Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Mystery of the missing AD User Account

Status
Not open for further replies.

Roadki11

MIS
Mar 23, 2005
1,097
US
Good morning,

I had this same issue on the same windows 2003 standard server SP1 early this spring. After i applied SP1 it cleared up but the issue has returned and i need some help. Seems users are just disappearing from AD. Yesterday 1 user vanished and this morning 2 different user have disappeared. DCDIAG and NETDIAG come back clean. Google says lots of people have had this issue but i see no remedies or pointers to the root cause. Server is 100% up2date on patches and service packs. I have added a 2nd DC, windows 2003 R2 a month ago, has been working fine up until now. The accounts are missing from the replica also. The server with the issue is the FSMO master and the R2 server is a 2nd global catalog server. Both servers run DHCP and DNS(AD Integrated), dns is functioning well. DC's are on different subnets and replication is working fine. Any thoughts?

thanks,

RoadKi11
 
Just to get a better idea of your environment:
1) Are you the only one that has access to AD?
2) Do you have any applications that manipulate AD (i.e. PeopleSoft)?
 
I am the only one with administrative access to the servers. No, i do not have any apps that touch AD.

RoadKi11

 
I should rephrase that, i do have Backup Exec 10 doing a nightly system state backup. nothing in the event logs to suggest a problem. no new software has been installed on the server since the last batch of windows updates about 30 days ago. and like i said the problem reappeared yesterday after an 8 month hyatus.

RoadKi11
 
NFI! Are the accounts just gone - or are they toombstoned? I think with some research, you can see the toombstoned accounts with ADSIEdit
 
The user were tombstoned and i was able to reanimate them with Sysinternals adrestore. Hand little utility, no wonder MS bought them. Im still looking for any ideas why this may be happening. No users vanished last night so i guess thats a good sign.

Thanks,

RoadKi11
 
If they are being toombstoned, it means there is an explicit delete command being executed. I don't know how - but there has to be a way of creating debugging logs for NTFRS?
 
Do you have auditing enabled? Check the event logs to see who last accessed the affected user objects. Hope this helps.

Regards

Terry
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top