Ransomware and SYSVOL folder

skak 21 Reputation points
2021-02-23T19:48:27.397+00:00

Hello,

I have an old setup with 4 Domain Controllers 3 Windows Server 2003 and one Windows 2008 R2. Last Week we had a Ransomware attack and it corrupted the SYSVOL folder. I have Recent AD back which I restored in my Lab and copied the clean SYSVOL folder to the existing SYSVOL (deleted the Contents in Sysvol).
Reference Server is build and changed the Registry value to D4 and all other ADC I did D2 after restarting the ntrs and netlogon I see

NtFrs_PreExisting___See_EventLog in the SYSVOL, how can I avoid this ?

https://support.microsoft.com/en-us/help/315457/how-to-rebuild-the-sysvol-tree-and-its-content-in-a-domain

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,096 questions
0 comments No comments
{count} votes

8 answers

Sort by: Most helpful
  1. Dave Patrick 426.4K Reputation points MVP
    2021-02-23T19:50:20.267+00:00

    If you have restored a domain controller from a recent backup then the recommended (and simplest) method is to rebuild the other ones.

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments No comments

  2. skak 21 Reputation points
    2021-02-23T21:44:31.497+00:00

    DSpatrick thanks for the answer I have a dc with exchange 2007 installed on it. Again my question is after restore why I see NtFrs_PreExisting___See_EventLog in the SYSVOL

    0 comments No comments

  3. Dave Patrick 426.4K Reputation points MVP
    2021-02-23T21:50:30.417+00:00

    Definitely not a good scenario to install exchange on a domain controller. You can follow along here.
    https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/rebuild-sysvol-tree-and-content-in-a-domain

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments No comments

  4. skak 21 Reputation points
    2021-02-23T22:22:46.367+00:00

    ur right i have used the same link for restore

    0 comments No comments

  5. Dave Patrick 426.4K Reputation points MVP
    2021-02-23T22:27:17.71+00:00

    I'd try the authoritative restore
    https://learn.microsoft.com/en-US/troubleshoot/windows-server/networking/use-burflags-to-reinitialize-frs#authoritative-frs-restore

    --please don't forget to Accept as answer if the reply is helpful--

    0 comments No comments