0

Okay, new problem. My Domain Controller is down, and as such, it's normal that users can't login to active directory, right? Now, there's a user who can't login no more using his active directory credentials, I think they might have expired out of the cache.

Question: Is there a painless way to make sure that the user can login, and keep his active directory settings? I know there's a profile folder on the disk, so there should be a way to keep them, which I will inspect later on.

Then, if I need administrative rights, do you people know of a tool to safely reset administrator password on a machine I'm supposed to have access to? Nobody has any idea whatsoever about the Admin password here, and I'm already under a lot of pressure.

Thank you all in advance.

Oh, missing information about the workstation: Windows XP 64. Hardware is irrelevant here, is it not?

Improve this question

4 Answers 4

Reset to default
4

"you people"? What do you mean by "you people"? :) Anyway, if your DC is down and that is your only DC, then you should really be focusing on getting AD up and running again instead of trying to get users up and running individually on their local machines. The reason is without AD, you have no central authentication mechanism and therefore all of your "domain" PCs and servers become WORKGROUP PCs isolated from each other. You won't be able to access network resources without providing a local account username/password on each resource. I am not sure what you mean by "keep his active directory settings" either. What is the point of having them if AD isn't working anyway? There are various tools to reset an admin password if you have physical access to the machine. Ironically (or not), most of them are built on Linux :) Here is a link to some of them: http://www.petri.co.il/forgot_administrator_password.htm

Improve this answer
1
  • I didn't realize i gave the same link as you... lol.
    – IceMage
    Aug 25, 2009 at 15:39
2

There are a multitude of tools out there to change the admin password for windows XP machines. If you need to reset the Domain Admin password, see if this article helps: http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

As August said, you need to concentrate on bringing up the DC rather than each individual PC. You can change local policies to cache credentials for longer, but you'd more than likely want to do that from the DC, since you can't override local policies with a domain policy (the most specific policy will win, in this case, always the local policy).

Improve this answer
1

Group Policy defines the number of Cached Logins a user/workstation will allow in the absense of a domain controller. That document explains it all. However, you need your domain controller (and thus AD) up in order to affect this change.

As for the local admin password problem, you are going to need a boot CD that resets the Admin password in the local SAM database of the machine. Instructions can be found here.

Lastly - fix your DC, and deploy a second DC, ASAP.

Improve this answer
2
  • The main problem with fixing my DC is that it's broken really bad. "User accounts corrupted" bad.
    – Olivier Tremblay
    Aug 20, 2009 at 11:29
  • How did you reach this conclusion, "User accounts corrupted".
    – Izzy
    Aug 20, 2009 at 15:06
1

Question: Is there a painless way to make sure that the user can login, and keep his active directory settings?

Nope. He will not be able to login until the DC is back up. You could have him login locally with a non-domain password, copy his profile directory over the new one, and pray it works -- but you'll likely have some hickups. Fix that DC stat.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .