manick Posted December 13, 2011 Posted December 13, 2011 Hi all, We have a self created problem here and are trying to find a way back! We have 2 DCs each hosted on a seperate VM host. Due to problems with (what appears to be iSCSI) losing mapped drives, we decided to take DC2 down and bring it back up on another host. To cut a long story short, we got our knickers in a twist and brought up the wrong snapshot up (about 3 weeks old) which resulted in an older version of AD coming back up. We didn't realise at the time and happily carried on with what we were testing and then brought it back up on the original VM host. Now (obviously) replication is broken, causing all sorts of mayhem with GP not applying correctly etc. Is there any way to force DC2 to replicate from DC1 to bring it up to date? or is the only way to Demote DC2 and then Re-Promo it? Thanks for any help. Manick
jamesreedersmith Posted December 13, 2011 Posted December 13, 2011 If its only a DC/DNS server then dump it and build a new one!
jsnetman Posted December 13, 2011 Posted December 13, 2011 (edited) Do you not need to do a Non Authorative Restore on the duff DC, I think that would work. http://technet.microsoft.com/en-us/library/cc730683(WS.10).aspx Edited December 13, 2011 by jsnetman
3s-gtech Posted December 13, 2011 Posted December 13, 2011 Dump it and re-build. Lesson - do not snapshot DCs! System State them, but with the nature of multiple DCs you should not need to have snapshots anyway.
manick Posted December 13, 2011 Author Posted December 13, 2011 Thanks for that, It provides network shares, DHCP, DNS and is also a print server. I think what I'll do is bring up a DC3 and DCpromo it, attach the shared storage to it and then demote DC2 cleam it up and bring it back up. When i say snapshot, I mean a VM snapshot. Many thanks Manick
sparkeh Posted December 13, 2011 Posted December 13, 2011 (edited) Never snapshot a VM DC, it is not recommended by MS and bad things can come of it. I would try the Non Authorative Restore as suggested by @jsnetman as that should bring it in line with the other DC. edit: didn't actually mean this, see below. Edited December 13, 2011 by sparkeh
sted Posted December 13, 2011 Posted December 13, 2011 Never snapshot a VM DC, it is not recommended by MS and bad things can come of it. I would try the Non Authorative Restore as suggested by @jsnetman as that should bring it in line with the other DC. i suspect if its the only dc its not that bad but with multi dcs somethings bound to go wrong
manick Posted December 13, 2011 Author Posted December 13, 2011 Hi, Is it the case that I should be able to just do a Demote and then promote it again? Surely when It's promoted it'll pick up AD from the remaining workable DC1? Again, thanks manick
3s-gtech Posted December 13, 2011 Posted December 13, 2011 When i say snapshot, I mean a VM snapshot. I realise, as @sparkeh says you must not snapshot a VM DC. In theory, it should pick up again from the remaining DC if you dcpromo. Make sure that has all necessary roles and that AD works okay with just that one online.
sparkeh Posted December 13, 2011 Posted December 13, 2011 Sorry I didn't actually mean to use the process linked to by @jsnetman but rather the process for Nonauthoritative restore here: Using the BurFlags registry key to reinitialize File Replication Service replica sets Read the article and I think it applies to your situation, the process just makes the borked AD reinitialise with the good AD.
m25man Posted December 13, 2011 Posted December 13, 2011 Does this not underpin the argument about maintaining a dedicated hardware server for the sole purpose of maintaining the AD? Thats what we do, we always have a 1u single cpu server with a pair of mirrored (preferably SAS HDD's) and a USB drive attached using the Windows 2008R2 bare metal backup running. It does very little else than maintain a bullet proof copy of the forest. Everything else is virtualised.
ricki Posted December 14, 2011 Posted December 14, 2011 HI If a windows 2008 domain controller that has not spoken to the other domain controller for a bit it will refuse to replicate. Now you need to do some reading before doing any of this and make sure you know what the consequences are. Event ID 2042: It has been too long since this machine replicated: Active Directory Richard
sparkeh Posted December 14, 2011 Posted December 14, 2011 @ricki from the info given by the OP its does not look like he is in that position, there is no mention of that error and the AD is different by three weeks which is much shorted than the tombstone period.
HallX Posted December 14, 2011 Posted December 14, 2011 Does this not underpin the argument about maintaining a dedicated hardware server for the sole purpose of maintaining the AD? I was on a 2008 server course 3 weeks ago, instructor told us in no uncertain terms, NEVER virtualize a live DC, always use a dedicated hardware server. This is MS advise.
sparkeh Posted December 14, 2011 Posted December 14, 2011 I was on a 2008 server course 3 weeks ago, instructor told us in no uncertain terms, NEVER virtualize a live DC, always use a dedicated hardware server. This is MS advise. Can you clarify this? Are you saying you were told never to virtualise a DC?
HallX Posted December 14, 2011 Posted December 14, 2011 Can you clarify this? Are you saying you were told never to virtualise a DC? Thats right.
irsprint84 Posted December 14, 2011 Posted December 14, 2011 Can you clarify this? Are you saying you were told never to virtualise a DC? You can virtualise a DC 100% though always have a physical DC, dpm 2012 will actually allow you to snapshot a DC though not sure how this will work
sted Posted December 14, 2011 Posted December 14, 2011 You can virtualise a DC 100% though always have a physical DC, dpm 2012 will actually allow you to snapshot a DC though not sure how this will work at a guess it will replace the domain info from the snapshot with current info from a n other dc before it finishes restoring the snapshot
sparkeh Posted December 14, 2011 Posted December 14, 2011 Thats right. Ok well that's not MS advice at all. MS actively promoted the benefits of virtualising, the advice is to retain one hardware DC.
K.C.Leblanc Posted December 14, 2011 Posted December 14, 2011 Thats right. Are you sure they didn't mean perform a P2V conversion an existing DC?
CyberNerd Posted December 14, 2011 Posted December 14, 2011 Does this not underpin the argument about maintaining a dedicated hardware server for the sole purpose of maintaining the AD? No, it underpins the argument that you should RTFM before messing with live systems.
sparkeh Posted December 14, 2011 Posted December 14, 2011 Are you sure they didn't mean perform a P2V conversion an existing DC? Nothing wrong with that either, in fact there are MS tools to do this.
irsprint84 Posted December 14, 2011 Posted December 14, 2011 Nothing wrong with that either, in fact there are MS tools to do this. Its redundant anyway might as well bring upa new DC and move roles over I wouldnt try and P2V a DC
sparkeh Posted December 14, 2011 Posted December 14, 2011 Its redundant anyway might as well bring upa new DC and move roles over I wouldnt try and P2V a DC Depends, when my single DC site server was failing and couldn't be fixed, P2Ving it onto a new VM host was a Godsend.
irsprint84 Posted December 14, 2011 Posted December 14, 2011 Depends, when my single DC site server was failing and couldn't be fixed, P2Ving it onto a new VM host was a Godsend. ok I ll let you off
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now