Share via

Restored DC From Backup in a Multiple DC Environment, Need Help!

Ryan Stockham 0 Reputation points
2023-04-29T12:54:00.18+00:00

We have a multiple Domain/DC environment. One top level domain and two sub-domains. Two DC's in each domain. One of my sub-domain DC's went into a Blue Screen state after removing an update and restarting. I tried many things to get it working, but determined it wasn't going to happen. We had a backup of the DC server from the night before. I restored the backup successfully, but as everyone would probably expect, there are a number of replication errors, etc. The other domains are not accepting requests for replication.

I made sure that within the sub domain, the active and working DC was set to all of the Operational Master roles, but still no luck.

I know the recommended method would normally be to remove all references of the failed DC and bring up a new server to replicate with the existing good DC, but our concern is that we are in a fairly large environment with a vast number of services and programs that likely reference the failed DC for one reason or another. We'd like to be able to keep that image as it has a number of agents, etc that respond to various programs.

Would it be possible to Demote the DC that was restored from backup and then re-promote it and hopefully after it's promoted again, the replication issues are fixed and the all of the software/agents running on it would still be in place and ip/dns references would all still be intact as well?

Advice appreciated!

Windows for business | Windows Server | User experience | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 45,231 Reputation points
    2023-05-02T12:02:55.39+00:00

    Hello,

    Restoring a domain controller in a multi DC environment is not recommended. The much safer / cleaner option is to seize roles to a healthy one (if needed)

    https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control

    then perform cleanup.

    https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup

    then rebuild the failed one from scratch by using dcdiag / repadmin tools to verify health correcting all errors found before starting. Then stand up the new replacement, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health.

    --If the reply is helpful, please Upvote and Accept as answer--

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.