We help IT Professionals succeed at work.

Restore an Active Directory domain controller with system states

dnadeveloper
dnadeveloper asked
on
2,804 Views
Last Modified: 2008-03-10
We had a Windows Server 2003 Active Directory domain controller completely crash.
The machine had to be rebuilt and a system state was restored successfully in directory service mode.

When I try to introduce it back into the network, I get the following error message.
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server PRINTSVR01$.  The target name used was MyDomain\PRINTSVR01$. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named  machine accounts in the target realm (myDomain.COM), and the client realm.   Please contact your system administrator.


I have also tried restoring the system state with the machine off the network. When I try to browse the Domain Security Policy I get the message:
Failed to open the Group Policy Object, you may not have appropriate rights.
Details:
The network path was not found.

Other errors I have in the event viewer aware things like: Active Directory was unable to establish a connection with the global catalog.

I thought the whole point of backing up the system state was to easily bring a machine back into AD if it crashes.

Can anyone tell me what I need to do to put this machine back online and functioning in the AD network as it did before the failure?

Thanks,
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2006

Commented:
how did you perform the restore? authorative restore?
Fatal_ExceptionSystems Engineer
Top Expert 2005

Commented:
Was this the only DC in your network?  

Did you follow the steps in this article?

http://support.microsoft.com/default.aspx?scid=kb;EN-US;326216

Author

Commented:
This was not the only dc in my network but the other dc's wont accept this machine back as I receive the KRB_AP_ERR_MODIFIED error.

I followed the steps in the article though on the restore I was booted into directory services mode.

Author

Commented:
I performed the authoritive restore by:
1) Installing Windows
2) Rebooting the server in directory service mode
3)Restore system state using windows backup.
4) Reboot
CERTIFIED EXPERT
Top Expert 2006
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION
Fatal_ExceptionSystems Engineer
Top Expert 2005

Commented:
One question that I forgot to ask is who holds the FSMO roles in the domain/forest now?

Author

Commented:
This machine does have DNS and it was the first domain controller I put up.
The machine I am trying to restore is svcs01.

If I go to another DC and do a netdom query fsmo I receive the following:
C:\Program Files\Support Tools>netdom query fsmo
Schema owner                svcs01.MyDomain.com
Domain role owner           svcs01.MyDomain.com
PDC role                    svcs01.MyDomain.com
RID pool manager            svcs01.MyDomain.com
Infrastructure owner        svcs01.MyDomain.com
The command completed successfully.

C:\Program Files\Support Tools>

However the machine I have as svcs01 is not getting admitted and cannot open the GPO.
I have also tried to join the domain with a new computer and I would receive the message that the login failed.




Fatal_ExceptionSystems Engineer
Top Expert 2005
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Sorry for the delay getting back here.
I ended up resolving this using MS paid support.
It turned out there were several problems. The first issue was that the remaining two domain controllers had errors in their dns configuration. That was preventing proper replication between the remaining domain controllers. That was the first thing we corrected.

Once dns was corrected, the original domain controller was brought back using a restore of the system states and the techniques referenced in Jay_Jay70  and ADExpert’s comment. (Without the other  peripheral problems, that would have nailed it.)

There were also major issues installing Windows 2003 server Service pack 1 on a HP Proliant ML370. I am still working with HP to find out what the deal is there. Basically, installing the service pack is what crashed this machine in the first place and I still cannot get it to install.

Thanks for all of you input and questions, it was a great help, was very informative and is greatly appreciated.
Fatal_ExceptionSystems Engineer
Top Expert 2005

Commented:
And thank you..

FE
CERTIFIED EXPERT
Top Expert 2006

Commented:
cheers mate
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.