Solved

Windows 2003 SBS - Disaster Recovery

Posted on 2009-07-03
11
254 Views
Last Modified: 2012-05-07
hello All -

Here is the situation:

WIndows 2003 SBS SP2 (R1) Exchange (as is standard, sql, sharepoint etc). This server got nailed by a virus one of the worst i have ever seen, none of the normal tools to remove the virus would run. (Such as Malware Antibytes, Hijack this, Avast etc nothing would run).

I figured that out by using an open file monitor to see what dll was being launched by winlogn.exe then went into Safe mode >> Recovery Console > and deleted the file.

Then i was able to access the needed tools and run them. However (before i ran any tools) when i booted into normal mode all of the system services were set to disabled. Even the even viewer was disabled, RPC was started except all service errored out with "WIn32: Rpc Server is unavailable" and numerous other dc/ad/gc errors.

I ran malwayre antibytes on the server and vundo fix - malware found 10+Registry keys that were infected; and 180 Other files that were infected! This server is definitely hosed!

I have tried several solutions to recover the server, but at this point i am certain the only way to fix this is to do an ad restore - only one DC.

My question is this:

If i do an AD restore based on this document: http://seer.entsupport.symantec.com/docs/243037.htm

Can i restore the Just the system state - and not anything else? (I do not want to rebuild this box) ! If i do a system state restore and nothing else, will exchange still work? will Sharepoint still work? Will SQL still work?

Also do i need to then after the restore is completed, go back into DSRM and set the following:

# On the restored domain controller, restore AD by using the following commands:

   1. Open a command prompt
   2. ntdsutil
   3. Authoritative restore
   4. Restore Database
   5. OK at the warning
   6. Click Yes
   7. Exit
   8. Exit

# Reboot

I dont think i need to do both but i am not sure?


I really appreciate your help....

Robert
0
Comment
Question by:castellansolutions
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
11 Comments
 
LVL 13

Expert Comment

by:marine7275
ID: 24772950
You have the correct doc to complete the restore. No you should not have to complete the DSRM commands afterwards. With any DR exercise, it will be only as succesful as the backups that you have.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 24772966
THanks... DO i have to restore the windows folder as well? Normally if this was a Restore to clean install the answer would be yes. But in this case i dont want to resotre the windows folder.




Robert
0
 
LVL 13

Accepted Solution

by:
marine7275 earned 500 total points
ID: 24772971
No, just the system state.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 6

Author Comment

by:castellansolutions
ID: 24772989
Ok and when i do that, that should resotre all the services, the com+ compnenets (cause those are hosed 2) and the ntds.dit (ad files) right?



I have done this before for different servers/clients but always on a new install. thats why i have so many quetions.


Thanks,

Robert
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 24773009
Last question...


 If i do a system state restore and nothing else, will exchange still work? will Sharepoint still work? Will SQL still work?


Robert
0
 
LVL 13

Expert Comment

by:marine7275
ID: 24773016
It should restore all the services, etc. I understand the need for verifying before beginning because of the need to get it online asap. I would make sure you have all the data backed up first before you begin, just in case. I have had some restores not go so good and I have been forced to rebuild the server and restore data. It made for long hours but ultimately everything was restored.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 24773035
My main concern here is when i restore the system state (assuming that exchange is in tact, beucase i cant the start the IS becuase the DC is dead)  -That if all is well with the database that when i do the restore it wont magically delete exchange related items (in ad, on the file system etc) i will do a an offline copy backup of the IS before anything is restored.


The same above applies to sharepoint and sql.


Robert
0
 
LVL 13

Expert Comment

by:marine7275
ID: 24789292
Any luck this weekend?
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 24789333
Well Actually now that you askk.... And all that prep work.... There was no system state or c drive backup at all. Imagine my surpirse when i discovered that!

Heres how i fixed it: (I was getting ad errors, domain cannot be found; no time server; gc not availbale) dcdiag failed, netdom query fsmo : domain cannot be found. - Not a good day!

1. Reverified that all Services were running as they were supposed to (corerct startup type and not disabled)
- That fixed numerous issues, the one service that was not set to startup was the WINS service
2. ran secedit /configure (etc) for the /area of SERVICES and REGISTRY (found one error fixed it)
-Still had GC issues, still had no netlogon shares, no sysvol etc.
3. Ran the rebuild my sysvol share command - magic!
-exchange started and all is now well.


I do see some kcc errors, but i have not address those yet, i need to restore the (temp system state backup i made before running any registry changes) and see if i can pull the login.bat files out of there.


I may also need to run gpo fix becuase i have a blank sysvol fodler now. I have never had to rebuild a sysvol share before so this part of it is learn as i go. <<< Any ideas?



Robert
0
 
LVL 13

Expert Comment

by:marine7275
ID: 24789365
I have never done either, but I found the following MS article:

http://support.microsoft.com/kb/315457

Good work and good luck with the sys vol.
0
 
LVL 6

Author Comment

by:castellansolutions
ID: 24789575
This is the articele that i used, however i do not see how to restore the files. My solution is to just copy them back then see what happens.





Robert
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Combining Get-Mailbox and Get-MailboxStatistics in PowerShell 3 45
AD Account lockout 11 64
NTP time source for DC 3 44
Cannot create 365 Migration Endpoint 11 74
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question