Backup Domain Controller Screw Up

  • Thread starter Thread starter AC
  • Start date Start date
A

AC

Last week, I had a major hard drive failure on my Win2000 AD BDC. At any
rate, I set about the task of building a new one from scratch, and got to
the point where it was working again and replicating.

Then on the weekend, I had a brain storm, and got Norton Ghost to copy one
of the failed mirrors (with a few complaints), and low-and-behold, the
copy worked, and my original BDC was up and running...

Not! I suspect that I have completely messed things up, but now I'm getting
SAM errors, and its pretty clear that the AD network doesn't like the old
having the same name as the new.

At any rate, here's a sampling of the errors I'm seeing:

Event ID 16650
"The account-identifier allocator failed to initialize properly. The record
data contains the NT error code that caused the failure. Windows 2000 will
retry the initialization until it succeeds; until that time, account
creation will be denied on this Domain Controller. Please look for other
SAM event logs that may indicate the exact reason for the failure. "

Event ID 1586
"The checkpoint with the PDC was unsuccessful. The checkpointing process
will be retried again in four hours. A full synchronization of the security
database to downlevel domain controllers may take place if this machine is
promoted to be the PDC before the next successful checkpoint. The error
returned was: The destination server is currently rejecting replication
requests."

Event ID 2103
"The Active Directory database has been restored using an unsupported
restoration procedure.

Active Directory will be unable to log on users while this condition
persists. As a result, the Net Logon service has paused.

User Action
See previous event logs for details. "
 
Yeah, you've messed things up pretty well. I'd recommend using DCPROMO to
demote the old server back to a member server, then running DCPROMO again to
bring it back up as a domain controller in the new domain.

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm
 
Yeah, you've messed things up pretty well. I'd recommend using DCPROMO to
demote the old server back to a member server, then running DCPROMO again to
bring it back up as a domain controller in the new domain.
Click to expand...

I tried that, but because it can't authenticate, DCPROMO fails.
 
I tried that, but because it can't authenticate, DCPROMO fails.
Click to expand...

Alright, I think I did manage to fix it. I followed the steps in
http://support.microsoft.com/default.aspx?scid=kb;en-us;332199 and forced a
demotion of the domain controller in question. When it rebooted, it was no
longer even a member of the domain, and I just had to enroll it again. At
that point, another reboot meant I had to fix a few services that couldn't
find the right account, and then I ran DCPROMO to promote it back to a DC.
It's replicating like nuts to the primary right now, so I'm hoping my silly
screwup is done with.
 
Glad you got it figured out in the end. If not - well, you know where to
find us. :-)

--
Richard G. Harper [MVP Shell/User] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm
 
Back
Top