win2k server shows as a dc but no domain...

I've been asked to fix a server that has no backup, no erd, and had a hard boot due to a power failure. Upon booting up I get a sam error. I can get in using directory services restore moded. If I look at the properties, the computer name is correct ( but the domain show 'none'. I cant run dcpromo from this condition. Suggestions?
Who is Participating?
Pete LongConnect With a Mentor Technical ConsultantCommented:
Error Message: Lsass.exe - System Error : Security Accounts Manager Initialization Failed Because of the...;EN-US;258007

as youve suddenly started seeing LSaSS errors Id start getting worried about the Sasser Worm?
Pete LongTechnical ConsultantCommented:
is it the only domain controller for the domain?
gaskewAuthor Commented:
I should also state that I've tried to restore the ntds.dit by ntdsutil and esentutl /r. The esentutl completed but made no difference upon boot.
Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

gaskewAuthor Commented:
No, thats one good thing. They have three more dc's
Pete LongTechnical ConsultantCommented:
well its a good thing if the others hold the FSMO roles? if not your gonna need to seize them on another DC

1.      On any domain controller, click Start, click Run, type ntdsutil in the Open box, and then click OK.

Note Microsoft recommends that you use the domain controller that is taking the FSMO roles.
2.      Type roles, and then press ENTER.

To see a list of available commands at any of the prompts in the Ntdsutil tool, type ?, and then press ENTER.
3.      Type connections, and then press ENTER.
4.      Type connect to server servername, where servername is the name of the server you want to use, and then press ENTER.
5.      At the server connections: prompt, type q, and then press ENTER again.
6.      Type seize role, where role is the role you want to seize. For a list of roles that you can seize, type ? at the Fsmo maintenance: prompt, and then press ENTER, or consult the list of roles at the beginning of this article. For example, to seize the RID Master role, you would type seize rid master. The one exception is for the PDC Emulator role, whose syntax would be "seize pdc" and not "seize pdc emulator".

Note All five roles need to be in the forest. If the first domain controller is out of the forest then seize all roles. Determine which roles are to be on which remaining domain controllers so that all five roles are not on only one server.

Microsoft recommends that you only seize all roles when the other domain controller is not returning to the domain, otherwise fix the broken domain controller with the roles.

If the original domain controller with the FSMO roles is still online, transfer the roles. Type transfer role.
7.      After you seize or transfer the roles, type q, and then press ENTER until you quit the Ntdsutil tool.
Note Do not put the Infrastructure Master role on the same domain controller as the global catalog.;EN-US;197132

To check if a domain controller is also a global catalog server:
1.      Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Sites and Services.
2.      Double-click Sites in the left pane, and then browse to the appropriate site or click Default-first-site-name if no other sites are available.
3.      Open the Servers folder, and then click the domain controller.
4.      In the domain controller's folder, double-click NTDS Settings.
5.      On the Action menu, click Properties.
6.      On the General tab, locate the Global Catalog check box to see if it is selected.

Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain Controller

Windows 2000 Active Directory FSMO Roles;EN-US;197132

Flexible Single Master Operation Transfer and Seizure Process;EN-US;223787
gaskewAuthor Commented:
all roles are not on PHS02 (the one in question).
gaskewAuthor Commented:
To explain a little further. When I boot up the phs02 server, I get the message, "Security Accounts Manager Initialization failed because of the following error: Directory Services cannot start"

all fsmo roles, including GC, are on phs03
gaskewAuthor Commented:
I wanted to give you points for all the hard work. Heres what I did to make it work:
regedit to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
Edit the ProductType value name and change the data value from LanmanNT to ServerNT

amazingly it came back as a member server in the correct domain!

Thanks for everything.
Pete LongTechnical ConsultantCommented:
Thats a fantactic reg hack, and one Ive not seen before, thanks for posting that, the question now has some outstanding PAQ value.

ThanQ - Glad you are fixed :)

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.