Need help for restore DC in multi DC domain

Question

Hi there,

we have a single Active Directory domain forest with 11 DCs in function level 2016.

For testing a disaster recovery and to implement a testing domain that is almost similar to our productive domain.

So I made a backup (full and only system state) from a DC (VM under Hyper-V) and tried to restore it to another new VM not joined to the domain with same OS version as the backuped DC. The backuped DC had all 5 FSMO roles activated.

First I tried to restore the system state according to MS documentation:

• add role ADDS and feature Windows Server Backup
• safe boot with AD repair mode
• Restore System State

after successfull restore server boots but directly to repair mode without any chance to come back to the server.

Second I tried to restore the bare metall backup.

Boot form Virtual DVD

• recovery mode and choosed the windows backup on separate partition

after reboot server comes up but no AD features available.

Service Intersite Messaging is stopped and not able to get started.

No FSMO role could be forced to seize to the server. No AD snap-in could be started.

Does anybody has a good idea?

Thanks in advance

Bernd

Answer 1

Something here could help.

https://www.dell.com/support/kbdoc/en-us/000143782/windows-server-how-to-restore-a-windows-server-2012-domain-controller-from-a-backup

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi Patrick,

thanks for your help but this was what I described above with the second try and did not work.

Kind Regards

Bernd

Answer 3

Hi

I want to add some things maybe important.

First of all the recovered DC has no NIC plugged in and so no network connecting.

After restoring a complete backup the server comes up without funtional AD. The service Intersite Messaging is stopped and unable to start.

In System Eventlog there are a lot of Informational Events 16647 saying:

• The domain controller is starting a request for a new account-identifier pool.

The DFS Replication Eventlog: has some 6702 Warnings:

• The DFS Replictaion service did not find a valid machine configuration file ... It has created a new machine configuration file...

and

Error 1202:

• DFS Replication service failed to contact domain controller to access ...

In the Directory Service Eventlog: a lot of 2092 Warnings saying:

• *This server is the owner of the following FSMO role, but does not consider it valid. For the partition which contains the FSMO, this server has not replicated successfully with any of its partners since this server has been restarted. Replication errors are preventing validation of this role.  Operations which require contacting a FSMO operation master will fail until this condition is corrected.  FSMO Role: CN=RID Manager$,CN=System,DC=juwi,DC=de  User Action: 
  1. Initial synchronization is the first early replications done by a system as it is starting. A failure to initially synchronize may explain why a FSMO role cannot be validated. This process is explained in KB article 305476. 
  2. This server has one or more replication partners, and replication is failing for all of these partners. Use the command repadmin /showrepl to display the replication errors.  Correct the error in question. For example there maybe problems with IP connectivity, DNS name resolution, or security authentication that are preventing successful replication. 
  3. In the rare event that all replication partners are expected to be offline (for example, because of maintenance or disaster recovery), you can force the role to be validated. This can be done by using NTDSUTIL.EXE to seize the role to the same server. This may be done using the steps provided in KB articles 255504 and 324801 on http://support.microsoft.com. 
  The following operations may be impacted: 
  Schema: You will no longer be able to modify the schema for this forest. 
  Domain Naming: You will no longer be able to add or remove domains from this forest. 
  PDC: You will no longer be able to perform primary domain controller operations, such as Group Policy updates and password resets for non-Active Directory Domain Services accounts. 
  RID: You will not be able to allocation new security identifiers for new user accounts, computer accounts or security groups. 
  Infrastructure: Cross-domain name references, such as universal group memberships, will not be updated properly if their target object is moved or renamed.*

Any attempt to seize the roles does not work

• ntdsutil: roles
  fsmo maintenance: connect to server dc-01
  Error parsing Input - Invalid Syntax.
  fsmo maintenance: connection
  server connections: connect to server dc-01
  Binding to dc-01 ...
  ldap_bind_sW failed with 0x51(81 (Server Down).
  )
  Connected to dc-01 using credentials of locally logged on user.
  ldap_search for attribute supportedCapabilities failed with 0x34(52 (Unavailable).
  )
  server connections: q
  fsmo maintenance: Seize RID master
  ldap_search for attribute DefaultNamingContext failed with 0x34(52 (Unavailable).
  )
  Unable to query Rid manager Object
  fsmo maintenance: Seize PDC
  ldap_search for attribute dsServiceName failed with 0x34(52 (Unavailable).
  )
  fsmo maintenance:

And even any attempt to open an AD snap-in is answered by an error saying

• Naming information cannot be located for the following reason: The server is not operational

P

Answer 4

A simpler solution to implement a testing domain may be to stand up a new one in existing domain, after successful replication you could shut down and move it to isolated location, then in both locations do cleanup to remove unwanted remnants. (new one in existing network and all the others in isolated network)

Clean up Active Directory Domain Controller server metadata

Step-By-Step: Manually Removing A Domain Controller Server

Then in isolated you could seize roles.

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/transfer-or-seize-operation-master-roles-in-ad-ds

-

--please don't forget to upvote and Accept as answer if the reply is helpful--