2

I have two domain controllers. One is failing replication. It has past tombstone expiration, so I have read it must be demoted and re-promoted. I cannot log in to this server anymore, because of failed replication and do not know if I can access a local admin account.

  1. Is there a way to fix replication without demotion? (Directory Services Restore Mode?)
  2. What is the proper method to demote/promote without RDP?
  • I've edited your question to be a little more clear. One thing to note is that DCs are multi-master peers. There are no "primary" or "secondary" DCs. – MDMarra Jun 16 '13 at 18:07
8

I have no logon access to this server anymore because of failed replication

You should still be able to log in. Replication doesn't have anything to do with this, other than you may have to use an older password for your domain admin account if you've changed it.

and do not know if I can access a local admin account.

There are no local accounts on DCs. You'll have to use either the Directory Services Restore Mode account and boot into DSRM, (you configured this account at the time of promotion), or use a Domain Admin account.

Is there a way to fix replication without demotion? (Directory Services Restore Mode?)

There are steps outlined on TechNet to fix this, however, the cleanest and most recommended method is to demote and promote again. DSRM does not figure in here.

What is the proper method to demote/promote without RDP?

If you can't RDP, then do a console session over your out-of-band management controller (iLO, DRAC, etc) or get physical access and use a keyboard and mouse. If this isn't an option, then you will have to do a metadata cleanup and reinstall the server. After you do a metadata cleanup, a reinstall and re-promotion will be the only way to bring that DC back into service.

  • Thank you for the detailed answers. Following my first question, I receive access denied when trying to login with any domain user. I assumed because replication is all wrecked it was denying access... Not so? – Seth Jun 16 '13 at 18:29
  • Nope. Like I said, the worst that will happen is that the newer passwords will not be replicated to it, so if you've changed your Domain Admin account's password, you'll have to use the one from the time of the last replication. Failing to replicate isn't going to magically change permissions or anything. – MDMarra Jun 16 '13 at 18:32
  • I agree with you, but the passwords haven't changed in quite a while, much longer than the replication has failed. Just trying to get in a session without having to make a trip – Seth Jun 16 '13 at 18:46
  • If that's the case, then you have larger problems than just replication failures. Do you not use out of band management? – MDMarra Jun 16 '13 at 20:31
  • Unfortunately no I have never configured DRAC. Definitely will change this. I have compared DNS records and everything seems in order, no warning events for DNS. But constant Event 2042 errors, and persistent Event 4 Kerberos errors. – Seth Jun 16 '13 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.