Geeks With Blogs

Mike H. - Another Geek In Need... WebLog

Many of us have probably dabbled in setting up our own domain and forest for development purposes. For me - a domain is a must - I have my development environment that is heavily used to model development projects for clents - and I have my family - me, my wife, and 7 children with their own computers.

So, we have a fairly detailed setup on the home front - but the following applies to ANY environment in which your primary domain controller gives up the ghost - and you do not have an image backup of the PDC.

Foremost - clarity: In an Active Directory forest, where you have several domain controllers, but one primary domain controller (PDC) - you may think that you must RESTORE or recover this PDC to salvage the domain. In other words, if the PDC fails - is all lost? Nope, not at all. Unless you do not have backup domain controllers. If you do not - then reading the rest of this is moot - but if you do, then read on.

When you promote additional servers on your domain, and make them member DC's in the same forest, then your domain details are available to you - and you simply need to transfer the Operation Master role to another DC - but before doing that - there are the FSMO's - yea, something hardly anyone knows about: FSMO = Flexible Single Master Operation - something your PDC or master of operations - manages. If a PDC - and Global Catalog for that matter - goes offline, a backup DC will generally pickup and juggle traffic for the PDC. But what happens if the PDC crashes altogether, and you need to basically assign a member backup DC the PDC role?

FSMO must be transferred to a backup DC before that DC can assume the Master of Operations role. This is done at the command-line level, and you must be careful before you make this call - ONLY do this if you are sure you cannot recover the original PDC because once you do this - you cannot laterr recover the PDC and bring it online. It cannot be added back into the forest at all.

So, the FSMO roles and how we transfer these. In a word, you cannot simply transfer the FSMO roles because the PDC is off line and not available to authorize the transfer. However, you 'can' SEIZE the FSMO roles from the original PDC - even with the machine offl line.

Caution: Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

Open a CMD prompt on the backup DC you want to perform this on. At the command-line prompt, type Ntdsutil and press <Enter>.

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS>ntdsutil
ntdsutil:

At this prompt, type roles and press <Enter>:

ntdsutil: roles
fsmo maintenance:

Now type connections and press <Enter>:

fsmo maintenance: connections
server connections:

Now type connect to servername <serverName> where <serverName> is the name of the backup DC you are working on, and press <Enter>:

server connections: connect to servername hamddc02

Connected to hamdc02 using credentials of locally logged on user.
server connections:

At the server connections prompt type q and press <Enter>:

server connections: q
fsmo maintenance:

Now we are going to SEIZE the FSMO roles we want. NOTE: Out of the 5 FSMO roles, we are NOT going to seize the Infrastructure Master. We do not want to put the Infrastructure Master (IM) role on the same domain controller as the Global Catalog server. If the Infrastructure Master runs on a GC server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest. For now, we'll seize the following:

Seize domain naming master
Seize PDC
Seize RID master
Seize schema master

We do this by typig the line shown above. For example, to seize the domain naming master, type seize domain naming master and press <Enter>

You will receive a Windows dialog prompting to confirm this move - click <Yes> and then you'll see the attempt to safely transfer the FSMO role, a failure message, and then it will seize the role, assigning it to the backup DC you specified when you connected to the server above.

Once you have completed this for the 4 roles, type Quit to exit the utility, then Exit to return to Windows.

From the Start menu, select Run and enter dsa.msc and press <Enter>.

On the domain that is displayed, right click and select Operations Masters. You should now see that this backup domain controller (HAMDC02 in this case) is not the Operations master.

From here you simply re-create the failed domain controller, and promote it - joining it to this existing forest.

Hopefully others will find this useful.

Posted on Sunday, April 15, 2007 11:05 AM | Back to top


Comments on this post: How to recover domain when the primary domain controller failes and there are member domain controllers

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I like this Article, Thanks so much~!
Left by Michael on Apr 23, 2007 3:49 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
good document
Left by rajkumar on May 02, 2007 5:06 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
lost and canceled by 1n1.co.uk, how do I recover it
Left by Jamil on Sep 03, 2007 3:47 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Jamil,

Without knowing more of what the issue is, I'm not sure I can help at all - I'm not sure what you mean by lost and cancelled.

Regards...

MikeH...
Left by MikeH on Sep 03, 2007 5:58 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
how to transfer five roles primary domain failed
Left by Arbind kumar Singh on Oct 16, 2007 1:14 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
wow .. It's nice Steps.....Perfect Solution...
I really like it... Thanks so much....
Left by Sonali on Oct 30, 2007 7:36 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
"From here you simply re-create the failed domain controller, and promote it "

What do you mean? We are doing this to the additional domain controller ,right? so how to promote it again. andhow to re-create failed domain ?

Thanks
Left by Rukmal on Oct 31, 2007 1:55 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Rukmal,

That last line is referring to the setup of the OS that failed. The assumption is that it is the only other machine still available to be a domain controller - and it'll have to be re-configured and re-joined as a DC in the forest.

If, for example, the failed DC came back to life, after you had walked through the transfer of everything, and the Ops Master? And you simply wanted to bring it back on-line? This would fail. The machine has to be promoted all over again, and then joined as a member server.

Hope that helps..
Left by MikeH on Oct 31, 2007 3:43 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Its really thankful information
Left by Sachin Sharma on Nov 03, 2007 12:52 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hey,

As with most things in life, you only begin to to listen up when it matters. And this was the case for us recently.

Could i just add to the excellent write up, the following points for any person in the same boat: -

1. The seize command is a rather heavy handed route to undertake and only should happen as a last resort if the usual transfer is not possible. Don't be alarmed though if you need to go down this road. If the DC is limping till it gives up the ghost, try and transfer the roles without delay. In other words, if there is a chance to transfer then, do it otherwise fall back on seizing them.

2. The issue of never returning the same DC back into the AD had concerened me the most especially as it's written everywhere yet with no good explanation as to why. The main reason for it is that the AD will be competing with the downed server for the handling of the RID pool in particular. If this was to occur, any newly created items within AD will not get unique identifiers and start to cause unknown complications when calling on these ID's leading up to an unstable and very confused AD.

3. However, the above rule would only happen if the downed DC was not freshly rebuilt before returning to the domain. If the server _is_ the same one that left, then you can never bring it back into AD and promote it. However, if it's the same server physically yet was formatted and repartitioned with a fresh OS then its not technically the same server as the GUID of the new machine will be different. That's what is referred to when instructed never to bring it back - the GUID. So, when rebuilding you can even use the same netbios/dns name as the original since AD will hand it a new GUID on entry to the directory.

4. This then means that when removing the server (or rebuilding it from a crash) there will still be remnants of it within AD. You will then need to do a metadata cleanup via ntdsutil. To ensure that all records of the original server have been removed from AD, use the DcDiag /v command.

5. If you need to determine which servers are handling each of the 5 FSMO roles, use the "Netdom query FSMO /domain" command available from either the windows 2000 support tools or within the standard 2003 server.

Thanks again!

Pop
Left by Popolou on Dec 21, 2007 4:14 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
please send,

how to recover domain controller
Left by nawal on Jan 23, 2008 2:44 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Very Good Article....
Left by JOY on Feb 19, 2008 7:32 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
This article is very nice!
Left by mike tagle on Mar 23, 2008 1:24 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I followed all the steps, (really great article) but what does this last line mean "From here you simply re-create the failed domain controller, and promote it - joining it to this existing forest."

I have installed a new machine called it HAMDC02 join to forest using additional domain controller (becasue original PDC is nomore) and follwed all the steps for seizing roles to this new machine, who is running the roles now if not HAMDC02?

Please help?

Tahnks
Left by Zubair on Apr 02, 2008 6:37 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Fair question Zubair... Basically that means you take a clean new server - or the old one - after it has been renamed, and possibly run NewSID on it - and you re-join it to the domain.

The predicate is that you cannot join the older failed machine w/the same SSID/name.
Left by MikeH on Apr 02, 2008 6:57 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Thanks, but my question is which server is acting as Schema, Domain Naming, PDC and RID Master.

I have an exchange server installed and after this repair I want to extend schema, usinng additional exchange.

Thanks again!
Left by Zubair on Apr 07, 2008 4:30 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Zubair,

The 'member' server that was a member domain controller when the PDC failed - is the machine you would be working on.

Following the steps I outlined, you seize all of these roles as outlined - and this 'member' server becomes the new PDC/RID Master/Schema master of operations.

HTH's...
Left by MikeH on Apr 07, 2008 6:25 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi,
I just want to make sure of the FSMO transfer before I go ahead and follow your steps.
If I transfer the FSMO roles via ntdsutil to the BDC except for the Infrastructure Master, am I able to get the FSMO back to the original PDC once I have rebuilt the OS and re-installed all the necessary services to that machine??
I basically have a PDC with a failing disk and need to rebuild the machine.
Is that what we are looking at here?
thank you
P.S. - this is the most logical technical article I have read in years.
Left by Liam on Apr 15, 2008 10:32 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Liam... Good question.

In short, the answer is yes.

Remember, the member server that is going to seize everything will effectively become the new PDC/Master of Operations.

With that said, if you want to rebuild the failing machine, be sure to completely rebuild - meaning a re-installation / re-SID effectively - of the OS - so it "IS" new to the domain. If you seize all of these roles from the failing PDC to a member server, that failing PDC cannot take them back - you would essentially have to join it to the domain as a member server, then seize the roles back to the newly joined server.

Does that help?
Left by MikeH on Apr 15, 2008 11:19 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Yes!
One last thing..since I do not make the BDC (going to PDC) the infrastructure master I can basically take that role back to the "new" PDC when I re-install the services. Then seize the FSMO roles back to the "new" PDC when everything is up and running and joined to the domain again, correct?
Left by Liam on Apr 15, 2008 2:17 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
That would be correct, yes.
Left by MikeH on Apr 15, 2008 2:43 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Just a slight correction...you have in step 3 the syntax:

server connections: connect to servername hamddc02

On server 2003 R2, the correct syntax is "server" not "servername"
Left by dotnetnoob on Apr 26, 2008 3:18 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I have the same problem.
My server PDC had a problem of hardware. I made transfer the roles for the server BDC. Now I wanted to put it back as PDC. How do I restore this machine?

Thanks.
Left by Fernando on Jul 03, 2008 7:34 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Fernando... The predicate in seizing the roles from the original PDC are that it cannot be the PDC again. In order to introduce it back into the mix, you must reload it - and at the very least, run NewSID on it (you can Google that easily enough) and create a new SID / Name pair for the machine - join it back as a member server - and you can then seize the roles back to the newly joined machine - making it the PDC once again.

HTH's...
Left by MikeH on Jul 03, 2008 11:10 AM

# how to make the newly installed windows 2000 server as a primary domain controller from existing backup domain controller
Requesting Gravatar...
Hi, boys and girls, I am really in truble could any body help me in this regard
Left by Hashim on Aug 15, 2008 10:12 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
sir i cant not add more client on the same domain pls tell me what is the promblem
Left by abid ali on Aug 16, 2008 12:27 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Ok I have read this document and others. Well appreciated. regarding transferred FSMO's, I understand that the GC should not be on same server as Infrastructer Master because updates do not occur effectively on one or both (too slow or not at all) So that said, should GC be on a Dc to better server network users access and assure updating ) Thanks
Left by Johnny on Sep 24, 2008 12:41 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi Johnny... Good question.

I know in my office environment and development environment, the GC is on one of the DC's - but I do not know that this answers your question - or is the right setup. It's basically out of the box setup for me.
Left by MikeH on Sep 24, 2008 12:46 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Excellent posting, BTW. Our PDC on our dev network had an HD failure and crashed. I was looking for some simple instructions on promoting a backup DC to the primary, and this article made it a snap!

The GUI and DCPromo wouldn't let us do the promotion because normally the promotion would be registered with the current PDC. However, the current PDC was non-existent... We had to "seize" those roles.

Doing it through the cmd line did the trick..

Thanks a million!

BTW, this operation is still pretty dangerous, and I'm sure that we'll find issues. So, far I've had to redo any passwords and changes that were made after the PDC was lost.






Left by Wolverine on Jan 11, 2009 10:21 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
From SYCIP
Left by Edwin Soquerata on Feb 10, 2009 4:06 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I am under the same situation, but I have been through the same problem before and it is the only solution to seize the roles. But I have a question: When I reinstall my system can I name it the same name it had before and can I give it the same IP? for example: server1, ip:xxx.xxx.xxx.xxx
Thanks.
Left by Ed Sacerio on Mar 05, 2009 12:16 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Fantastic document saved my day. Thanks alot
Left by Joe Frixon on Apr 29, 2009 3:01 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi all,
Need help, Domain naming master role has error, but other roles are working fine, as i don't want to seize those roles and need a new domain naming master, what should i do?
Left by Mahesh on May 28, 2009 9:36 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Great article!

Have a network that has been running sbs 2000 for several years. I installed a second win2k box as a dc approximately 2 years ago and run exchange 2k3 on that box. The sbs box recently died and need to seize the roles. We don't want to have more than 2 servers in the office one being this win 2k box and another is a member win2k3 box.

What is the risk of moving all roles to the win2k box? And if necessary can the win2k3 box assume any of these roles after being dcpromo'd?
Left by Ben Gasser on May 29, 2009 10:16 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Just curious how this can work if you don't "seize" the IM role from the failed PDC. Once the other 4 are transferred to the BDC what happens to this role - wouldn't it still reside on the failed PDC that will know have to re-built?

Brando
Left by Brando on Jun 30, 2009 1:03 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
plz give a solution
Left by Mukesh Kumar Bharti on Jul 08, 2009 3:29 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Fantastic Article!!!

My PDC server has just recently crashed the HDD. Fortunately, I do have BDC joined as member. I finally followed this steps and managed this BDC to be PDC. I now need to reinstall new server and make it as BDC again.

Thank you very much and I do really appreciated!

Vises Kith
Left by Vises Kith on Aug 15, 2009 12:33 PM

# How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Awesome article!!! This sure helped out. I think it condenses 30 pages of filler material in some easy to understand steps. This article rocks!
Left by Miguel Fra on Sep 08, 2009 3:52 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Question when I try to seize the the domain naming master the window that pops up lists the server DC as DC=BWBCPA,DC=com but the domain the server belongs to is BWBOACC this worries me as BWBCPA domain exists at another site (there are trusts in place)
Left by rhouston on Sep 16, 2009 3:45 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Not to be an ahole, but take a look at all these articles.
Daniel Petri is an AD guru - he has free (like in 0$) articles concerning all AD questions including this one.
Left by Michael on Oct 07, 2009 7:35 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Appreciate that you posted this over 2 years ago but just wanted to offer my thanks for the article - our DC died about a week ago due to not liking a power cut and thankfully I learnt from last time this happened and had a backup DC running so I was able to switch the roles over to that machine and set up a new backup DC.

Much better than last time when I had to completely rebuild the office network - which was quite a learning curve for me as I'd inherited it from a colleague with absolutely no handover information whatsoever...
Left by Matt on Dec 07, 2009 6:26 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Great article!!! so clear!
Left by Ariel Martin on Jan 28, 2010 8:58 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
it is very useful information.i faced this type of quetions in my interview.so next time i will be clear about this concept
Left by nawas on Feb 27, 2010 7:49 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
i have using one primary domain controller and one additional domain controller. but my primary domain controller is crash. how to recovery all the thing and handling please give me a sugesion .
Left by balakrishna nahak on Apr 29, 2010 2:05 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
It is indeed a great article....

Please help on this issue. I am trying to join windows 2003 to a a domain control 2000. When I run adprep forest and domain, i get this error :




Adprep was unable to check the forest update status.

[Status/Consequence]

Adprep queries the directory to see if the forest has already been prepared. If the information is unavailable or unknown, Adprep proceeds without attempting this operation.

[User Action]

Restart Adprep and check the Adprep.log file. Verify in the log file that this forest has already been successfully prepared.

Adprep encountered a Win32 error.

Error code: 0x57 Error message: The parameter is incorrect..


Please help me.

Thanks,
Left by FCosta on May 29, 2010 4:21 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Interesting Article.

However you wrote that one shouldn't "seize the Infrastructure Master..." to GC server. So what to do if your working DC is a Global Catalog server? Should you skip seizing Infrastructure master role or seize it as well?

Regards

sogi
Left by sogi on Jul 05, 2010 6:08 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
What should I do in order to use the Backup DC as the new DC and forget about the old DC that failed.

I tried just following the steps above but it does not work. Something else is missing.

I'm a bit new at this so I excuse myself if the question is an obvious one.

Thanks for the article, I feel it helped although I missing a bit more ;-)
Left by Fernando on Jul 07, 2010 1:34 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Really superb document, Many Thanks
Left by Ramesh on Aug 25, 2010 2:14 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
We have domain controller (DC1) running with win2k3 and recently added an additional domain controller (DC2) through dcpromo /adv. My question is, what will i do if the DC1 failed or totally offline, how to get all the services of DC1 to DC2 because when i tried to shutdown the DC1 as my testing, the DC2 cannot open the Active Directory Users and Computers but when i open the DC1, it opens the Active Directory Users and Computers to DC2.

Does anyone could help me on this. Im newbie with Active Directory.

Thanks in advance and God Bless.

Bong

Left by Bong Ramos (Philippines) on Sep 03, 2010 7:36 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Is DC02 in the same forest as DC01? Make sure they are both part of the DC group as you are having problems replicating AD to your "backup DC".
Left by burb on Oct 19, 2010 2:29 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Good day,

I just got lucky to find this forum and have relevance to my existing structure.

I have a pdc and working properly. Later few months I deployed a bdc to support me in case that pdc fails.

Base on the forum, after seizing the roles except for the Infrastructure master means, all roles from pdc are transferred to bdc? and pdc cannot be joined as we have seized the roles and needed to be prmoted once again.

1. Does this mean that bdc is now pdc?

2. Should I be cleaning some dumps of info that was recorded from the pdc?

3. What does this mean: "On the domain that is displayed, right click and select Operations Masters. You should now see that this backup domain controller (HAMDC02 in this case) is not the Operations master." Should it be HAMD02?

4.What should I do with Infrastructure Master as it hasn't been seized?

5. Do I have to do more jobs as I don't have idea if above procedure is done till bdc is running.

Can you help me on this.

Thanks,
Jiggs.

Left by Jiggs on Nov 01, 2010 10:21 AM

# Thanks Man Alots ........
Requesting Gravatar...
Thanks man for this brilent article. Thanks alots. This step by stip instructions was very very helpfull. Thanks again.
Left by Mudassir Khan on Jan 18, 2011 2:28 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Thanks I found this very helpful. However, the last "Seize schema master" command failed with error "insufficient_Access_rights".
Left by Budzeg on May 07, 2011 1:03 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I just have one question. Will this work when your PDC is a windows 2000 server that failed and the backup is a 2008 server that needs to be promoted?
Left by Arleen on Sep 28, 2011 6:42 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Thank you for this incredibly helpful article! My company is starting to expand and thus has an even higher demand for server up time. So far we've not had any major crisis but I'm still saving a copy of this article for when that time comes.
Left by Dan on Jan 24, 2012 11:53 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Late entrant to the discussion....

It would make sense after a promote/seize is done you could bring the old one up off the network, demote and destroy the domain (as far as it's disconnected self is concerned it would become a stand-alone) and then bring it up and rejoin the domain...

I have a DC that failed with me 3,000 miles away, so I Promoted another DC to primary and left it down...

HOWEVER - the old primary DC also performed a number of other vital functions and I can't wipe it. Really just NOT an option.

I'll try this tonight - Hopefully it won't give me too much heartburn, and post the results.
Left by Jesse on Feb 24, 2012 2:03 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Did it with the following steps...

Recovered the original DC as a domain member using the following steps:

1. On DC1, Remove network connection / boot host.

2. On DC1, Force-removed secondary/tertiary active-directory servers. (DC3, DC4)

3. On DC1, run DCPROMO and removed Active Directory - (There were a couple of minor gotchas to do this - like an idiot I didn't write them down, but they were easy fixes, easily googleable. (is too a word) This removes all AD membership and makes it a stand alone workstation.

4. Shut down DC1

5. On the new PDC (DC2) removed DC1 as an AD server.

6. On DC1, connect network, boot server.

7. Join DC1 to AD as a domain member.
Left by Jesse on Apr 06, 2012 6:21 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Really Great Article Dude. Thanks a lot. You saved my time and my job.
Left by Keshav Reddy on Apr 21, 2012 5:58 AM

# How toTransfar fsmo roles PDC TO ADC when the primary PDC controller failes
Requesting Gravatar...
please give me solution
Left by Mangesh on Apr 26, 2012 4:39 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
it was very helpful. But schema master role didnt change. still DC dont work. Please help me
Left by Nomin on Nov 10, 2012 7:39 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Worked pretty good.
Some notes for Windows Server 2012: Make sure your shell is "Run as Administrator" or the seize command won't be available.
Commands are renamed slightly. Use "?" to list the new style commands.
The final step showed the backup DC as the operations master.
Left by Jeff Humphreys on Jun 28, 2013 7:21 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Worked like a champ.........thank you so much as i was completely tensed due to complete loss of my PDC.

with this article i could get everything up and working,
Left by Shashi Kumar on May 05, 2014 2:57 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
This worked great of be , failed 2003 PDC 2008 R2 BDC
Out of the 5 FSMO roles, we are NOT going to seize the Infrastructure Master. We do not want to put the Infrastructure Master (IM) role on the same domain controller as the Global Catalog server. If the Infrastructure Master runs on a GC server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a GC server holds a partial replica of every object in the forest. For now, we'll seize the following:
Seize domain naming master
Seize PDC
Seize RID master
Seize schema master

Oueston?
I have a new 2008 R2 BDC installed.
What do I do about Infrastructure Master (IM) role?
Thanks William
Left by William Berry on Jun 27, 2014 5:49 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Commenters have asked about putting the GC and Infrastructure Master together. The short answer is this:
If you can, put the GC role on two different servers, neither of which have the Infrastructure Master role. Put the IM role on a third DC.
If you cannot do this, and you have to put GC and IM together, then you simply put the GC role on EVERY DC. That eliminates the issue of the IM not populating.
Left by Scoundrel on Jan 19, 2015 2:12 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
After many hours trying to solve the problem, finally found something that works. Thank you so much!
Left by Thiago on Jul 13, 2015 9:25 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
I have one PDC and one additional domain controller. If my PDC stopped working due to Hardware problem and never be online . What will I do??
Time being I can use ADC.but in the future how can I create another ADC.
Left by AVR on May 28, 2016 2:54 AM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Dear Sir

I have parent domain called parent.ho with two server. One is primary server and another one is additional server in head office.
i have child domain called child.parent.ho with two server. One is primary child server and another one is additional child server in branch office.
They are connected with P2P link.
My problem is in child domain primary server. it is down because of hardware problem. I switched all domain wide roles to additional child server.
But still i am not able to see users and computer from additional child domain server. It gives error that " naming information cannot be loaded. The specified domain does not exist or could not contracted".
I changed PDC, RID, Domain naming master roles to additional child domain. And I switched global catalog server also to this server.
My forest wide roles are in parent domain primary server. What will be the problem and what option I need to check?
Thanking you for your reply.

Left by nawas khan on Aug 07, 2016 4:30 AM

# domain controller
Requesting Gravatar...
Hello
Dear sir i need to know that my domain controller is totally damaged and i dont have backup domain controller
some users can login with cached credentials and some don't and how to rectify and provide them the same user settings without removig from the domain
Left by anonymos on Sep 03, 2016 12:13 PM

# re: How to recover domain when the primary domain controller failes and there are member domain controllers
Requesting Gravatar...
Hi All,

My question is suppose if your PDC machine is not accessible means completely crashed so How to promote your ADC become as a PDC?

Kindly update the same.

Thanks
Ankush Mehra
Left by Ankush Mehra on Jun 23, 2017 5:43 AM

Your comment:
 (will show your gravatar)


Copyright © Michael J. Hamilton, Sr. | Powered by: GeeksWithBlogs.net