G
Guest
1. running W2k server (SP4 with Rollup 1) on AD1 as PDC
2. added AD2 as SDC
3. promoted AD2 to PDC
4. migrated roles to AD2
5. demoted AD1 to domain member
System working fine, but several months later needed to replace AD2 with new
server (need to keep name and IP)
6. added AD1 as SDC
7. promoted AD1 to PDC
8. migrated roles to AD1
9. demoted AD2 to domain member
10. removed AD2 from domain
So far so good. AD1 working as DC.
11. added AD2-new as domain member
12. when logged in to AD2-new after reboot, Run command gone from Start
menu and Command Prompt access is denied; Administrative Tools missing from
menus; tried running dcpromo (onlyl worked by double click on executable) and
was able to add AD2-new as SDC, but could not transfer Roles to SDC to make
it PDC
13. All user accounts now being asked to change their passwords and if they
do, are locked out of system
14. AD1 is not restricted for the Domain Administrator in any way
Managed to get AD1 functioning as PDC and DNS server and other functions it
has, but need to find out what is causing decreased functioning of Domain
Administrator. There is a Group Policy that is set on an OU of RWusers (not
the User OU), but the Domain Administrator is not a member of that OU, it is
in the Users OU. That GP removes Run from the Start menu, does not allow the
user to save to the hard drive of the workstation and does not allow use of
USB ports, CD/DVD drive or floppy drive. I'm thinking that the GP was
initially set as part of the Default Domain Policy and that no one is owning
up to it. I've looked and cannot find where it might be set, but I may no
longer have rights to see it as Domain Administrator.
I need to try to clean this up and keep my AD setup and users. Suggestions?
My only other option that I can see is to totally remove the domain and
introduce a new AD2-new with a clean install of AD and the domain set up
there and then propogated to the other machines.
This is a time critical problem. Any help would be appreciated.
2. added AD2 as SDC
3. promoted AD2 to PDC
4. migrated roles to AD2
5. demoted AD1 to domain member
System working fine, but several months later needed to replace AD2 with new
server (need to keep name and IP)
6. added AD1 as SDC
7. promoted AD1 to PDC
8. migrated roles to AD1
9. demoted AD2 to domain member
10. removed AD2 from domain
So far so good. AD1 working as DC.
11. added AD2-new as domain member
12. when logged in to AD2-new after reboot, Run command gone from Start
menu and Command Prompt access is denied; Administrative Tools missing from
menus; tried running dcpromo (onlyl worked by double click on executable) and
was able to add AD2-new as SDC, but could not transfer Roles to SDC to make
it PDC
13. All user accounts now being asked to change their passwords and if they
do, are locked out of system
14. AD1 is not restricted for the Domain Administrator in any way
Managed to get AD1 functioning as PDC and DNS server and other functions it
has, but need to find out what is causing decreased functioning of Domain
Administrator. There is a Group Policy that is set on an OU of RWusers (not
the User OU), but the Domain Administrator is not a member of that OU, it is
in the Users OU. That GP removes Run from the Start menu, does not allow the
user to save to the hard drive of the workstation and does not allow use of
USB ports, CD/DVD drive or floppy drive. I'm thinking that the GP was
initially set as part of the Default Domain Policy and that no one is owning
up to it. I've looked and cannot find where it might be set, but I may no
longer have rights to see it as Domain Administrator.
I need to try to clean this up and keep my AD setup and users. Suggestions?
My only other option that I can see is to totally remove the domain and
introduce a new AD2-new with a clean install of AD and the domain set up
there and then propogated to the other machines.
This is a time critical problem. Any help would be appreciated.