Help Urgently Needed!!! Sysvol/Netlogon Toast!

[MarcConsulting]

I am new to this environment and have a client that has lost the sysvol and netlogon directories. The server is still operating (marginally). Needless to say loggin in is becoming an issue.

My question is, can I run DCPROMO to demote the server then repromote and reinstall AD? Do I have to start from scratch? Any other work-arounds?

This is a single server environment and no backups (not yet implemented). The server isn't used much except for printer sharing and DHCP/DNS.

I'm hoping that there is a "quick" way to restore "normal" operation.

Thanks for your kind advice!

Marc

 

[Cstorms]

Well "quick" and "restore" usually entail some form of backup.. If you do not have a copy of the system state sitting around you may need to rebuild your AD structure.

If you demote it you obviously will lose the tree so although this may be what you indeed need to do (a forced removal may also be necessary if you cant demote properly, in which case you will need to run a few more utilities to completely clean everything up), then a dcpromo and a manual rebuild.

What you could do is export your tree into a csv file and import it into the new build. Look into using CSVDE for this. Of course there are many variables to this situation depending on the scope of the problem. Good luck in any case.

Cory

 

[MarcConsulting]

Cory,

Thanks a bunch! If I'm forced to do a "forced removal", what other tools/utilities will I need? any tech references for that process? I don't mind rebuilding the AD structure as it is a small network with 30 or so users. I just want to do it quickly and properly.

Marc

 

[Cstorms]

The force removal switch is used if you encounter problems demoting the machine with dcpromo.

http://support.microsoft.com/kb/332199

That is the kb that explains it.

This machine doesnt host Exchange correct? If not then you should be ok to proceed with what you had in mind. Good luck to you.

Cory

 

[NJForensics]

Do NOT run dcpromo.... please see this registry key ... this is a journal wrap error... easily resolvable.


Expand HKEY_LOCAL_MACHINE.
Click down the key path:
"System\CurrentControlSet\Services\NtFrs\Parameters "
Double click on the value name
"Enable Journal Wrap Automatic Restore"
and update the value to 1
Restart your server.
When the shares re-appear... set that value back to 0

If the value name is not present you may add it with the
New->DWORD Value function under the Edit Menu item. Type
the value name exactly as shown above.


Chris Clancy, EnCE,CCE

http://www.milestechnologies.com

" ... when you can't figure out what the problem is, find out what it isn't.... "

 

[MarcConsulting]

Chris,

Thanks. I've come to find out that the tech, in an attempt to reallocate space repartitioned/reformatted the space. I'm not sure why the previous consultants configured the server that way (for such a small environment). So, I'm not sure your fine suggenstion would apply (correct me if that's not the case). If you've got any other thoughts, I'm open to hear them. Every little bit helps.

Cheers,

Marc