4

Some background first: So I have two domain controllers (dc1 and dc2) running Server 2003 32-bit and 64-bit, respectively. They have not been able to replicate since sometime in 2012 which I hadn't realized when I started working at this company. Employees were still able to log into the file shares hosted on both domain controllers so I was told not to touch them. I added a VM running server 2003 to act as another domain controller to replicate with dc1 who holds the FSMO roles.

That VM recently died and I removed the AD role from that VM from dc1. Now I cannot log into dc1 using the Administrator account. I also cannot add any machines to the domain. Some users can get to the file shares on dc1 but most people can't. I ran dcdiag on both dc1 and dc2 and the results can be seen here.

So, my question is, is there anything I can do to get dc1 back? I'm not even sure where to start and I don't have anyone else but the internet to ask for help. I know I should remove AD from dc2 and re-add it but I don't want to do that while dc1 is in its current state of unrest.

Improve this question
5
  • 4
    Sounds like you're in waaaay over your head. Even with my very limited AD knowledge I can foresee this being quite a bit of work. (Quick chat with a more AD savvy person confirms this). I'd consider hiring external help. Good luck!
    – Dennis Kaarsemaker
    Jul 16, 2013 at 22:15
  • Thanks. I was kind of leaning toward trying to hire someone who knows what they're doing but I'm afraid the company won't let me. They don't believe IT is important. Although I guess it doesn't hurt to ask.
    – kiwi
    Jul 16, 2013 at 22:31
  • 1
    @kiwi I'd suggest at least airing your concerns with the company, then if the whole lot turns to ash, you at least have a defence as you'd have asked for help. If everything collapses around you, and you haven't asked for help, you could be the recipient of some serious finger pointing. As you were leaning towards getting help, that just confirms to me that, help is exactly what you need. It shouldn't be too difficult to sort the mess out, but if you're not 100% sure, there is nothing wrong with stepping back and asking for help, don't take risks, as people won't thank you when it goes wrong.
    – Bryan
    Jul 16, 2013 at 22:47
  • 1
    You are in a position where the $125 (or whatever it is) to call Microsoft Support will be well worth it.
    – mfinni
    Jul 17, 2013 at 0:23
  • Can you log into DC02 with the Administrator account, or DC01 with any account?
    – HostBits
    Jul 17, 2013 at 1:04

2 Answers 2

Reset to default
3

Can you create another 2003 VM and add AD to that, replicate our DC1, transfer roles and then fix dc2? Even that sounds like voodoo. Without a valid admin account in AD, anything you need to do is going to be a problem.

It seems like maybe your DC2 and DC1 split and then continued to run without being able to communicate and your user accounts are spread across both servers. Probably why they could still login, but I'll bet the admin's account password is different on both boxes (try the last known password and see if it works). (your bass un and pw errors seem to indicate they are different).

Are the times the same on each machine? I looked at your dcdiag dump, but am not familiar enough to be helpful with the errors you are receiving.

If it was me (and you aren't), I'd ditch DC1, have dc2 sieze the FSMO roles and then triage from there. But, without knowing more of your setup, it's likely you'll have some loss of data.

Improve this answer
3
  • I tried that earlier. I can create the VM but I'm unable to add it to the domain as it thinks there is no valid Administrator account and it doesn't want to believe I'm in the Domain Admins group. Would it make sense to change the admin password on DC2 to what it ought to be on DC1? I have no idea about the times. I can't get into DC1 to check.
    – kiwi
    Jul 16, 2013 at 23:02
  • Yeah, this is likely over your head like the comments above indicate. It's not impossible to fix, but you do need to know what you are doing to accomplish this and not make it worse. Find local support and pay them for their time. Odds are, management will start to get squirly when half the office can't get to their files/login. That might be the justification you need to move forward.
    – MikeAWood
    Jul 16, 2013 at 23:05
  • 1
    Totally agree on the last part, kill DC1 and just focus on DC2, you will lost some accounts and setup but you'll end up with something working at least.
    – Noor Khaldi
    Jul 17, 2013 at 6:48
2

I may suggest the following approach, but it's lengthy to apply:

  1. Take an image backup of both your DCs, if anything goes wrong, you have an image to restore
  2. Reset your admin password on DC1, Google is your friend here, but you use this helpful link if you get lost in the results: http://www.petri.co.il/reset_domain_admin_password_in_windows_server_2003_ad.htm
  3. Once you have access to DC1, try to see the difference between both servers in terms of AD objects created (as in users, groups, computers)
  4. If DC1 doesn't have lots of objects created in it, and that most of your objects are on DC2, then I'd recommend to kill DC1 just like the answer before me, focus your efforts on bringing DC2 into a healthy state, seize the FSMO rules, and then install a replica DC ASAP.
  5. If DC1 have lots of objects that are not on DC2, then try to install a new DC and join it with DC1 after you reset the DC password, replicate, seize the FSMO rules, make sure that new server is up and running and then BAM! kill DC1 (it'll have to die no matter what), make sure to install a new DC replica after you kill DC1

I have a feeling that you'll lose some accounts no matter what you do, but it's a matter of weighing which approach will make you lose less than the other.

Hope this helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .