5

I was performing a rename of an Active Directory domain that consists of two domain controllers running Windows Server 2012, and everything was going smoothly... However, I ran the rendom /clean utility too soon.

If you execute rendom /clean before all the machines in the domain get rebooted twice, they won't be able to access the domain any longer... /clean removes the alias/migration information from Active Directory.

Unfortunately, I ran /clean without realizing the catastrophic effect it would have -- making all the machines that haven't rebooted, no longer be able to access the domain.

Is there a way to undo the /clean? I took bare-metal backups of the DC's before doing the rename operation, so I'm looking at restoring those now -- but I would like to know if there's a way to just add the alias information back into Active Directory.

2 Answers 2

4

I'll preface this by saying that I've never run /clean early and I've never fully inspected what bits /clean flips under the hood. That said, I have done a large-scale domain rename in a 10,000+ object forest, and it's a delicate process. I wouldn't want to rig up a workaround that will leave you in an unsupported state. Instead, I'd definitely restore your DCs from backups as well as any other servers that did reboot twice. Then start over with a clean slate.

1
  • 1
    Well, I got lucky... I took a gamble, and with a couple laptops made a test: I re-added via ADSI Edit the msDS-DnsRootAlias attribute with the value of the old domain name - this is the attribute /clean removes, along with the updateScript which is used by the servers... rebooted a couple laptops twice, and everything went beautifully. Forty machines later, everything is good.
    – Dan Smith
    Feb 19, 2013 at 3:32
2

Sounds like it is time to do a restore from your good system backups.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .