Network user Profile problem

Question

Network user Profile problem

Ahmed 40

environment: Win2012 R2 (S1) DC holding all the roles and 2019 Datacenter (S2) DC File Server. Both S1 and 2 are VMs. Initially all network shared folders were hosted on S1 until it began to run out of space. Built S2, copied the shares over, created a new GPO, Linked to domain and all was great until S2 went down after a power out.

S2 VM couldn't be restarted. Restored from back up and resumed operation for 2 days without issue. I decided to create a 2nd file server (just in case) using the backup copy of S2 and rename it after restoration. Now we have S3. S2 lost trust relationship with the Domain after S3 was identified on the network. I was unable to log on to S2 any longer but can do all I wanmt with S3. I am still able to access the Shred folders on S2 and all the drive mapping per GPO is still pointing to S2. I have 2 problems, the First is the mapped shares appear disconnected to some of the users and won't reconnect. The second problem is that I am able to remap the shares manually for some users using my old network credentials but not for others. I seem able to do so on newer versions of Windows but the older ones aren't allowing the authentication with the old password. I am unable to log on to S2 with local or domain creds. Planning on moving all to NAS in the immediate future but need to resolve the share issue if possible. I brought S3 down to get it out of the way and totally rule it out. any assistance will be greatly appreciated. Thanks!

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Geoff McKenzie 950

Hi Ahmed,

I am not sure there is enough information in here to really help. Maybe some error messages for each problem may help.

However, I do have some concerns about the methods as outlined above. Specifically, where you say "I decided to create a 2nd file server (just in case) using the backup copy of S2 and rename it after restoration" - Depedning on the actual steps you did here, this could be a problem. A 'copy' of a machine and rename could result with 2 servers with the same SID which will confuse authentication. If the renamed server was online at the time of rename (i.e. connected to AD) It may have updated the computer object in AD leaving S2 with no matching computer object in AD.

HTH

Ahmed 40 Reputation points

2025-01-16T14:14:38.1066667+00:00

That is exactly what seem to have happened despite changing the name as soon as I was able to log in and reboot the 2nd instance.

I am working on trying to reset the local password of S2 using a disconnected snapshot. if I manage to do do so, I should be able to apply the fix to running VM and rejoin it to the domain.
Ahmed 40 Reputation points

2025-01-16T17:58:32.3933333+00:00

That is exactly what seem to have happened despite changing the name as soon as I was able to log in and reboot the 2nd instance.

I am working on trying to reset the local password of S2 using a disconnected snapshot. if I manage to do do so, I should be able to apply the fix to running VM and rejoin it to the domain.
Ahmed 40 Reputation points

2025-01-16T19:11:33.2233333+00:00

I took a snapshot of the running S2 and attempted to change the local admin PW using a 2019 boot ISO and so far succeeded in doing so and logging in to the server using safe mode.

used net user administrator (password command) once, then when it failed to log me in after normal boot I added /domain. the command executed successfully in both attemps but still won't accept the creds in normal boot mode.

I can't use the same password to log in when I restart the server in normal mode. the error is either due to trust relationship with the domain or No account for this computer. what am i missing?

I still have the vm disconnected from the network.
Geoff McKenzie 950 Reputation points

2025-01-17T06:38:42.4833333+00:00

Hi, if you are trying to change the local admin account using offline methods and the command is successful then maybe the name on the system is the problem. When you logon again try using dot \ user name e.g.
.\administrator
This might work as .\ translates to local machine so you don't have to match the local host name and ensures the authentication is processed locally.
Also, make sure there are no policies or other config which may have renamed the local admin account to something other than administrator.
Just working through thoughts here....
Ahmed 40 Reputation points

2025-01-17T12:29:33.7833333+00:00

I really appreciate the time you have taken to help me out. I have done all that already while Offline to avoid knocking the running instance down further. The instance that went off the domain as a DC is still running and we still have access to the shared folders on it (that is the beef of this whole thing). What I am trying to do here is to save the shares. I am afraid that the missing piece in the attempt to try the changed password on the copy is being online. The netlogon service won't start unless there is a Source to fetch and I can't change the name or membership to group or domain while the instance is offline.

What Do you think?
Geoff McKenzie 950 Reputation points

2025-01-22T11:19:43.9466667+00:00
OK I just re-read you original description.
Correct me if I am wrong.

Server1 - Domain Controller WS 2012R2.

Server2 - Domain Controller WS2019

Server3 - Domain Controller WS2019 - Created from restored backup of Server2 and renamed to server3

Is this correct?

If so, then you probably have a mess in regard to AD replication and authentication.

You can use tools like Eventvwr, DCDiag and Powershell to check for Directory services events, issues and replication problems, to see if you can confirm.

It may be too complex to resolve in this style of Q&A.

If my assumptions here are correct, then I would probably.

Backup everything / snapshot in case you need to start again.

Demote (forcibly if necessary) Server 2 and Server 3 and remove both from domain (remove/uninstall AD Domain Services)

Using Remaining Domain Controller (server1) - Do a metadata cleanup of Server2 and Server3 - All references in all naming contexts and DFSR - there is an MS article on this

assuming you don't need server3 - shut it down, turn it off and don't turn it back on.

re-add server2 to the domain

cross your fingers

Test.

If you still want it to be a domain controller - Reinstall AD DS and promote.

Without actually seeing it in front of me that's all I can think of at the moment.

Good luck
Ahmed 40 Reputation points

2025-01-22T16:30:08.7633333+00:00

You are right on the Money Geoff!

Thank you for taking the time to re-read through it. I am working on that now.

Have a great day!

Share via

Network user Profile problem

0 additional answers

Your answer