1

I'm kinda newbie in this Windows 2008 Server R2 configuration stuff, so I would appreciate any help regards the issue I'm facing.

After a Windows 2008 Server R2 clean install I created a couple of local user accounts and joined them to the administrators group, I tested them and I was able to log on with each one.

Then I installed Active Diectory role (DNS role implied) and runned DCPromo. The domain was created and promoted succesfully and I was able to log on into the domain from a client machine.

The issue began when I realized that I was no longer able to log on locally into the server (meaning LOCALMACHINE\localusername). I looked into domain user accounts and noticed that the local user accounts I created previously were now part of the domain. I consider a bad thing not being able to log on locally anymore, so in a shot to fix it I stopped the Active Directory service... my bad! Now I'm sort of locked up, I can't log either locally or as part of the domain.

Can someone please shed some light in this? What did I miss in the process? I tried googling but could find any straight forward solution or explanation. What concept I'm not catching?How can I promote a server to PDC and still be able to log on locally?

Thanks in advanced.

Improve this question
2
  • Additional advice - get the MS press books that accompany the classes that will get you certified on Win2k8 server. You will learn all about this sort of thing. Some folks may prefer Sybex or other study guides; I've had good luck with the MS Press. – mfinni Nov 22 '10 at 19:54
  • Actually I'm following the Sybex guide. Thnaks for the advice mfinni – jromero Nov 22 '10 at 20:05
6

When you install Active Directory, it removes any local accounts - this is well documented and intended functionality. As an aside, there are no primary and backup domain controllers any more - each DC is equal.

Reboot the machine - Active Directory should start back up again on reboot. If it doesn't, reboot again and keep tapping F8 and boot into Directory Services Restore Mode. You should then be able to log in and interrogate the Event Viewer for any clues why Active Directory isn't starting.

Improve this answer
6
  • I think he disabled the service... +1 for directory restore mode I can't believe I forgot about that option. – Supercereal Nov 22 '10 at 19:44
  • If this is the case, hopefully rebooting into Directory Services Restore Mode will allow login and allow the OP to re-enable the service. – Ben Pilbrow Nov 22 '10 at 19:45
  • Yes, that is correct. – Ben Pilbrow Nov 22 '10 at 19:55
  • ok, I rebooted and apparently AD service ran again! Now I'm logged on. So no local logon anymore once AD is installed? All is now managed through the domain, am I correct? – jromero Nov 22 '10 at 19:57
  • 2
    FYI - Every DC is NOT equal, theyre just not called Primary and secondary DC's any longer. There are "Master Roles", beware there will be cleanup to do if that first 'primary' server goes down or is removed in any way other than via dcpromo. Kind of like "Win95 - no more GPFs!" – user130764 Aug 2 '12 at 19:31
0

Once a member server is promoted to a domain controller it will no longer have local accounts. When you demote the domain controller it will ask you to set a new local administrator password. However I am not sure how you would restart the active directory service if you disabled it entirely. Here is a link for reference about local accounts not being available on a domain controller.

EDIT: like Ben said directory restore mode is your best bet with this.

Improve this answer
0

Once DCPROMO created , AD administrator Credentials will be replicated from Forest or Group account. in worst case, where the site connector or replication is not happening..

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.