Active Directory Corrupted In Windows Small Business Server 2011 - Server No Longer Domain Controller

Question

I have a rather bad problem with my Windows SBS 2011. First of all, I'll give the background to what caused the problem. I was setting up a new small business server network. I had my job about finished. The server was working great, all the workstations had joined the domain, and I had all my applications and data moved to the server. I thought I was done. But then it happened. I tried adding one more computer to the domain, and to my dismay the computer name was set to the same name as the server.

Apparently when a computer joins a domain with the same name as another machine that is already on the domain, it overrides the first one. For normal workstations, this is not a big deal, you just delete the computer from AD and rejoin the original computer to the domain. However, for a server that is the domain controller it is a whole different story. Since the server got overridden in AD, it is no longer the domain controller. The DNS service is not working and all kinds of other services are failing also.

So the question is, what are my options? I am embarrassed to admit it, but since this is a new server one thing I did not have setup yet was backup. So I have no backups to work from. I am worried that things are broken enough that I might need to do a reinstall. However, I already have several days worth of configuration into this server, so I would obviously prefer if there was a fix that would prevent me from needing to do a reinstall. All the server components are there and installed correctly, but they are misconfigured (I think it is basically just Active Directory). So I have the feeling that if I did the right thing I could solve the issue without a reinstall. Is there anyway to rerun the component that installs the initial configuration to "convert" the base windows server 2008 r2 install into a SBS? In other words in the program files folder there is an application called SBSsetup.exe, is there anyway to rerun this and have it reconfigure AD, etc. to work with SBS?

Any insight will be greatly appreciated. Thanks.

Solution

You have a DNS issue. You must have DNS running in order for AD to run. It is possible that the client registered its IP and broke things. (although for the life of me, I cannot believe AD would allow that)

Try this - find the workstation's IP then shut it down. Add that IP to the NIC of the domain controller. This should allow the computer name to get associated with the right IP address.

If it doesn't help, try uninstalling DNS and reinstalling. Once it is loaded run ipconfig /registerDNS on the DC to recreate the AD records

Comments

[mbrownnyc]

Just some quick ideas.. Did you run dcdiag? What do the SRV records in DNS look like? What is the SID of the DC? What is the SID of the workstation?

[ThinkerIV]

Here is a pastebin of the output from dcdiag: pastebin.com/RWmk0Wyz. As far as the DNS records, when I go to DNS it says The DNS server has not been configured. But the problem actually is that DNS is failing to start. So I cannot look at what the records are. How do I go about checking the SID stuff?

[mbrownnyc]

getsid. What are the errors that are logged when you try to start DNS? DNS is critical to AD, as it advertises the location of all offered services.

[ThinkerIV]

Here is the only error that DNS is generating when it is staring: Event Type: Error Event Source: DNS Event Category: None Event ID: 4000 Date: 11/18/2011 Time: 10:10:45 AM User: N/A Computer: [Removed From Post For Security] Description: The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it. Check that the Active Directory is functioning properly and reload the zone. The event data is the error code. Data: 0000: 2d 23 00 00

[mbrownnyc]

What errors do you have in Directory Service event log? You have to figure out how to get your AD started. Make sure that the DC is the only machine with its IP address. You can always use dcpromo to demote the DC essentially destroying the domain, but that's last resort.

[ThinkerIV]

In the Directory Service log there is first an information level entry : pastebin.com/HFXirQKE. Next there is a warning level entry: pastebin.com/KdJBce29. And last of all it makes an error level entry: pastebin.com/aAT1tQU5. What do you think my chances are? Should I just give up and do a reinstall?

[mbrownnyc]

I'm having trouble really wrapping my head around the issues as they seem to be quite large in count. You would have to troubleshoot each issue that has occurred, and fix it from backward and forward (each AD related service relies on another, etc, etc.). Depending on your time constraint, it would be a very good learning experience. However, rebuilding the domain by demoting the "last DC" then promoting it again might be faster. My suggestion is to have a back up in place, and even a secondary DC, so that you can seize rolls if necessary (even on a VM on secondary hardware).