Help! SBS 2003 issue after MS updates

[viperbri]

After letting the MS critical updates download and install on our Small Business Server 2003 it asked to restart. I restarted the server now we can't login to the server console on our Administrator account. I even tried to remote desktop to the server and received the account / login does not exist or is the wrong password.

Since the client workstations (all XP) could still login to the domain, print, browse the net, get email (Exchange), and access the file shares we could still work. I installed the Admin Pack on one of the XP workstations so I could look at the Active Directory Users and Computers. I connected to the server and could see all my users, except...my Administrator account was not there! Unfortunately I did not have a backup Administrator account (I know bad idea, but it was a small secured network).

So my question is...how do I fix this? I can't re-create an Admin account even though I have access to the Active Directory because I don't have another user that has enough rights to do that.

What are my options? Help! Thanks.

 

[RebateMonger]

There might be some useful information in this UseNet thread.

Basically, you go into Directory Services Restore Mode and work on the Local Administrator (DSR administrator) account.

You could also re-install SBS (first CD only), patch it to the SP level of your backups, and restore the Server to a date prior to when you lost the Administrator account.

 

[viperbri]

Ouch...that does not look like fun...although I have used that password changer before. Will this fix it even though it seems my domain Administrator account is not there?

 

[RebateMonger]

Originally posted by: viperbri
Ouch...that does not look like fun...although I have used that password changer before. Will this fix it even though it seems my domain Administrator account is not there?

SBS 2003 SP1 is VERY hard to get into. I don't know for sure if that method will work or not.

I'd likely Restore SBS from backups from before the updates. It's the safest way to do it. Then you are sure you'd get your original accounts back.

 

[stash]

Something doesn't make sense. You can't delete the Administrator account in AD.

This also has nothing to do with applying the updates.

Are you sure the account wasn't renamed?

 

[RebateMonger]

Originally posted by: stash
Something doesn't make sense. You can't delete the Administrator account in AD.

This also has nothing to do with applying the updates.

Are you sure the account wasn't renamed?

Yeah. I added that to my earlier messages, but deleted the comment, figuring that the OP had already considered that, or this is truly some weird Server 2003 bug.

How do you enumerate all of the account names? I imagine you can't do it from the Windows command line without Administrator rights. There are likely utilities you could run from a CD or from the Recovery Console that would list them, though. I know you can tell it from the SID codes.

 

[stash]

Well since he has ADUC on another box, I was thinking trying something even easier. Just check which accounts are members of the domain admins group or the built in Administrators group.

 

[RebateMonger]

Originally posted by: stash
Well since he has ADUC on another box, I was thinking trying something even easier. Just check which accounts are members of the domain admins group or the built in Administrators group.

Yeah, I see what you mean. I was thinking that you had to be an Administrator to see which accounts are admins. But you don't.

If you open up ADU&C and then go to the "Builtin" \Administrators, you'll see who's a member of that group. Or go through all the other accounts in the "MyBusiness" unit and see who's a member of the Domain Administrators built-in group.