0

Have a newly minted DC (on VM) that is DC for a Tree Domain in our forest, and it's got issues. Unfortunately was the only DC I have promoted for this Domain when it went down.

The OS is in a bad way (Classes not registered, DCOM is offline, SFC and DISM do not function) and no network adapters are available for configuration so I cant reach it to promote an additional DC.

So at this point is it possible to Seize the offline DC's roles from a DC in another Domain Tree (same forest).

Or is there a better option in this?

I'm open to troubleshooting the above issues but so far everything I've gone thru usually ends with "you should just re-image". Of course even if I do get network back and am able to promote another DC i'll scrap this VM anyway.

I am hoping to avoid manually removing an offline domain from my forest so I can rebuild it.

UPDATE

After I found out that my network admin had enabled port security a switch with a VM host I was able to get the broken DC on network.

The machine is still very much broken but it is now working as a near fully functional Domain controller (not sure how).

My issue now is when I attempted to add a Secondary DC and Move FSMO roles the new DC did not complete it's initial replication correctly. I was able to move the PDC,RID and Infrastructure roles but the server is not replicating properly and because it did not actually initialize i cant do a D2/D4 restore (cannot edit the ADSI attributes).

I attempted to move the OperatialRoles back but the I get a missing binary's error from the broken DC.

Basically I need to get the second DC online so I can pull out the broken DC and re-image (I can't demote the broken DC because of the missing binarys).

0

So I was able to resolve most of this issue and here's what I found.

  1. My network admin enabled port security in restrict mode and the default for number of MAC addresses so the switch was a black-hole to all my VM's but not the hosts. Once that was fixed I got network back on the PDC and promoted an ADC.

  2. The ADC did not do it's initial sync correctly. Since Powershell was broken on the PDC I used Powershell on the newly promoted but still broken ADC and moved the PDC,RID, and Infrastructure roles to the new DC.

  3. Because DFSR had not done it's job on the new DC, DCDIAG showed that Advertisement was broken and the SYSVOL NTLOGON folders had not synced. Testing server: Default-First-Site\server

      Starting test: Advertising

         Warning: DsGetDcName returned information for

         \\DC01.xyz.local, when we were trying to reach

         DC02.

         SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.

Every article I read at this point said to do a Authoritative restore but I ran into an issue where the mDFSR-Enable and mDFSR-Options properties for the newly promoted DC were not changeable in ADSI edit. I found out I had to connect to the Schema running on the first domain controller to edit the properties for both of the DC's since the new DC had never really completed it's promotion correctly.

I followed this article to the letter once I got into ADSI.

https://support.microsoft.com/en-us/help/2218556/how-to-force-an-authoritative-and-non-authoritative-synchronization-fo

The new DC is now the PDC and passes all DCDIAG checks.

Unfortunately because all the binary's and classes are messed up on the old DC Unistall-ADDSDominController doesn't work and i'll have to remove it manually from AD/DNS and clean up the metadata.

https://techcommunity.microsoft.com/t5/ITOps-Talk-Blog/Step-By-Step-Manually-Removing-A-Domain-Controller-Server/ba-p/280564

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.