I've the following simple configuration: 4 MS Windows Server 2008 SP2 virtual machines, one of them is the PDC of a small Domain Forest, one is secondary DC in the forest and two are members of the Domain. Initially there was well working DNS, but from some point in the past (around 2 months) the secondary DC has stopped to resolve correctly the domain names.
My suspects here are, this happened because some Windows Update has updated AD Services and from that point no synchronization between the PDC and the SDC could happen, also there is no direct (per DNS) connection between the DF and this secondary DC... But this is not the main problem.
The main Problem is, that one of the Domain Members has started to issue the error “The security database on the server does not have a computer account for this workstation trust relationship” upon logon (again around 2 months ago). Initially I've resolved this by disjoining and the rejoining the Workstation, but as this error came more than once, I've tried then the solution mentioned here.
Obviously I've did something wrong, then after that my PDC started to issue the same error upon the login... Since the PDC don't have a local administration account, my only access to the machine is via DSRM (starting the PDC in DSRM and using the DSRM Administrator account, allows me to log on the server).
But in DSRM the PDC acts as normal Workstation and there is no access to the AD DS (dcdiag, setspn and netdom does not work, telling me the AD DS is down Edit:- LDAP Error (49/52e) Login Failed or LDAP Error 81(0x51) - Server down).
Note, my Domain Administrator Account is still valid and works (when I disjoin and rejoin Workstations), I can't use it on the PDC only. My SDC has DNS malfunctions, so I'm unable to fix the AD DS Database from the SDC, because I didn't find out how to use the DS tools with IP-addresses instead of FQDNs...
The suggessted handling here also does not help much - I can't use any of the AD DS tools.
Looking in the Event Viewer pointed me to a duplicated HOST-entry in the AD DS configuration (Error 11) so now here is my question:
How can I regain the Domain-Level control over the PDC? Besides the obvious solution to scrap the current OS Installation and then reinstall the Server, how else can I regain the control over the machine?