Replace DC server (server 2019)

FotS 81 Reputation points
2021-09-12T06:20:50.94+00:00

We were hit by a ransomware attack. Because the company hadn't invested any money into offsite backups, we only had onsite and, yeah, for all intents and purposes they are toast right now. The 2 DCs we had were fine, until someone powered on an infected machine I had powered down. Now both DC servers are at least partially encrypted. I don't see signs of the virus itself on them (yet), but I don't want to take any chances. I'm actually afraid to logout or even disconnect from DC01 for fear I won't be able to log back into it (I can't log into DC02 anymore due to the encryption).

I've powered down DC02 and using our virtual environment, spun up another server (DC03). I've added the same roles to it as what DC01 had (AD DS, DHCP, DNS, and NPAS), promoted DC03 as a DC in AD and started some work on DNS (on DC01 I've added DC03 as a Name Server), but when following guides for steps that continue to the new server, I've noticed all the zones are already visible on DC03, so I'm not sure what to do.

I really don't have the level of expertise to do all of this, but the company lacks the money to hire outside help. I've found some guides for complete replacements of DCs, but they're old (Server 2008 or older), and I'm not sure how much has changed over the versions (sorry, should mention that all of our servers are 2019 and I know I've already run across some guides saying that even going from server 2008 to 2016 require some additional steps like upgrading to 2012, first). Frankly, I don't even know what things I should be asking/looking out for. Until I was looking at some of these guides, I had never even heard of FSMO in relation to AD.

I need to get the AD, DHCP, DNS, and NPAS services transferred over to DC03, plus whatever else in there that I may not know about. NPAS I think(?) is being used for a RADIUS connection from the site's internet firewall for VPN. That said, there's some software installed on DC01 for the firewall, too, for the purposes of the web filters, so I think I'm going to engage the firewall support people to move the software and get VPN going through that instead. There's also Azure AD Connect software running on DC01, too (primarily used to sync our AD accounts with our Office 365 email accounts). That should be it.

Once all of that is transferred over, I want to shut DC01 down, then either rename and re-IP DC03 to match DC01, or spin up another DC server to match DC01's name and IP (would that be easier?). I know there have to be a lot of references and pointers to its name and IP, so I want to make sure at least something exists with it's identical info. If it makes it any easier, I think we have like less than a half dozen PCs that are still functional at this point, anyway. XD

What a nightmare this is turning into.... I need help. :(

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,448 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,832 questions
0 comments
Accepted answer
  1. Dave Patrick 426.1K Reputation points MVP
    2021-09-12T12:38:56.58+00:00

    For the additional domain controllers I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2019, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

    For DHCP do you have a backup or starting over?

    For the NPAS question I'd start a new thread over here.
    https://learn.microsoft.com/en-us/answers/topics/windows-network-access-protection.html

    Do not install the vpn on a domain controller. I'd stand up a separate instance for this purpose.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

    1 person found this answer helpful.
    0 comments

8 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. FotS 81 Reputation points
    2021-09-12T15:32:29.017+00:00

    Ok, I'm close.... I've got a new DC01 all up, same name and IP as the old, joined to domain and promoted as DC, even got DHCP working on it and confirmed the rest of the network now works on DHCP.

    However, DNS seems desync'd between them. I had to add an A record for DC01 from DC02/DC03 in order for them to resolve it when attempting to add it as a Name Server, and I've noticed as I've begun demoting and removing DC03 from everything, that DC01's DNS records are not updating with the removal of DC03. I've apparently done gone and mucked something up. :/

    0 comments
  2. Dave Patrick 426.1K Reputation points MVP
    2021-09-12T15:35:56.557+00:00

    Please run;

    Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
    repadmin /showrepl >C:\repl.txt
    ipconfig /all > C:\dc1.txt
    ipconfig /all > C:\dc2.txt
    ipconfig /all > C:\dc3.txt

    then put unzipped text files up on OneDrive and share a link.

  3. Dave Patrick 426.1K Reputation points MVP
    2021-09-12T18:05:43.943+00:00

    Sounds good.

    --please don't forget to upvote and Accept as answer if the reply is helpful--

  4. Dave Patrick 426.1K Reputation points MVP
    2021-09-13T12:56:29.453+00:00

    Glad to hear of success and that health and replication are now back to 100%.

    --please don't forget to upvote and Accept as answer if the reply is helpful--