hi, am almost lost. our server started acting weird after improper uninstallation of exchange 2010. system state (from tape) didnt work either. so we had to rebuild it. this is our Primary DC, we have Backup DC too. before proceeding to knock down the server, i transferred the PDC, RID master, Infrastructure roles to BDC and rebooted both. did a clean installation & restored the system state (from windows server backup) to the time when it is working good. all roles are restored fine, server is ok now apart from DNS. it is creating this logs "The DNS server was unable to open Active Directory. This DNS server is configured to obtain and use information from the directory for this zone and is unable to load the zone without it" and i could not join any new PCs into domain. some users are not able to login to domain. logon screen comes up, after putting in username and password, just a blank screen comes up with their wall paper. tried renaming the old profiles with no luck. admin can login and local users can. could some one please help me. thanks

our Primary DC There is no primary and secondary DC. All DCs are RW except RODCs. before proceeding to knock down the server, i transferred the PDC, RID master, Infrastructure roles to BDC and rebooted both. did a clean installation & restored the system state (from windows server backup) to the time when it is working good. What I understand is that you have transfered FSMO roles to another DC and then restored the old DC using a backup that dates before the transfer. => You have two PDC, RID and infrastructure masters. Note that this cause severe problems. The action plan is following: Disconnect the DC to which you have transfered the FSMO roles Perform an authoritative restore of the DC that was the original holder of FSMO roles Perform a non-authoritative restore of the DC to which you transfered FSMO roles that dates before the transfer proceed like that and then check if your problem is solved or not. Note that it is not recommended to run Exchange on a DC and I suggest running it as a member server. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Hello, the second DC in the domain is it also GC and DNS server? Are the clients configured to use it as DNS server on the NIC? If you have a crashed DC because of that application problems with Exchange on it, which btw. is not recommended from Microsoft, then better remove the crashed DC complete and install it from scratch. To add it then again to the domain run metadata cleanup on the second DC and remove the broken one also from AD UC, AD sites and services and from the DNS zones and zone properties. A system state backup is time critical and should not be older then the tombstone lifetime: http://support.microsoft.com/kb/216993Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Disconnect the DC to which you have transfered the FSMO roles Perform an authoritative restore of the DC that was the original holder of FSMO roles Perform a non-authoritative restore of the DC to which you transfered FSMO roles that dates before the transfer thanks for the reply. i will try out of hours, it is our main server (crashed-DC1) with file shares on it. i dont have the backup for DC2. if it works, i need to demote the DC2 as a member server to install exchange. i will keep you posetd. Hi Meinolf, yes DC2 is GC. it is DHCP server as well with serving DNS its own IP. i did clean install, but after that i did restore system state which complexed the issue.

ok i decided to do a clean install, no restore anymore, as it is complicating the issue further. just started installation. the steps i planned are clean install DC1, join domain, dcpromo transfer the FSMO roles back to DC1 install the required roles and features demote DC2 as member server. any feedback? please. thanks

ok i decided to do a clean install, no restore anymore, as it is complicating the issue further. just started installation. the steps i planned are clean install DC1, join domain, dcpromo transfer the FSMO roles back to DC1 install the required roles and features demote DC2 as member server. any feedback? please. thanks Just a question. Have you restored the DC with its old FSMO roles after you had transfered them? means that you had two FSMO holders online. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

at the moment yes. but now am re-installing server. i wont restore it again. will re-build everything and probably restore some data files. once i transfer the roles, i will demote DC2. that means i will be having only one FSMO holder. let me know if u need more info, i need to get it up n running by tomorrow morning. forgot to say, we have once more DC(3) at branch office which replicates over site-to-site VPN.

The problem is that, you had two RID masters. Based on MOC (Microsoft Official Courses), this may cause data corruption which may oblige you to reconstruct your domain. It is for that it is possible that your action plan will not be efficient. To make sure that all is okay, I recommend that you follow my action plan that I mentioned in my reply. Start by performing a backup of all present DCs and proceed like I mentioned in my first reply. If your third DC had not received replication from your head office DC, you can: Force demotion of your head office DCs Perform a metadata cleanup Resize FSMO roles to the 3rd DC Promote again your head office DCs This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Hi, forgive me for this. due to time factor, i acted a bit quick. as of now, i re-installed the OS on DC1. so now DC2 is having FSMO roles. DC3 is replicated. now please tell me my next steps.

Hi, forgive me for this. due to time factor, i acted a bit quick. as of now, i re-installed the OS on DC1. so now DC2 is having FSMO roles. DC3 is replicated. now please tell me my next steps. if i can get DC1 up n running, i dont have to run DC2 anymore. anyway i will be demoting it to member server to install exchange. sorry for being a pain, my situation now is as described above. please guide me from here. thanks forgot to say, i did a metadata cleanup on DC2 at the moment.

Please follow the steps I mentioned. Like I said, having two RID masters may data corruption which may oblige you to reconstruct your domain. I don't know if your domain had been affected by that or not. Please proceed like that (I suppose that DC1 is also a GC): Disconnect your current DCs Perform a restore of your DC1 (from the backup you performed before the appearance of your problems) Perform a metadata cleanup on it Force demotion of DC2 and DC3 and then promote them again of DCs Please backup all current DCs before proceeding. Don't demote anything before proceeding by backups as you increase the risk of losing your domain. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

thanks. i will do that, will update you once i did it. just to know, what are the symptoms of data corruption affect on domain.

hi, how far does the restore from a backup tape work. i have a backup image, but it was taken after the problems are started. i dont have image backup on tape. have system state, C drive backup for system when it is clean, without any problems. using symantec backup exec.

Hello again, for restore, you can use the system state backup that you have. Please follow all what I mentioned before proceeding to avoid the lose of your domain. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

yep, i will follow. doing it now. thanks

Don't forget performing a system state backup of remaining DCs before demoting them like I mentioned previously. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

a bit confused here. i dont have any backups for remaining DCs. i am just backing them up now. removed all the network connections as you said and restoring DC1 now. please be more specific. thanks

I mean back up them now :). It is what you are doing. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

sorry, misread it. performed the system state restore on DC1, when rebooted, i can see the roles in server manager but not in administrative tools. ohhh.. more problems, when i click on ADSS in server manager it says, "naming information can not be located because: the specified domain does not exist or could not be contacted. contact your system admin to verify that your domain is properly configured and is currently online." same with ADUC. do i need to run DCpromo.exe before i restore it ??

Hello again, I assume that the DC is also a DNS server. Make sure that it points to itself as primary DNS server. Once done, run ipconfig /registerdns and restart netlogon. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

do i need to do DCpromo before restore?? i just restored it after a clean install. didnt make any changes.

did it. still no luck. when i am in DS restore mode, there is a message popping up in server manger "this server is not yet running as a domain controller. run the dcpromo.exe" any chance i can skype or gtalk you ? running out of time..:-(

Looks like that this backup dates before than this server was a DC. So, you said that you have no other backups. Now the only option is to connect other DCs and then to promote DC1 as a DC. Hope that having two RID masters did not an impact on your AD environment. Proceed like that and try creating AD objects and check if you are able to perform that without problems. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

thanks for your time. if any success, i will update here.

hi, i can not even join this server (DC1) into domain. it says, it can not resolve DNS name, blah..blah.. verify target server. any idea ?? checked DNS server on DC2 which is not running. any idea to fix this ?

You should have at least a DNS server. Make your DCs point to this DNS server for DNS resolution and then install DNS on them and your AD-integrated zones will be replicated. After changing IP settings please run ipconfig /registerdns and restart netlogon on DCs. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

ok here you go. i managed to join the domain and promoted it to DC(1). i tried to join my laptop into domain by giving DC1 IP as primary DNS. its not working with DC2 as primary. so now what should i do. i backed the system state now. should i transfer the roles from DC2? or should i just demote DC2 ? or disconnect DC2 and restore DC1 from my earlier backup (!!)? hope you are still there, please help me, am almost there. anyway when i joined my laptop into domain, it joined. but still saying domain does not exist,

Hello again, I have not understood what you said. After promoting DC1, make it a DNS / GC server. Please check that you are able to create AD objects without problems (user accounts, computer accounts ...). This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

hi, i did not create any. they are all replicated. now domain is working fine, but i could not demote the other two servers. should i transfer the roles before demote them.

hi, i did not create any. they are all replicated. now domain is working fine, but i could not demote the other two servers. should i transfer the roles before demote them. I said try creating AD objects to check that all is okay with RID master. I know that it will get replicated. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

yeah, can create AD objects now. anyway, i joined two other PCs onto domain last night to double-check whic wasn't working earlier. now i guess all is well. can i go ahead and demote remaining two DCS and rejoin them, what are the steps i should be carefull of ?

Ok. I assume that when you had two RID masters online did not gave negative affects on your domain. That was what I was scared about. Why do you want to demote other DCs and rejoin them? Please use Microsoft Skydrive to upload the output of these commands on all your DCs so that I check that all is okay or not: ipconfig /all >c:\ipconfig.txt [from each DC/DNS Server] dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more then one DC exists)] dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045) Once done, post a link here. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

Why do you want to demote other DCs and rejoin them? i thought you asked me to perform metadata cleanup on DC1, demote remaining DCs and rejoin them. ok i will post the output those commands tomorrow first thing in the morning. cheers

Why do you want to demote other DCs and rejoin them? i thought you asked me to perform metadata cleanup on DC1, demote remaining DCs and rejoin them. ok i will post the output those commands tomorrow first thing in the morning. cheers It was the action plan that I suggested when you said that you had an old backup. From an old reply: So, you said that you have no other backups. Now the only option is to connect other DCs and then to promote DC1 as a DC. Hope that having two RID masters did not an impact on your AD environment. Proceed like that and try creating AD objects and check if you are able to perform that without problems. => I have not mentioned demotion over here. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

ok, here is the link for DC1 reports. i will update the rest at same place. cheers http://cid-ea6b3a8230769ce1.office.live.com/browse.aspx/.Documents?permissionsChanged=1&1

I see errors in the dcdiag with RPC calls. Please proceed like that: Make sure that each DC/DNS server points to itself as primary DNS server and to other internal ones as secondary Make sure that each DC without DNS points to internal DNS servers as DNS servers Once done, run ipconfig /registerdns and restart netlogon on all DCs. Also, make sure that all required ports for AD replication are opened: http://technet.microsoft.com/en-us/library/bb727063.aspx Use PortQry v2 to check. Also, check logged event viewer errors. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

to be honest with you, you are an absolute legend. thanks for all your help. i really mean it. here is the reports for another two DCs. http://cid-ea6b3a8230769ce1.office.live.com/browse.aspx/.Documents?sa=734636209 i want to demote DC2 to install Exchange 2010. what u reckon ?

Hello again, the RPC problem was not solved. Have you tried what I suggested? For DC demotion, I recommend demotion only if you at least two DC/DNS/GC servers that are online. It is in order to ensure the high-availability of AD/DNS service. Once demoted, you can install Exchange 2010. More information in Exchange forums. Please check DNS resolution and that needed ports for AD replication are opened. Please go to each DC and check if there is DCs that have missing SYSVOL folder or which content of this folder is missing on these DCs. If you determine which one has the correct SYSVOL folder, refer to this Microsoft article: http://support.microsoft.com/kb/290762 Please perform backups of your DCs to avoid risk of losing of your domain. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

i didn't try your solution yet. will do. we have two DCs on-site here and one more at branch office. if i demote one, i will be having only once DC at main site. i think branch office will do job. its not RODC. will update you soon. cheers

i didn't try your solution yet. will do. we have two DCs on-site here and one more at branch office. if i demote one, i will be having only once DC at main site. i think branch office will do job. its not RODC. will update you soon. cheers You can work like that. What is recommended is to have at least two DC/DNS/GC servers per domain to ensure the high-availability of AD/DNS service and so that you reduce the risk of losing your domain. Also, don't forget to perform backups periodically. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

will do from now on. especially image backups. came to know what am not doing when the disaster happened. this is first time am facing it. cheers

will do from now on. especially image backups. came to know what am not doing when the disaster happened. this is first time am facing it. cheers This depends of the disaster. There is no standard procedure. If you face a problem, post in Technet. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

this is the most helpful thread or forum i have ever found till now. cheers

hello, am getting the following error when am demoting DC2. http://cid-ea6b3a8230769ce1.office.live.com/browse.aspx/.Documents?uc=1 any suggestions ??? cheers

Hi, As to the recent demoting issue, I would like to suggest you create a new thread in this forum as the current thread has already been marked. This can be beneficial to other community members reading the thread. Regards, Cecilia Zhou