Windows 2003 DC not functioning

[Boxer77]

I am running a Windows 2003 that is functioning as a sole DC in a domain. Yesterday everything stopped functioning. I first checked DNS and all of the AD zones are gone. The event viewer has an error message of Event ID:4000 "The DNS server was unable to open Active Directory..."

In the system event viewer I'm getting an error "The Security System detected an authentication error for the server cifs/SERVER. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request." I also get this error but with the IP address of other DC in different forests listed.

In the application event viewer I'm getting the error "Windows cannot determine the user or computer name. (The system detected a possible attempt to compromise security.)" (ID: 1053) The name of the DC is listed under computer

I'm unable to make changes to Active Directory or to any trust relationships. I've tried resetting the account with the netdom command but that just fails.

Any ideas? (Other than "update your resume")

 

[goombawaho]

This is when you pull out your "system image backup" and put the server back the way it was before the problem. No image backup - very bad news. Almost sounds like you got hacked.

Try this though then your option is not bad.

http://support.microsoft.com/kb/325375

I thought our little wild time had just begun.

 

[ShackDaddy]

There may be some other errors that indicate that the ntdis.dit file has been corrupted. Look for those. I've seen them alongside the errors you list above, so it's a possibility.

If that ends up being the problem (events 217 and 474) then you can follow the following instructions to fix that little database:

http://www.digitalforensics.be/blog...crosoft+Active+Directory+database+problems+(c

Dave Shackelford
ThirdTier.net
TrainSignal.com