syncronize domain controller

[Tom]

Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Richard G. Harper]

Event ID 3210 means that the domain controller cannot authenticate to the
domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend more time
trying to get it back onto the domain and synchronized than a full rebuild
will take.

 

[Steven L Umbach]

Computer account passwords expire after thirty days. Possibly you could try to use
netdom to reset it as described in the KB below, but I don't no if that will work for
a domain controller.

http://support.microsoft.com/default.aspx?scid=kb;en-us;216393

Another option would be to reinstall the operating system and dcpromo it to a domain
controller letting it replicate with AD again. Note that if you end up doing that you
will have to clean up the AD metadata using ntdsutil and the procedure differs a bit
depending on if you use the same name for the domain controller or not. You may also
want to post in the win2000.Active_directory newsgroup. See the link below for more
info.--- Steve

http://www.microsoft.com/technet/pr...de/part1/adogd03.mspx#XSLTsection128121120120

 

[Tom]

Thank you

Computer account passwords expire after thirty days. Possibly you could try to use
netdom to reset it as described in the KB below, but I don't no if that will work for
a domain controller.

http://support.microsoft.com/default.aspx?scid=kb;en-us;216393

Another option would be to reinstall the operating system and dcpromo it to a domain
controller letting it replicate with AD again. Note that if you end up doing that you
will have to clean up the AD metadata using ntdsutil and the procedure differs a bit
depending on if you use the same name for the domain controller or not. You may also
want to post in the win2000.Active_directory newsgroup. See the link below for more
info.--- Steve

http://www.microsoft.com/technet/pr...de/part1/adogd03.mspx#XSLTsection128121120120

 

[Tom]

My question is, if I`ll go for rebuild, can I delete the old one from the
AD easy? since it`s not the only DC in my network.
is the system going to look for that DC?

Tom

Event ID 3210 means that the domain controller cannot authenticate to the
domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend more time
trying to get it back onto the domain and synchronized than a full rebuild
will take.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Richard G. Harper]

You need to remove it from two places - Active Directory Users and
Computers, in the Domain Controllers list; also Active Directory Sites and
Services, expand Sites, then Default-First-Site-Name, then Servers. Once
removed from both places it will be as if the server never existed in the
first place.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

My question is, if I`ll go for rebuild, can I delete the old one from the
AD easy? since it`s not the only DC in my network.
is the system going to look for that DC?

Tom

Event ID 3210 means that the domain controller cannot authenticate to the
domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend more time
trying to get it back onto the domain and synchronized than a full rebuild
will take.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Tom]

Thank you

You need to remove it from two places - Active Directory Users and
Computers, in the Domain Controllers list; also Active Directory Sites and
Services, expand Sites, then Default-First-Site-Name, then Servers. Once
removed from both places it will be as if the server never existed in the
first place.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

My question is, if I`ll go for rebuild, can I delete the old one from the
AD easy? since it`s not the only DC in my network.
is the system going to look for that DC?

Tom

Event ID 3210 means that the domain controller cannot authenticate to the
domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend more time
trying to get it back onto the domain and synchronized than a full rebuild
will take.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Tom]

Hi again,
I tried to delete it from the AD users and computers, and I get a massage
"The DSA object can not be deleted".

What's that?

Thanks for the patience,

Tom

You need to remove it from two places - Active Directory Users and
Computers, in the Domain Controllers list; also Active Directory Sites and
Services, expand Sites, then Default-First-Site-Name, then Servers. Once
removed from both places it will be as if the server never existed in the
first place.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

My question is, if I`ll go for rebuild, can I delete the old one from the
AD easy? since it`s not the only DC in my network.
is the system going to look for that DC?

Tom

Event ID 3210 means that the domain controller cannot authenticate to the
domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend more time
trying to get it back onto the domain and synchronized than a full rebuild
will take.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Richard G. Harper]

See if you can delete it from the AD Sites and Services area, then wait a
bit (for changes to make it around the AD controllers) then see if it will
remove or if it is gone already.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

Hi again,
I tried to delete it from the AD users and computers, and I get a massage
"The DSA object can not be deleted".

What's that?

Thanks for the patience,

Tom

You need to remove it from two places - Active Directory Users and
Computers, in the Domain Controllers list; also Active Directory Sites and
Services, expand Sites, then Default-First-Site-Name, then Servers. Once
removed from both places it will be as if the server never existed in the
first place.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm

My question is, if I`ll go for rebuild, can I delete the old one from the
AD easy? since it`s not the only DC in my network.
is the system going to look for that DC?

Tom




Event ID 3210 means that the domain controller cannot authenticate

to
the

domain. I would suggest that you recover whatever data needs to be saved
from the server, then reformat and restore. You'll likely spend

more
time

trying to get it back onto the domain and synchronized than a full rebuild
will take.

--
Richard G. Harper [MVP Win9x] (e-mail address removed)
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


Hi all,
I have a win 2000 server which is a domain controller.
It was off for a couple of months, now it does not syncronize with the
domain.
and I get event id 3210.
I dont know what to do - please help.

Thanks,
Tom

 

[Ace Fekay [MVP]]

In

Computer account passwords expire after thirty days. Possibly you
could try to use
netdom to reset it as described in the KB below, but I don't no if
that will work for
a domain controller.

http://support.microsoft.com/default.aspx?scid=kb;en-us;216393

Another option would be to reinstall the operating system and dcpromo
it to a domain
controller letting it replicate with AD again. Note that if you end
up doing that you
will have to clean up the AD metadata using ntdsutil and the
procedure differs a bit
depending on if you use the same name for the domain controller or
not. You may also
want to post in the win2000.Active_directory newsgroup. See the link
below for more
info.--- Steve

http://www.microsoft.com/technet/pr...de/part1/adogd03.mspx#XSLTsection128121120120

Hi Steve, after re-reading his original post, he said he had it offline for
a couple months. Maybe (and taking in account the password synch error) that
its past the 60 tombstone. If so, as you said, a resinstall after a Metadata
cleanup may be in order. Here's a link for the poster on how to remove the
DC's reference out of AD prior to rebuilding this machine:

HOW TO Remove Data in Active Directory After an Unsuccessful Domain
Controller Demotion Q216498:
http://support.microsoft.com/?id=216498

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS-IS" with no warranties and confers no
rights.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

HAM AND EGGS: A day's work for a chicken; A lifetime commitment for a
pig. --
=================================

 

[Ace Fekay [MVP]]

In Ace Fekay [MVP] <PleaseSubstituteMyActualFirstName&[email protected]>
posted their thoughts, then I offered mine

its past the 60 tombstone. If so, as you said, a resinstall after a

Of course I meant the 60 day tombstone limit.


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS-IS" with no warranties and confers no
rights.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

HAM AND EGGS: A day's work for a chicken; A lifetime commitment for a
pig. --
=================================

 

[Steven L Umbach]

Hi Ace.

Thanks for posting that link and reminding me that metadata needs to be cleaned up
before the dcpromo. I suppose you can repair a dc computer account with netdom, but
I am not sure. I didn't recommend a restore of System State through Directory
Services Restore because I don't think it would fix his problem being that old. I
agree best bet would be to reinstall and clean metadata. It's not that hard to do if
one follows the instructions. --- Steve

 

[Ace Fekay [MVP]]

In

Hi Ace.

Thanks for posting that link and reminding me that metadata needs to
be cleaned up
before the dcpromo. I suppose you can repair a dc computer account
with netdom, but
I am not sure. I didn't recommend a restore of System State through
Directory
Services Restore because I don't think it would fix his problem being
that old. I
agree best bet would be to reinstall and clean metadata. It's not
that hard to do if
one follows the instructions. --- Steve

Very true Steve, its relatively easy. Hope the best for Tom in taking care
of this.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS-IS" with no warranties and confers no
rights.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory

HAM AND EGGS: A day's work for a chicken; A lifetime commitment for a
pig. --
=================================