1

I have around 100+ users in a windows 2008 active directory. There is only one active directory controller / server in the network. If the server hard drive crashed, and if I rebuild the active directory with the same name, the already authenticated users, computers are unable to login.

If I remove the computer from the domain and join back, the users will be able to login from that newly removed and joined computer.

How do I make sure that users will be able to login from their computer without rejoining the computers to the newly rebuilt domain. A new password for the users is fine, but rejoining all the nodes is a pain. All the settings, the domain names, the ip addresses etc - everything is same.

I know i'm missing something, but could not find more information on this in the net. Any help / advise is much appreciated. Thank you.

Improve this question
1
  • Two important things that are not the same are the SIDs (security identifiers) and the GUIDs (globally unique identifiers). Computers have domain accounts just like users do, so you have to re-create the computer accounts just like re-creating the user accounts. How do you re-create a computer account? You do it by joining the computer to the new domain.
    – Todd Wilcox
    Jun 19, 2015 at 14:13

2 Answers 2

Reset to default
5

The name of the domain is not important. The cryptographic secrets behind the scenes that the computers and servers use to authenticate each other are what defines if they are in the "same" domain. When you create a new domain, all of those secrets are different. Otherwise, someone could just plug in their own server to the network and pretend to be your server and steal all of your stuff.

The thing you're doing wrong is running only one domain controller. You should be running a minimum of 2 domain controllers, but 3 is the optimum minimum for a small, single-site network.

Improve this answer
1
  • 4
    I would add: "The first thing wrong is running only one DC. The second thing wrong is not doing System State backups."
    – jscott
    Jun 19, 2015 at 14:00
0

As Todd Wilcox has pointed out, the relationships between the clients and the domain depends on the SIDs and GUIDs, not the domain name, so you will have to do rebuilding. For other users, if you still have the opportunity to do disaster recovery from a System State backup, as jscott pointed out, do that instead and you can avoid resetting passwords.

Original Poster: You might try the two solutions for broken trust relationships at this link http://implbits.com/active-directory/2012/04/13/dont-rejoin-to-fix.html

The PowerShell command may access the domain by SID, so it might not be helpful. Then NETDOM command accesses the domain by the servername of the DC, so it might still work. You will probably still have to go to each computer and run these commands, but if they work, it will be faster then doing the reboots to rejoin the domain. If you have access to the machines with a local admin account, you might be able to push out the commands instead of visiting each one.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .