2

Preface: I'm not a trained sysadmin. Just trying to learn as I go. Please be gentle. :)

Background: So we rented a VPS to act as our domain controller. Joined ~500 of our laptops to it. GPOs were working perfectly (thanks to advice from grawity and others on my previous question). But the VPS was very unstable, kept restarting around every 10 mins for reasons I couldn't figure out. In the end I installed 2012R2 on the VPS instead of 2016, promoted it to domain controller again and reconfigured the GPOs. I also set up another VPS as domain controller to act as a sort of backup. The servers are stable and everything works.

Problem: After I reinstalled OS on the DC I can't see the ~500 laptops that were joined earlier among the list of computers. I checked 1 laptop and it still shows itself as a member of the domain and still has existing policies but "gpupdate /force" fails and I suspect that all the older laptops won't be receiving any further updates on GPOs. At this point I don't mind manually rejoining the computers but almost all of those laptops are in the field. So I could either ask for a recall which is not gonna make me any friends or send them a .vbs script to join the computer to domain again and ask them to run it which, even if I assume everyone does, the .vbs contains the root password to the domain controller so that's a non-starter. So here's my 2 questions:

  1. Is there any way I could rejoin those old laptops? Given that the laptops still 'consider' themselves as members of the domain. I think if I can just get them to show up in the domain computers list, I could reset the computer account and the trust issue should be solved... I think.

  2. We're unsatisfied with the support from the VPS provider and want to switch. Is there any way we can move to a new VPS with a new IP and not have to rejoin the computers again.

(I suspect the answer to second question would also answer the first one by default but I don't know for sure, so leaving it upto you.)

Bit of relevant info: We're using a publicly routable .net domain registered on godaddy. Using custom nameservers (ns1..net and ns2..net both pointing to the IP of dc1 as of now). Since the domain is publicly routable, we have set DNS of computers to 8.8.8.8 & 8.8.4.4 instead of the DCs ("gpupdate" works on newer computers with this configuration).

Thanks for reading and appreciate any guidance you can provide.

EDIT: System seems to have marked this question as duplicate of "Command to remove computer from non-existant domain". Completely different question though

8
  • @GeraldSchneider: Different question. This is about retaining computer in a domain after reinstalling OS on the DC.
    – Manoj Jain
    Nov 30, 2017 at 10:18
  • 3
    If you reinstalled windows on your only DC you have a new domain. It may have the same name as the old one, but the old one is gone. Nov 30, 2017 at 10:24
  • I think I get what you mean. What's my question though is, the older computers will still be directed to the new DC for all their DC needs. Is there a way the DC can accept those computers as members and create computer accounts for them if it doesn't exist? (potentially unsafe I know, that's why I intend to monitor and close it as soon as possible.)
    – Manoj Jain
    Nov 30, 2017 at 10:38
  • 1
    Oh, and of course every user account is new as well. You'll have to recreate all permissions. Next time you try something like this you should plan it better and create a temporary second DC. Nov 30, 2017 at 10:46
  • 1
    An afterthought: If you still have a backup of your old DC it might be worth to restore from that backup, promote a second DC and then reinstall your DC again. Could be a lot less work. Nov 30, 2017 at 10:47

1 Answer 1

1

Here are my recommendations (I have not tried any of this personally):

For the computers:

  1. Recreate all machine accounts from your backup lists.
  2. Reset all computer accounts.
  3. Create an account that has been delegated the single privilege "add computers to the domain."
  4. Write a script in the scripting language of your choice to rejoin the domain using that account and send it to the laptops, although there might be issues since they're remote. (They might not be able to find the DC remotely.)
  5. Either disable or reset the password of the temporary domain-joining account.

Assuming this works, this will take care of your computers but not the user accounts. Right now, your remote users are logging in with cached credentials.

For the users:

  1. Recreate all user accounts from a list.
  2. Issue them their original passwords from when you first set up the domain.
  3. Communicate to the users that their passwords will have to be reset.
  4. Set "user must change password on next login." This will hopefully reset their passwords, but you might have issues with the remote users.
  5. You might have to have the users reset their passwords through OWA or a similar web page type utility if changing their passwords first.

Please test everything before putting it into production.

I'm sorry I don't have a happier answer for you. Please consider setting up a second domain controller to prevent this from happening again, even if it's just a VM on your desktop. (That's not amazing practice, but it's a lot better than just not having a second DC--as you just discovered!)

You also might have issues with the order in which these things are done. Again, please test.

As for switching to a new VPS: The easiest way to do that would be to install Windows server on the new VPS and join it to the existing domain, give it time to replicate, then demote the old DC on the old VPS. I still recommend having a second DC, however.

Not the answer you're looking for? Browse other questions tagged .