server 2003 crash

[FSCtek]

I have a client with a windows 2003 server, with a 6 disk raid 5 array.

3 of the six disks failed suddenly due to a firmware issue. the windows OS was no longer accessable.
I was forced to recreate the Raid strip container in the raid bios in order to get the drives online to do the firmware update.
After the logical raid 5 rebuild, I can get to the boot.ini menu of the windows server, however when the server begins to load it seems OK until it loads the gui, then it immediatly reboots.
I did LKGC which didn't help.
I can't get into safe mode (immrdiately reboots)
I can't log into recovery console (immrdiately reboots)
I boot off the server installation disk and run the repair utility and the admin password does not work.

That tells me there is some SID/REG corruption.

The client has misplaced their volume license agreement so a window repair and/or clean install is out of the question.

Any suggestions?

 

[ShackDaddy]

What about rebuilding the OS with an eval version and then doing a full restore over it, including system state? That would get you around the licensing.

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Thanks, thats an idea. I was hoping for some insight in to restoring the registry or something like that. I remember a while back I had an issue the MSgina.dll file I don't think this is the same thing. I have Winternals and a Bart Boot disk any utilities you think could help from those tools.

 

[ShackDaddy]

If you can boot to a floppy with NTFS rights, you could restore the registry from the Windows\Repair directory. Use the files there to overwrite the ones in Windows\System32\Config

Read Part One of this article:

http://support.microsoft.com/kb/307545/

If you can't figure out the Admin password, then hack it. There are resources out there.

http://www.petri.co.il/forgot_administrator_password.htm

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Thanks, I was going to boot up with the winternals disk and reset the password that way.

Are there any registry repair utilities that you would trust on a 2003 server?

 

[ShackDaddy]

Personally, I would just work through that KB article. Every time you run a backup with SystemState included, a backup of the registry hives is written to the \Repair directory. If you can overwrite your \Config registry hives with the backed up ones, you will have gone back to the registry as of the time of your last backup.

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Again thanks for your help. Here is where I'm at, The Server was running Directory services with EFS. So I was unable to get into the system with any utilities or password manipulation tools. And good thing too or else I would have lost all access to the files on the server.

After another windows repair I was finally able to boot into Directory Services Restore mode and logon with the Administrative credentials.

However the AD has been corrupted and I can not recover or repair the NTDS.dit database with the ntdsutil.

I get a jet_errDatabaseCorrupt error.

I have tryied all the steps in the following article

http://support.microsoft.com/kb/258062/en-us

And no luck. I'm going to do a restore from tape back up of the NTDS.DIT file. do you see anything wrong with this as a solution and what might you suggest as a potential repair.

Thanks.

 

[ShackDaddy]

Have you tried, from Directory Services Restore Mode, to restore System State?

http://technet2.microsoft.com/Windo...395a-4c21-971f-9c3b6f4563631033.mspx?mfr=true

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Thanks, We are using Veritas Backup, Now I have done many files restores in the past but never a system state restore.

Do I do a non-authoritative restore
An authoritative restore
or a primary restore

And what problems might occure?
and do I have any other options or is this a system state restore the best option?

 

[FSCtek]

UPDATE:

I have attempted to do a system state restore from tape back up with Veritas Backup Exec. It seems that the previous tech has disabled Volume Shadow Services in Backup Exec since September 06 (Shortly after he was fired) so no System State information has been getting backed up since.

However I do have complete backups of the C: and D: drive data as of 03/01/07
But my most recent System state backup is from 09/24/06

I have been advices from Veritas Extended Support to restore both the System State and C: drive from 09/24/06.
I believe I maybe better off restoring only the system state and not the C: Drive.

I’d prefer to get the AD repaired with out a restore, if possible.
Does server keep a backup of the NTDS.dit database and could I simple replace it?
Do I have any other options or is this a system state restore the best option?
What problems can I expect if the system state and the other data are not synchronized?
What else do I need to know?

 

[ShackDaddy]

Back up the current \Repair directory however you want. Then do a restore from 9\24\06, of all data, including system state. Then you can recover you shared data as of 3/1/07, and you can work to restore the system state from the \Repair directory backup that you kept. That's what I would do.

ShackDaddy
Shackelford Consulting

 

[FSCtek]

I may try that.

I was told that Tombstone was 6 months on 2003 server standard in a single domain environment? is this accurate? in the above article referencing 2000 server is says tombstone is 60 days?

Also What happens if the tombstone life is too old and the workstations connect?

At this point there are no Computer attached to the DC, only users that log in with terminal services.

 

[ShackDaddy]

You know, the \Repair directory is only updated when a SystemState backup is run. Before we go any further, can you check the file dates in the Windows\Repair directory?

If they aren't newer than September, we may be stuck with the September version of AD, and if tombstoning fully invalidates the September backup, we may be really hosed. I'm taking this to an SBS MVP list to see if I can get some additional feedback about your situation.

I know that tombstoning makes offline DC's useless after a while, but I'm not sure how it works with a single-DC domain. I'll know pretty quickly though.

ShackDaddy
Shackelford Consulting

 

[ShackDaddy]

My sources say that tombstoning shouldn't affect you if its the ONLY DC in the domain, which in your case is true. Did you check the dates on those files in the \Repair directory?

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Repair files are from April 06?

As I mentioned before the System is EFS so I can't clone the drive to back it up.

Can I disable EFS and how can I back up the current system state manually? (The back up software will not backup a corrupt system state)

 

[ShackDaddy]

Forget about the repair directory then. Your September backup with SystemState (if it really does include system state) will be better than something from April, and is probably the best you can do. At this point you just need to restore to your September backup, reload all patches that were released since then and update your users (their old passwords will be in effect) and restore the more recent user data.

At least now you should have a clear picture of what a useful backup looks like!

ShackDaddy
Shackelford Consulting

 

[FSCtek]

OK so what I have done is Restored the old system state from 09/06 to a separate directory.
I took the contentd of NTDS Folder from 09/06 and copy it to the original location.
I booted the server and it's back online.

However there is an oracle application that service will start and I'm getting some login errors to the oracle application.

Any thoughts?

 

[ShackDaddy]

I would start a new thread in the oracle forum saying that you just did a restore from a few months back and give the exact error messages.

Glad we got you to a functional place.

ShackDaddy
Shackelford Consulting

 

[FSCtek]

Thanks you've been a great help.