Sheridan Posted August 30, 2013 Posted August 30, 2013 (edited) I've an odd problem with one of our primaries 2008 Servers. Its the single DC for their domain, and seems to be working mostly ok (people can login etc) but when you open the DNS console both forward and reverse zones cannot be accessed (they are AD zones). Also, when opening the ADUC console you can browse nearly all of the OUs, with the exception of Users which generates an error (system error) So I assumed this was a problem with the AD database as the DNS and Users OU are part of AD. Rebooting the server into restore mode and running the esentutl tool to repair the ntds.dit database results in an error at about 50% of the Defragmentation stage - saying there is an Illegal Duplicate (error -1605). So after many repair attempts (and also trying ntdsutil as well) I decided to revert to one of the System State backups created using Windows Server Backup - we have backups for the last 25 days and every one results in the same corrupted ntds.dit database! So it looks like this problem has been happening since the start of the holidays - unfortunately we only have the 25 backups taking is back to early August as the school itself was closed until today! So I'm a bit stuck now - the server is sort of working, but DNS clearly isn't and AD seems to be partially corrupt. Oddly Ranger is working fine as is DHCP so the staff are logging on OK - but I'd like to fix this without an OS re-installation if possible, although its looking likely thats the only option! Is there any other way to repair the AD ntds.dit database, or even a third party tool to do this as the MS one drops out with the error? Edited August 30, 2013 by Sheridan
Roberto Posted August 31, 2013 Posted August 31, 2013 Can you promote another DC in that domain and get things working through that? If not (and I appreciate this may be unaffordable) this would be the time to phone Microsoft support and open a case.
ConradJones Posted August 31, 2013 Posted August 31, 2013 now would be a time to review your backup policies and backup for longer than 25 days.
Sheridan Posted August 31, 2013 Author Posted August 31, 2013 Single dc in this place. And yes, I know all about backup policies but we only inherited this school about 3 months ago so all we've had time to do is check the backups were actually working! They are working but this error has remained unnoticed it has been backed up in that state! Is there any way to remove the dns zones from AD and then recreate them on a single dc ad integrated dns server?
kmount Posted August 31, 2013 Posted August 31, 2013 I'd look at dropping in a temp DC as a second box to at least let something sync and see whether it's "ok" on the far end (allowing you to sleep better) and go from there. Even a little VM would be sufficient and it'll help us see the lie of the land. Your 25 days of backups (albeit broken ones) are good enough for things not to get 'worse' as such as you can always revert back to this point in time. We can all go on about backup strategies etc but it doesn't fix the problem at hand so lets focus on that for now.
kmount Posted August 31, 2013 Posted August 31, 2013 Some stuff to read through below, some of it is quite old (very old) but it might help re re-creating zones etc. Re-Create _MSDCS zone? - Petri IT Knowledgebase Forums Domain subfolders missing from forward lookup zone How to recreate an accidentally deleted AD integrated DNS zone. Oops, our AD Integrated DNS zone 1
Sheridan Posted August 31, 2013 Author Posted August 31, 2013 Yeah I thought I might add in a spare pc as another dc, then demote the original, re promote it and eventually remove the spare pc totally after its all sorted. It's not a very well setup system we've inherited and its been poorly maintained over the years!
kmount Posted August 31, 2013 Posted August 31, 2013 Yeah, I think getting your image based back up onto some removable media is first step. Then introduce second DC since you know you have a good (broken) backup to go back to if needbe. See what happens on this second DC, plus that gives you a machine to mess around on knowing it's not the end of the world if you brick it. If we assume it is also "broken" on replication then we know we need to mend the data so we start looking at re-creating zones etc. Might just find it replicates fine, and replicates authoritatively backwards too..!
Sheridan Posted August 31, 2013 Author Posted August 31, 2013 It's frustrating as there is obviously only some minor corruption in the ntds.dit file but neither ntdsutil or esentutl can fix it! And it seems to be a duplicate entry causing the problem but I can't find a way around that either!
ConradJones Posted August 31, 2013 Posted August 31, 2013 How big is the network? How many users? How many PCs? Trashing it might not be a bad idea? (Might be quicker in the long run)
plexer Posted August 31, 2013 Posted August 31, 2013 MS may not offer support after those tools have been run according to one article I read until the domain is re-created in a supported configuration i.e rebuilt Ben
Sheridan Posted August 31, 2013 Author Posted August 31, 2013 I'd read that as well - besides if I have to resort to MS support then I would bet money on their solution simply be to reinstall AD. I might try and export everthing using ldifde and see if I can export the GPO's as well - its a network of about 50 PCs and 300 users so not massive.
ConradJones Posted August 31, 2013 Posted August 31, 2013 I'd read that as well - besides if I have to resort to MS support then I would bet money on their solution simply be to reinstall AD. I might try and export everthing using ldifde and see if I can export the GPO's as well - its a network of about 50 PCs and 300 users so not massive. i did this a few years back as fixing the broken ad wasn't worth the time, i wrote a small program in c# to export all the users and walked round and rejoined all the machines to the domain (although you could probably do this with psexec and netdom join ) recreated the GPOs. does the native GPMC let you export GPOs ? i think i AGPM does.
kevin_lane Posted August 31, 2013 Posted August 31, 2013 Just out of interest what does event viewer say also. Have you thought about moving the dns to a different server Only thing I would be also worried about is if you put in another dc whats not to say it copies the corrupted data across Also what was the last thing you did on the dc
plexer Posted August 31, 2013 Posted August 31, 2013 What about firing up a new domain controller in a new domain and using netdom to move over the computer accounts? Netdom move For user accounts Migrating All User Accounts Ben
Sheridan Posted September 3, 2013 Author Posted September 3, 2013 I'm going to try and add a new DC tomorrow and see if we can replicate - fingers crossed!
Sheridan Posted September 4, 2013 Author Posted September 4, 2013 So much for that idea, I can't join a new DC to the domain as DNS isn't working so the new DC can't find the domain!
Sheridan Posted September 5, 2013 Author Posted September 5, 2013 Well for anyone still reading this sorry tale - I managed to hack around with ADSIedit and delete the DNS zones and recreate them - which means the server is functioning almost normally. The AD database is till corrupt, as any attempt to read the contents of the Users OU causes an error and esentutl and ntdsutil cannot fix the fragmentation error in ntds.dit - oddly though you can still add users and computers to the other OU's though, so this might be ok until a holiday period when the server can be rebuilt fully!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now