0

My Active Directory server crashed and I do not have a secondary DC, no RAID, no backup and the system disk is completely dead. I know it is bad and stupid to not have a backup but let's leave those discussions to other threads.

The server was domain controller, DNS and file server. The data disks are still working so the file server part is still accessible, including home directory of all users.

I have installed a new need to do the following steps:

  1. Create a new AD (I assume that it should have the same root domain name and same NetBIOS domain name as the lost AD had)
  2. Setup DNS server on the server
  3. Create new accounts for every computer in the network
  4. Create new user accounts for every user (assigning a new password to each and every user)

(Edit #1: more steps)

  1. Rejoin each computer to the new AD

Is it possible to remap old accounts against new ones? We have a source control system (Microsoft TFS) that is linked to our domain accounts (e.g. DOMAIN\user1). Questions: 1. Do you have any suggestions to the above scenario? 2. Is it possible to "remap" new accounts against old ones so that permissions are intact? E.g. TFS permissions.

When everything is up and running I will of course create a backup scheme, including image backup of the server and a secondary DC.

I have already started this recreation so any quick help would be greatly appreciated.

(Edit #2: more info on status)

  • The new domain is created (with the same name as the previous domain)
  • DNS is configured with forwarders
  • My user account (DOMAIN\james) is created
  • My computer is already joined to the (old) domain so I have to join a workgroup, restart, join the domain again.
  • When I join the new domain I cannot join "domain.lan" since it gives an error that the AD DC could not be found (DNS could not be found)
  • If I join the NetBIOS name "domain" it works but I get a long timeout and an error: Changing the Primary Domain DNS name of this computer to "" failed. The name will remain "domain.lan".
  • The name is then changed from "domain" to "domain.lan" which seems ok
  • After reboot a "Please Wait..." shows up, before the login and it stays for several minutes before it proceeds to login
  • I can login with the new domain account but when I try to add the domain account as a local admin I cannot choose "Active Directory" as locaion, only local accounts can be added - why is that?
1

Unfortunately all of the migration tools and API's require the source domain to be online to add sidHistory, so you could add the SID for user1 from the previous domain to the new account. But I think it is possible to edit sidHistory if you add a Samba4 domain controller to the domain.

http://cosmoskey.blogspot.co.uk/2010/08/online-sidhistory-edit-sid-injection.html

1

I assume your domain isn't terribly large.

WHat you really need to get up and running after Domain Services is DHCP. Then DNS. Make sure they're both running. The re-join workstations to the domain.

'Active directory' isn't a location, your domain is. You should be looking for your domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.