How to log in to a malfunctioning domain controller

active-directorywindows-server-2003

I have a setup here with a single domain controller and 4 servers which were whithin it's domain. The servers were brought down and are being repurposed, but we would like to keep backups of the machines around.

I am going through one by one and taking the backups, which requires that I login to these machines. I've been able to login to all the servers, except the domain controller. The domain controller itself seems to have not started all it's active directory services, and when one tries to login, it complains that the system cannot log you on now because the domain XXXXX is not available.

How can I login to this box?

Billy3

Best Answer

Start it in Directory Services Restore Mode (by pressing F8 at boot time), and you'll be able to log on using the DSRM password you chose during Active Directory setup.

Of course you remember that password, don't you? ;-)

(Almost no one seems to remember it when it's actually needed, i.e. when it's the only way to log on to a dead DC...)

Related Solutions

Active Directory – Can Domain Controllers Serve Other Functions?

You can and it works. I have about 40 branch offices and - for political reasons - a management decision was made to give each a full server infrastructure. For financial reasons it was a single-server environment in each, so it's all DC/File/Exchange (this was in the Windows 2000 days).

However, management of it is a nightmare, and my preferred rule is "a DC is a DC and nothing else goes on it". These are your most important servers, and if your AD goes funny you will have a horrible time getting it back right. If you can, give yourself the best chance of avoiding this by having dedicated DC roles. If you can't, beg, scream, whimper, bribe, threaten, prophesy, or whatever it takes to put yourself in a position where you can.

Seizing FSMO roles from dead Windows Domain Controller

Are the roles listed from netdom query fsmo the same ones I've seen listed elsewhere? For example, is Domain role owner the same as Domain Naming Master? Is RID Pool Manager the same as the RID role?

Yes, exactly. Not sure why they've got the names slightly different in that particular display.

What are the bad things that could happen if I seize one of these roles?

The seizure itself? Not a lot. Most of the potential issues that are warned about are about turning the old DC back on after it's had its role seized - and even then, there's a lot of hysteria out there for not a lot of risk; it takes some pretty strange scenarios to break anything with a seizure instead of a transfer of a role. To go on a tangent for a moment, let's go over the roles and the potential risks:

Schema Master: This one gets everyone pretty twitchy, but breaking it is not a terribly likely scenario. The documentation says that you should never ever ever turn the old Schema Master back on after seizing the role, which I call alarmist. The old server will be informed of the role change, and as soon as it is, it'll relinquish the role. The potential risk here is if changes are made to the new schema master, then the old schema master is brought online, then before it replicates from the other DCs, different, conflicting, schema changes are made on the old server. This situation is unlikely, but would destroy your domain.
Naming Master: Same deal as with the Schema master, you'd need to make changes (in this case, create a new domain in the forest) on the old DC, after seizing its role but before it gets knowledge of the seizure.
PDC Emulator: No risk, it's not responsible for anything where you risk divergence.
RID Master: You'd need a messed up replication structure to break this one - imagine that you've got 2 DCs; an old RID master that doesn't know its role has been seized, and a new RID master. In this situation, you'd need to create enough objects to exhaust the RID pool on both (they're handed out in 500s), and have them both assign themselves overlapping pools. Create objects with identical RIDs, reconnect the domain controllers, and watch the apocalypse unfold.
Infrastructure Master: Honestly, probably 50% of domains in the world don't even have a working Infrastructure Master at all, since it doesn't work when it's on a GC. In any case, you can't break it with seizure.

Will users notice?

They should not.

This set up has been going for a long time and people have been functioning more or less normally; is seizing the PDC role going to change this?

No. With a single DC, none of the functions of the PDC are missed at all, except maybe your non-PDC DC being unable to sync time with the source that it wants to (the missing PDC).

Moreso:

You'll only miss the Schema Master when you try to update the schema
You'll only miss the Naming Master when you try to create a new domain in the forest
You'll only miss the RID Master when you create too many objects and exhaust your DC's RID pool (this is probably the most likely for you to run into if you just keep running as is)
You'll only miss the Infrastructure Master for global catalog group updates in a multi-domain forest

Some of these documents predict dire consequences to having all roles on one DC. With a client base of no more than 20 - and perhaps less than 10 most days - is having all roles on one DC a real problem?

No - but get a second DC. You don't want to have your only DC fail.

Are there any caveats to performing the cleanup process recommended by Microsoft to remove the old DC from Active Directory?

Yeah - be careful. But sharpen your ntdsutil knives and tear the old data out - extra junk in there isn't helping the maintainability of the domain.

Best Answer

Related Solutions

Active Directory – Can Domain Controllers Serve Other Functions?

Seizing FSMO roles from dead Windows Domain Controller

Related Topic