1

I have a setup here with a single domain controller and 4 servers which were whithin it's domain. The servers were brought down and are being repurposed, but we would like to keep backups of the machines around.

I am going through one by one and taking the backups, which requires that I login to these machines. I've been able to login to all the servers, except the domain controller. The domain controller itself seems to have not started all it's active directory services, and when one tries to login, it complains that the system cannot log you on now because the domain XXXXX is not available.

How can I login to this box?

Billy3

Improve this question

5 Answers 5

Reset to default
4

Start it in Directory Services Restore Mode (by pressing F8 at boot time), and you'll be able to log on using the DSRM password you chose during Active Directory setup.

Of course you remember that password, don't you? ;-)

(Almost no one seems to remember it when it's actually needed, i.e. when it's the only way to log on to a dead DC...)

Improve this answer
6
  • I didn't setup this domain, and have no access to that password. Yes, I can reset this password using a number of means. The problem is, sure, that lets me login to the DC, but the system is in safe mode and I can't do the backups from that environment.
    – Billy ONeal
    May 21, 2010 at 14:45
  • If you need to backup Active Directory and the system state, no, you can't do that in safe mode; but if you need to copy data from that server somewhere else, this will work fine. Besides, if AD services don't work on a DC and it is not in DSRM, there's just no way you can log on to it...
    – Massimo
    May 21, 2010 at 14:59
  • @Massimo: The backup needs to run over the network which is why it won't work from Safe Mode.
    – Billy ONeal
    May 21, 2010 at 15:40
  • DSRM is not Safe Mode, it's a DC without Active Directory. Network works. How could you use it to restore AD backups, otherwise?
    – Massimo
    May 21, 2010 at 17:52
  • Also, there's Safe Mode with Networking, but it won't help with an AD corruption, because AD services are vital to a DC even in Safe Mode. Only DSRM will let you in if AD doesn't work.
    – Massimo
    May 21, 2010 at 17:53
1

I actually had a similar issue this weekend - in my case, I had brought the DC up without a network connection by accident (the switch hadn't finished powering up). I rebooted it with the net connection active and it worked fine after that.

Improve this answer
1
  • +1, DCs love to completely die when they don't have an active network adapter :-(
    – Massimo
    May 19, 2010 at 20:12
0

Not sure with a DC, but if you unplug the network cable and login to a domain, sometimes you'll get lucky and the cached credentials will be there, allowing you to login; you need to know the password though.

Finally if it's just data, you may have some luck with CloneZilla to Acronis to mount/create an image of the disk(s).

EDIT:

My boot disk suggestion was incorrect, but this method may work for you: http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm

Improve this answer
6
  • 4
    there is no such thing as a local admin password on a DC
    – Zypher
    May 19, 2010 at 15:07
  • That trick actually still works in 2008... I've tried it once ^^
    – Oskar Duveborn
    May 19, 2010 at 16:56
  • Zypher, there actually is a local admin password on a DC; it's the one you set for Directory Services Restore Mode. Of course, you can't login as the local Administrator if directory services are up, i.e. if the DC was not booted in DSRM.
    – Massimo
    May 19, 2010 at 20:13
  • @Massimo, you are right. I don't think of it as an admin password but the recovery password .. aka the "oh #$!@# password" ...
    – Zypher
    May 20, 2010 at 5:31
  • 1
    Since it's a local account, it would be in the SAM database and should be editable by a recovery boot disk.
    – gravyface
    May 20, 2010 at 15:46
0

In my opinion you need to figure out what services are availble, and what is broken.

Is DNS running on the Domain Controller or on another box?

Is the "domain" still active - can you ping the domain? What domain related errors are in the event logs on the other servers?

Is your workstation part of the domain? Can you log in over the network from one of the other servers?

Can you mount a share on the dc? (eg net use * \dc\c$ /user:domain\admin)

Can you open a term-server connection (assuming this was turned on...)

Type: dcdiag.exe /s:[domain controller] What fails? (you may need to go to Microsoft to find this tool)

Along other lines, http://www.joeware.net/freetools/tools/findpdc/index.htm

Sorry no real help here - this is how I would start to work on this.

Improve this answer
1
  • No, none of the domain remains operational. I'm not trying to get the domain working, I'm merely trying to login to the single machine. The system can be completely removed from the domain for all I care.
    – Billy ONeal
    May 21, 2010 at 14:46
-1

Don't forget that the default username = administrator and the password = what you put in for the directory services restore mode password when you created the DC.

BW

Improve this answer
1
  • 1
    Wich is already mentioned in the accepted answer - 5 months ago.
    – pauska
    Oct 6, 2011 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .