I've found myself thrown into a problem with a couple of AD servers that has me beating my head against the wall. I've read through quite a few entries on the web, but haven't made much progress.
The primary server apparently lost power and the AD database was corrupted. Attempts to recover it with ntdsutil failed, and while I was able to do a system state restore, the backup was from about three months ago. That, and the two servers haven't been replicating properly for a few months now. When I run dcdiag on either server, I get warnings about the latency being over the tombstone lifetime. The fact that both machines are apparently past the tombstone date worries me, and I'm wondering is if it is still possible to salvage this domain or if I should just burn it down and start from scratch.
Here are some of the problems with the first DC:
- Nobody can log in with their domain credentials.
- I can't add a new user in the AD Users and Computers snapin. I get an error saying 'The directory service was unable to allocate a relative identifier'.
- There are messages in eventvwr about being unable to execute group policy client-side extension scripts.
To make a long story short, we have a small AD domain running with two sites over three subnets (Site 1 - 192.168.1.0/24, Site 2 - 192.168.2.0/24 & 192.168.3.0/24) Each site has a 2003 server running AD, with the first site's server holding the FSMO roles. For what it's worth, the two DCs are Server 2003 virtual machines running on Linux VMWare Server 1.x hosts.
I've checked DNS and it seems to be running fine. netdom query fsmo returns the first server when run on either machine. I can ping both DCs from each other by IP address and by FQDN. The windows firewalls are turned off and I don't see anything untoward in the router firewalls. There seems to be some sort of connectivity issue that I can't pin down.