5

Server 2012 R2, Server 2012, Domain Controller role

After experiencing some permissions problems on my domain I noticed that my 2nd domain controller appears to be corrupted in some way (I'm sorry the naming is confusing. When I say the 2nd DC, it is actually named vswbcdc1). I have included some screen shots below to explain why I think the DC is corrupted. I had previously made this DC the operations master and transferred all the FSMO roles to it. The original DC on svrwbc is installed on Server 2012, the 2nd DC on vswbcdc1 is on Server 2012 R2 in case that is an issue.

I thought maybe a viable solution was to remove the 2nd DC role from its server and the problem might go away when I add the role back in, but I can't transfer things back to the original 1st DC b/f removing the 2nd DC's role. When I tried to transfer the operations master back, I received these screens:

On the 1st DC which is where I want to transfer the ops master back to I get "ERROR" for the current operations master. I figured that can't be good: enter image description here

On the 2nd DC which is where I want to transfer the ops master from it initially looks OK, but upon clicking Change the error panel shown below explains there are problems with contacting the current FSMO role holder:

enter image description here

But the fsmo roles appear to still be with the 2nd DC: enter image description here

After I demoted the 2nd DC and tried to remove the DC role, the role removal terminated with this error.

enter image description here

All this leads me to believe the 2nd DC is corrupted, so what is the best course of action? My system is quite small and setting up AD DS again won't be a terrible pain, but I'd like to take the shortest path through this.

My questions:

1) Is there a tool to 'repair' DC's?

2) If not, is the info above enough to point to what I could go in and fix manually?

3) If necessary, can I just kill both DC servers and start over?

3a) Does all of the domain info reside totally on the 2 DC servers so that if I kill those VM's and rebuild new DC's, I won't have any lingering DC data hanging around?

Thanks.

Improve this question
4
  • 1. dcdiag, and fix error by error. 2. read above 3. Both DC ? a fresh install ? or it's a second AD you promoted ? a. Yes, if you kill both, your AD is dead while you restore a backup. What is the permission problem you had ?
    – yagmoth555 ♦
    Jul 3, 2015 at 1:02
  • Permission question: Visual Studio Team Explorer couldn't connect to TFS. In TFS Admin Console > Application Tier > Administration Console Users I tried to Reapply existing User Names (not sure what prompted me to do this). TFS couldn't reapply. In Reapply dialogue > Search, only the TFS server name showed in 'From this location' box. The domain was not present. Additional investigation uncovered the errors above. I 1st thought I caused this by changing IP addressing, but a fallback to before shows the same errors. So I'm focusing on this 2nd DC.
    – Alan
    Jul 3, 2015 at 16:06
  • Both DC's/fresh install question: Yes, both, not just the 2nd DC I made the operations master. The reason I ask is because I can't transfer the operations master back to the original DC. If I kill the 2nd DC only, the fsmo roles are still attached to the dead DC and I can't get them back, so I figured why not just kill both DC's and start over, as you say, fresh. My question 3a is to confirm all records of the fsmo role holder will die when I kill both DC's. Is that bad reasoning?
    – Alan
    Jul 3, 2015 at 16:15
  • Result of dcdiag: Failed 1st test, advertising. DsGetDcName returned info for the other DC, so I'm looking into why SYSVOL is not replicating, or at least I think that is my problem.
    – Alan
    Jul 3, 2015 at 16:42

1 Answer 1

Reset to default
3

Microsoft has a scenario of transfering FSMO roles from a "dead" server. It means you dont need approval from old fsmo holder or negotiation. New server simply states that now he holds fsmo roles. According to this scenario, you can simply turn off vswbcdc1 and seize roles by svrwbc

To seize an operations master role

Open a Command Prompt as an administrator: On the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.

At the command prompt, type ntdsutil, and then press ENTER.

At the ntdsutil: prompt, type roles, and then press ENTER.

At the fsmo maintenance: prompt, type connections, and then press ENTER.

At the server connections: prompt, type connect to server <servername> (where <servername> is the name of the domain controller that will assume the operations master role), and then press ENTER.

After you receive confirmation of the connection, type quit, and then press ENTER.

Depending on the role that you want to seize, at the fsmo maintenance: prompt, type the appropriate command, and then press ENTER.

https://technet.microsoft.com/en-us/library/cc816779%28v=ws.10%29.aspx

Improve this answer
1
  • Exact answer to what I needed & just couldn't find-thx! As a help to others who experience my same problem, if you're willing to, on the last line of the instructions you provided above, you might replace the text "the appropriate command" with "seize <specific role>, ex: seize PDC". It took me a little bit to remember to type 'help' in order to see the specific syntax. I also note for anyone running this, depending on the situation, the initial attempt of a safe transfer can take some time before the 'forced seize' is accomplished. The link above is important for other syntax issues.
    – Alan
    Jul 6, 2015 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.