HPlum78 Posted February 20, 2018 Posted February 20, 2018 Did you get the output from the Powershell I posted previously, could just do with knowing what's what.
rrrrr Posted February 21, 2018 Posted February 21, 2018 When you did the system state restore did you do an authoritative or non authoritative restore?
T_Lister Posted February 21, 2018 Author Posted February 21, 2018 Is this what you meant, HPlum78? Does not look good to me. Starting test: RidManager * Available RID Pool for the Domain is 2601 to 1073741823 * Server-01.Domain.local is the RID Master * DsBind with RID Master was successful * rIDAllocationPool is 1101 to 1600 The DS has corrupt data: rIDPreviousAllocationPool value is not valid * rIDPreviousAllocationPool is 0 to 0 * rIDNextRID: 0 No rids allocated -- please check eventlog. So from what I've learned so far from both I have two options? 1. Gamble trying to seize the role with Server 2 and then create a brand new Server 1 and forget the original? 2. I've currupted it truely and it's time to rebuild? rrrrr, they system state was last Thursday from the latest tape backup that was the previous Friday. There were not options for autoritave or non. Just restore from what I recall...
rrrrr Posted February 21, 2018 Posted February 21, 2018 Is this what you meant, HPlum78? Does not look good to me. Starting test: RidManager * Available RID Pool for the Domain is 2601 to 1073741823 * Server-01.Domain.local is the RID Master * DsBind with RID Master was successful * rIDAllocationPool is 1101 to 1600 The DS has corrupt data: rIDPreviousAllocationPool value is not valid * rIDPreviousAllocationPool is 0 to 0 * rIDNextRID: 0 No rids allocated -- please check eventlog. So from what I've learned so far from both I have two options? 1. Gamble trying to seize the role with Server 2 and then create a brand new Server 1 and forget the original? 2. I've currupted it truely and it's time to rebuild? rrrrr, they system state was last Thursday from the latest tape backup that was the previous Friday. There were not options for autoritave or non. Just restore from what I recall... How many dcs did you have in total originally? How many dcs failed and required restore? How many working dcs do you currently have?
HPlum78 Posted February 21, 2018 Posted February 21, 2018 @rrrrr the detail is in the thread, but the upshot is from what I have gleaned from this and the a previous post is that there a 2 DC's, both have been restored using system state backup but not using DSRM.
rrrrr Posted February 21, 2018 Posted February 21, 2018 @rrrrr the detail is in the thread, but the upshot is from what I have gleaned from this and the a previous post is that there a 2 DC's, both have been restored using system state backup but not using DSRM. By the sounds of it, both servers were restored using an authoritative restore causing the RID mismatch. If it was me, i would restore again doing the PDC as an authoritative restore first, then do the SDC as a non authoritative restore. This will cause the SDC to update all its records from the PDC and realign the RIDs
T_Lister Posted February 21, 2018 Author Posted February 21, 2018 If by DSRM you mean did I boot them into the safe mode first, then yes they were...
HPlum78 Posted February 21, 2018 Posted February 21, 2018 (edited) @Trenton_Lister Can we just clear up what @rrrrr is saying as I have not read that he has booted in to DSRM at any point, so any restore would be a non authoritative restore. and no this is what I mean by DSRM - https://dirteam.com/sander/2012/11/29/rebooting-windows-server-2012-based-domain-controllers-into-directory-services-restore-mode/ Oh an I will clear up an inaccurate comment I made earlier about restoring from system state backups, what I driving at was that a system state restore dose not give you the options of doing a authoritative AD restore you are still able to do this by booting into DSRM. Edited February 21, 2018 by HPlum78 1
rrrrr Posted February 21, 2018 Posted February 21, 2018 One server needs to be restored authoritative and the other needs to be non-authoritative otherwise you will get RID mismatch and syncing issues https://www.manageengine.com/ad-recovery-manager/authoritative-and-non-authoritative-restoration.html
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now