5

I "inherited" a domain where I have the following situation:

A - the domain currently in use (Server 2003/2000)

B - an older sibling domain, not used anymore, whose servers were dismantled some time ago without deleting the domain

I need to add a new server to the "A" domain but the procedure fails because the server tries to connect to "B" and can't find it. Fact is, it seems I can't do anything to correct this, because the previous admins screwed up the permissions, granting full control to the Enterprise Admins of a THIRD domain called "C", which doesn't exist anymore (as for "B", the servers have gone but no one thought about deleting the domain) and removing some permissions for the other Domain Admins. No passwords (except for "A") are known by anyone. Not one of the older servers is still around. I already tried to take control of my domain and doing the metadata cleanup, without success.

Is there anything I can do to recover the existing domain, or would it be better to migrate everything to a completely new one?

Thanks a lot!

Improve this question
2
  • Need more details. By "sibling" domain, do you mean another tree in the same forest? What do you mean by "granting full control" to the Enterprise Admins of a 3rd domain? How has control been granted? Is this another tree? Give examples like "a is dom1.blah.com, b is blah.com" etc so we can see the heirarchy. What exactly did you do when you tried to "take control" of your domain A?
    – Neobyte
    Commented May 26, 2009 at 14:21
  • Does your current domain (or a domain in the same forest) have the enterprise admins group?
    – K. Brian Kelley
    Commented May 26, 2009 at 20:08

2 Answers 2

Reset to default
1

Have you tried removing the phantom domain controllers?

Look at http://www.petri.co.il/delete_failed_dcs_from_ad.htm and http://technet.microsoft.com/en-us/library/cc755937(WS.10).aspx for instructions on how to remove servers that no longer exist in real life.

Improve this answer
1

Sadly, if the "Enterprise Admins" group is in another domain that no longer exists, then you have serious issues.

"Enterprise Admins" is a group created in the Forest Root domain and will not exist in any other domain in the forest. It's not clear if you have multiple forests or not, so I'll presume a single forest with multiple domains.

You can check whether you have a single forest, or multiples by using the Domains and Trusts tool. Open the properties for you domain in that tool and check the Trusts tab. If the domains "B" and "C" show as anything other than External trusts, then you have a single forest.

If you have a single forest, then domain "C" is your Forest Root. If that domain is unrecoverable, then you have no choice - a migration to a completely new forest and domain are the only option. You can never regain full control of the domain you have.

Most likely, your best option is a migration to a new forest and domain anyway, as it seems that what you have has been abused and neglected and you will probably encounter many more issues created by that legacy. The Microsoft provided migration tools are generally quite effective and will simplify most of the migration tasks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .