[before anyone corrects me I've used the terms secondary and primary colloquially and I understand the terminology]

I have a problem with my secondary DC, but not on any other server in the domain. Everything is Windows Server 2008. Virtualized using VMWARE. It appears to not be part of the domain anymore. Accounts appear "locked out" on DC2 but are not locked out on DC1. Active directory won't pull up on DC2 and I can't edit accounts to unlock DC2 locally.

Any network pings are "General Failure", including any other server by IP or DNS name. Ping TO the DC2 fail conclusively as well. Everything is fine in the adapter settings and it even shows "connected" to the correct domain, but it can't reach anything else. Services are fine. There are NO enabled firewalls or issues that would arise from connection problems.

I believe it may be a trust issue? I'm not entirely sure

  • Also, as a historical datapoint, I'm a programmer by nature, not specifically an administrator. While I'm not technically inept, DC's in general are causing me quite the headache. – Eric Anthony Nov 16 '18 at 17:46
  • Since it runs on VMware, restore a snapshot or backup? Reinstall the DC? Doing a reinstall or spinning up a new VM sounds so much easier than troubleshooting this. – Tommiie Nov 16 '18 at 17:49
  • I would agree. Except... the snapshots we had, were deleted. By a fat fingered employee. – Eric Anthony Nov 16 '18 at 17:55
  • We ARE in the process of reinstalling, but it has to go to a lab, be audited, corrected in a different environment and brought back *assuming they fix it. I'm losing about a week plus of productivity. At this point I'm willing to put in the time to troubleshoot. – Eric Anthony Nov 16 '18 at 17:56
  • 1
    A snapshot wouldn't help you. As soon as it is reverted to a snapshot, the domain controller would log a message that it was restored using an unsupported procedure, and disable itself. – Greg Askew Nov 18 '18 at 18:23

Firstly, don't "restore" DCs via snapshots. Just in case you were tempted. It's theoretically supported, but it's still deprecated by Microsoft. Check the article for other advice on virtual DCs (some of it is about Hyper-V, but it mostly still applies to VMWare - not using the VM host time for example).

Secondly, what is DCdiag /v indicating on the problem DC? Presumably you're able to log into it. That will normally give a pretty good indication of what's up, or give you things to google.

Thirdly, what is the DNS server configured in the network adapter on the problem DC? Change it to the other DC, if its DNS is functional.

Fourthly, if you can't figure out the issue and want to scrap and start again, if the functional DC in the domain doesn't have the FSMO roles, then sieze them. Ensure DNS client is working on the bad DC (if you can), demote it, clean up AD Sites and Services and start again. If you can't gracefully demote it, then shut it down, delete the computer account (which does the metadata cleanup), and clean AD Sites and Services. Make sure your functional DC is 100% functional before introducing a new DC.

PS. If you know that "primary" and "secondary" doesn't apply to Active Directory DCs, then don't use the terms.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.