Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Yesterday i was assigned to reinstall a primary domain controller because the computer just died. Honestly, i have no experience on it, but i managed to reinstall and configure the new Win2K3 installation as a virtual machine, with the 'same' configuration as before (same domain, etc). I recreated the users in AD, and they can now log in again.

We have a problem with shared resources: no user can access them (folders, printers, etc). I re-joined one test virtual machine to the domain, and worked fine. ¿Do i have to re-join all workstations in the domain?
Note: i didn't recreate the computers in ad, just the users.
Note2: if this info adds help, in some pcs we're getting a message saying that windows xp could not update the credentials. It asks to block the session and un-block it, but the problem isn't gone.

Can anyone point me in the direction to find the solution for this?

Thanks

Nick

UPDATE: 2009/08/11 Here´s the link to the page i used to relocate the new user's profile folder (once i re-joined them to the domain) to the old user folder (the one that contains all the data and configuration for each one): http://windowsxp.mvps.org/userpath.htm

Be sure to check permissions on them, because in one of the workstations, xp kept creating a new user profile folder for the user, no matter how many times i relocated the profile. It cannot be accesed due ACL, so a new folder were created.

share|improve this question
    
Was this the only DC in the domain, and - if not - was it a 2003-only domain or were there NT4 DCs there also? –  Jimmy Shelter Aug 4 '09 at 23:38
    
Yes, is wak the only dc, and an 2003-only domain. –  nick2083 Aug 4 '09 at 23:58
    
Phew! I was worried for a while there. OK, Carl's suggestion is the way to go with this one then. –  Jimmy Shelter Aug 5 '09 at 0:09
    
:) Thank you very much. You don't know how worried i am! Do you have any advise on automating the process? Thanks again! –  nick2083 Aug 5 '09 at 0:43
    
The quick and dirty way - if your PCs were built from a sysprepped image - would be to re-sysprep them and let them automatically join the domain during boot up. Depends on how your PCs were built though; I fear you may have to do it the long and boring way. –  Jimmy Shelter Aug 5 '09 at 7:55
add comment

4 Answers

up vote 2 down vote accepted

You have to put the workstations in Workgroup mode and then rejoin them to the new Active Directory domain. From your description, this is a completely different domain, having only the name in common with the old domain.

The workstations don't just join a name when they join an AD domain. They join a single Active Directory that happens to have the name you assign. When that AD directory is lost, the workstation memberships are lost with it.

share|improve this answer
    
Carl, thank you very much. Is there any way i can automate the process of re-joining to the domain in each workstation? –  nick2083 Aug 4 '09 at 23:46
    
Nick - I would imagine there's a way to script the process, but it's not something I've ever done. –  Carl Campos Aug 5 '09 at 15:30
add comment

yikes! you didn't have a backup of the dc that just 'died' ? calling the domain the same name does not make it the same, it will have a different SID.

I cannot think of an easy way to automate re-joing the domain. You will need to switch each computer back to workgroup & then join it to the new join, if that's all you have to do, consider yourself lucky!

None of the permissions for users on the machines in the network will work, permisions that are there with usernames the original domain will still exist, but not able to be resolved.

Re-joining computers to the domain will also mean that desktop users will lose their profile settings, so you'll have to copy them using the copy profile wizard.

What you are essentially doing is migrating to a new domain. MS has a tool called the Active Directory Migration Tool, that will fix these issues like permissions & joing computers to a new domain, but it assumes you can still access the old DC.

Lessons to learn:

  1. backup your domain controller
  2. have more then one domain controller
  3. test your backups
share|improve this answer
    
"have more then one domain controller" << THIS DOES NOT HELP. You need to also assign the second DC to be a GC (global catalog) server, or your second DC will be useless if the primary GC server fails. –  SirStan Aug 5 '09 at 14:17
add comment

I was called in to a project where this happened once -- and what we ended up doing was writign an AutoIT script to automate the project (clicking all the join/disjoin buttons). The real kicker of all of this is any user profiles will get ignored as well.

ie..

John Sorrow (jsorrow@mydomain.llc)'s PC has

c:\documents and settings\jsorrow\

But when he logs in after the migration; Windows knows its a different user (his sid changed) so it will create

c:\documents and settings\jsorrow.DOMAIN\

So as a follow up, you need to use regedit to map the new sid instance back to his old folder. I seem to remember havign some issue just renaming jsorrow to jsorrow.DOMAIN, and found it mroe reliable to fix the registry key to use the old folder -- but I forget exactly why now.

Anyways -- its not easy. This is why its CRITICAL to have a second global catalog server.

share|improve this answer
add comment

I've been through this before.

  1. You will need to disjoin every workstation, and rejoin them to the new domain. -Before doing this, make sure you backup and local profile information that the users may need.
  2. Permissions will need to be reset on file and print sharing directories.

There really isn't an easy way to automate this, it's just a time consuming issue.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.