DC wipe - how to backup the users / AD etc?

[k-strider]

I know you have said that you have been over everything with a fine toothcomb… have you expaneded every single folder in DNS and made sure there is absolutely no reference to the old ip addresses in there?

 

You also have an exchange server have you tried promoting that to a AD or some other Virtual Server move FSMOs and demote the Original ? again trawl the DNS cause sometimes things get left behind.

 

If that’s sorts out the Authentication ie the only connection issues then appear with connections to the server in question, then rebuilding it and moving the AD back *should* sort it out…

 

The NTFS permissions on other drive volumes remain as long as you don’t Format them lol..

 

File shares are kept in the registry can be exported and merged back in a reboot then they are shared again…

 

If you had to rebuild with exchange in the equation that would take a long time… it must be faster surly to try rebuilding the Server first… if it doesn’t fix then I guess you have to bite the bullet and rebuild the lot..

[tarquel]

Thanks for the reply... lemme break it up a bit...

 

I know you have said that you have been over everything with a fine toothcomb… have you expaneded every single folder in DNS and made sure there is absolutely no reference to the old ip addresses in there?

 

I've removed the DNS and installed it again, plus I've also removed *all* the entries from it as well - so unless I'm blind, I cant see it there.

 

You also have an exchange server have you tried promoting that to a AD or some other Virtual Server move FSMOs and demote the Original ? again trawl the DNS cause sometimes things get left behind.

 

Well, the change of IP range & "slug" problem [hehe] was about a year before I setup the Exchange 2k3 server so it isn't that. And no, I've never tried anything remotely like that with the Exchange server.

 

It was just a very simple setup on a new 2003 SP1 server FYI. The schema update kinda threw up probs with the 98 clients but that was a different matter hehe

 

If that’s sorts out the Authentication ie the only connection issues then appear with connections to the server in question, then rebuilding it and moving the AD back *should* sort it out…

 

um....

 

The NTFS permissions on other drive volumes remain as long as you don’t Format them lol..

 

File shares are kept in the registry can be exported and merged back in a reboot then they are shared again…

 

I know... have done a old NT4 domain > 2003 new domain setup [with a move of HDD with the homedirs on them so yep, I know that one - thus why I ask about the shares, because with the NT4 exported shares brought into the 2003 server back then, it worked great hehe [after I used the ADMT tool of course hehe]

 

If you had to rebuild with exchange in the equation that would take a long time… it must be faster surly to try rebuilding the Server first… if it doesn’t fix then I guess you have to bite the bullet and rebuild the lot..

 

rebuilding the DC - AD, DHCP, DNS, FileServer - is what I'm after. The easiest and quickest method, but as the LEA have kind of delayed me, I'm not going to get around to it.

 

...and it isn't something i probably want to rush in a single day either i guess lol

 

Cheers

Nath

[djm968]

You really do need to set-up a second DC, I did this for client a while ago but they had 2 DC's and wanted them both rebuilt!

 

Sounds like a DNS issue to me, I re-scoped a domain with an exchange server recently and had the same issue at first but found a reference to the IP in the active directory somewhere and after correcting this all was ok.

 

I can't think for the life of me where I found it, my have been sites and services.

 

If you do set-up a second DC make sure you remember to transfer all the FSMO rolls over.

[k-strider]

Sorry i don’t think i was being overly clear... Like djm968 says you really need to promote a second DC in your domain.

 

What I meant regarding the exchange server was that you could use that as your second DC. Or use a workstation that’s spare (or a virtual server on vmware/virtual pc) and put 2k3 on it. I have done this before.. move all the FSMO roles over to the new DC whether this is the Exchange Box or another PC.. (personally I wouldn’t use the exchange box, but I have dc-promo’ed and demoted an Exchange 2003 server and it was ok)

 

I though I read in your posts that sometimes people couldn’t access the server until it was restarted... perhaps I read wrong... so what i was trying to say was if you move the DC operations to another server then you could eliminate the Authentication / GP Processing away from access to actual files (work).. what I was thinking... was if the server “crashed” ie no access did the workstations also fail to login (domain x is not available) as well as fail to have access to the files/data... you see what I mean you could establish if the issues were AD related or Server Machine related.

 

Iif you actually want to destroy and recreate your directory I think I am right in thinking you are effectively going to have to export all your mail boxes and probably rebuild your exchange server as well.. whereas by trying to move the directory onto another PC and rebuild the file server would be much simpler if it works because you won’t need to fiddle with exchange at all. It would also have minimal impact on availability of your domain if you just move the Directory, even if it doesn’t fix the issues if I was in your position I’d be inclined to try and move the DC operations over to another Server before effectively destroying the domain, because rebuilding AD will effectively mean that.. I’ve never had to recreate a domain that has an exchange server involved.

 

I too still think it’s likely to be DNS related. In the forward lookup zone under the _msdc.yourdomain.whatever there are lots of folders like dc, domains, gc, and pdc which have service location pointers that point to the DC... when you create a new DC you will notice new records appear and when you demote the older one the references to that will disappear. Have you tried to repair your AD DNS?

A quick google brought up this not explicitly related http://www.petri.co.il/troubleshooting_dcpromo_errors.htm

It suggests using a tool called netdiag /fix part of the windows 2000 Resource Kit... it might be worth looking up. or seeing if there is a server 2003 equiv. tool

[k-strider]

Re your plan some reason i must have missed / not read this

 

Could I use this new server by attaching it to the domain and setting it as the DC? If so, and once that has been done, is it just a matter of:

- exporting the shares [from within the registry] - Yup

- exporting the Group Policies using the GPMC tool – these would replicate to the new DC so not required

NEW STEP move the FSMO roles over to the new server there are 5 i believe... google it.

- removing the old DC from the domain –yes but DC Promo it to demote it.

- erasing the C drive -yup

- installing 2003 SP1 again -yup

- attaching to the domain -yup

- premoting it again -Yup

- importing the shares reg file - Yup

- importing the group policies using the GPMC – not required this will replicate back from the other DC..

 

Personally i’d leave both servers as DC and put the GC on them both.

[bigjb]

I moved a 2003 dc over onto another box found the Microsoft File Server Migration toolkit invaluabe for copying the files and shares over.

 

http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.mspx

[Grommit]

 

Could I promote the Exchange box as the DC, wipe & reinstall the DC, attach to domain and promote back again?

 

I don't think that Exchange likes to be on a DC.....

[tarquel]

Thanks djm968 & k-strider for all your info.

 

I'm gonna have to leave it for now sorry. I dont want to rush it - plus I have to setup this new server which any insight from you would be very welcome at the moment.

 

The thread is: http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=4612

 

If you have a moment to look at it and suggest the quickest and easiest course, please do.

 

And feel free to grab me on msn if you want to explain something hehe

 

*heads off to Google to look up info*....

 

Many thanks

Nath