DC go down, you still have a second working DC.

share|improve this answer
    
+1 for you... but, I worry about the OP implying "partial" replication. –  Ryan Ries Apr 24 '12 at 2:18
    
Lesson learned. Will definitely be running a backup DC on the network from now on. It's a home lab, so no biggie, but still. It pays to think ahead. –  Matias Nino Apr 24 '12 at 12:46
    
Ryan - After I recreated sysvol\netlogon dcdiag reports all tests pass and full replication. –  Matias Nino Apr 24 '12 at 12:47
    
@MatiasNino I figured your replication was ok from your question updates, but yes, these steps would only be recommended when you know you are in a stable AD state and just need to get rid of the old DC data. –  Cheekaleak Apr 24 '12 at 13:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.