Active Directory is pooched...what's the best plan of attack?

[vetteguy]

First, I am not the network administrator for my organization. However, I used to be one, so I am a convenient source of "free" information, so the things that go on here are mostly beyond my control.

Anyway, we were running out of room on the Global Catalog server for the AD database (the person who installed Windows gave it a 2GB partition). The administrator and I found a KB article about how to move the AD database to a different location. We tested it on a test machine, and it worked fine. So last night he wanted to do it to the live AD (since we needed to add a bunch of new users, plus today was supposed to be when I installed Exchange).

Anyway, I was not present at the time, but here is what happened. He did the database move exactly as the document said. It worked fine, and he did an integrity check, and it was ok. He rebooted, and started to add new users via a script. There was a large amount that needed to be added (about 600). He got about 200 done when he started getting errors about the AD database being out of room. He rebooted the server, but did not attempt anything further. He then went home for the night. This morning, people were having problems logging on, so I took a look at the GC, and there were errors in the event log, like this one:

Unable to establish connection with global catalog.

If you go into the AD manager, it says it can't find the AD.

So, my question is, what do I do? Basically no one here knows anything about Active Directory. I am an old NT admin, so I don't have much experience with it. When 2000 was installed last summer they had consultants do it, so they really have no idea what's going on. He did do a full backup (so he says) before the AD move. If that's the case, can I do a full system restore? Of course, we don't have any other domain controllers ("why do we need more than 1???") so I can't promote one to the GC. Any help is appreciated, as we are really screwed at this point. Thanks in advance.

 

[Rainsford]

Without knowing exactly what he did, it's hard to say what the problem is. I would recommend a full restore from any backups you might have. Of course it could be something simple, but trying to troubleshoot where he made the mistake might waste more time than a restore. Then I'd go out and buy a secondary domain controller and make it a GC as well. I would never, ever, run a network without at least 2 domain controllers, that's just asking for it. I know that wasn't your fault, but this would be a good time to bring up the need for another one.

Sorry I can't be more help, but somtimes a full restore is faster than trying to figure out what someone screwed up. And going home when the DC obviously doesn't work :| that's not cool.

 

[mobogasm]

Agreed. You NEED a secondary domain controller, its essential. The first mistake was installing AD on a 2gb partition. I know it wasn't you who did it but that was just dumb whoever did that.

EDIT: I was mistaken (tired). I meant use the a new box w/ a much larger hdd as a test bed and migrate everything over, pull the plug on the bad AD server and make sure the new one works properly. I don't see a problem with doing it this way.

 

[stash]

Uh...there are no PDCs and BDCs in active directory. The closest thing is the PDC emulator FSMO which is only really needed if the domain is in mixed mode.

 

[bot2600]

I would think restore from a backup, add a new domain controller and replicate AD to the new controller, take the old controller down, and reconfigure it the way it should have been configured to begin with, bring it back up and replicate AD back to it. Then if they will allow it, I would keep both Domain controllers permanantly.

 

[Rainsford]

Originally posted by: STaSh
Uh...there are no PDCs and BDCs in active directory. The closest thing is the PDC emulator FSMO which is only really needed if the domain is in mixed mode.

I think by secondary, mobogasm mean a second domain controller to act as a backup for the first, and the first would be a backup from the second. That's how I meant it as well. But you are correct, all domain controllers are peers in active directory.

 

[vetteguy]

Thanks guys for all the suggestions. We ended up calling Microsoft support and paying to have someone help us fix it. $250 and 3 hours later, we were all set, and now have another domain controller running. It is really frustrating when you weren't the one who set it up but are still expected to know exactly why it broke, and then know exactly how to fix it. Thanks again, I HOPE this won't be a repeat!

 

[Rainsford]

Originally posted by: vetteguy
Thanks guys for all the suggestions. We ended up calling Microsoft support and paying to have someone help us fix it. $250 and 3 hours later, we were all set, and now have another domain controller running. It is really frustrating when you weren't the one who set it up but are still expected to know exactly why it broke, and then know exactly how to fix it. Thanks again, I HOPE this won't be a repeat!

Just wondering, what did the MS guy do?

 

[Buddha Bart]

$250 and 3 hours later

Wow... thats a pretty good deal.
Considerign it was costing you 600 inconvienenced users, and two staff memebers days of frustration.


bart

 

[Abzstrak]

Quote
$250 and 3 hours later


Wow... thats a pretty good deal.
Considerign it was costing you 600 inconvienenced users, and two staff memebers days of frustration.

yep, I've called MS a few times my self... its $250/call, but my calls have all taken them 6 hours or more, so I figured it was a pretty good deal too...

 

[vetteguy]

Originally posted by: Rainsford

Originally posted by: vetteguy
Thanks guys for all the suggestions. We ended up calling Microsoft support and paying to have someone help us fix it. $250 and 3 hours later, we were all set, and now have another domain controller running. It is really frustrating when you weren't the one who set it up but are still expected to know exactly why it broke, and then know exactly how to fix it. Thanks again, I HOPE this won't be a repeat!

Just wondering, what did the MS guy do?

Well, a few things, which could have been considered different incidents, so it was nice. First, we cleaned up the AD and removed references to servers that no longer existed (which had been improperly removed). We then brought another domain controller up, and transferred the RID master role to it. Then some more AD cleanup, then transferred the RID role back to the GC. In other words, not something I could have figured out myself.

By the way, Budda Bart, it was way more than 600, try 3000. We were just trying to ADD 600.