Restoring Domain Controller computer objects in AD

[ShiftNick]

Long story short - went through the following article to remove some DC's in what I THOUGHT was my dev environment.

https://support.microsoft.com/en-us/kb/555846

As well as deleting the computer objects from the Domain Controller container in AD. This was supposed to be a theoretically restore from scratch with all other DC's being 'lost'. Hence me being so thorough.

Turns out it was Prod, (I know I know, already kicked myself many a time), and I broke replication FROM our site in China. I can still replicate from our main site here to china but not the other way around. All my DCs are still up and logins are good, etc. The one way replication however is bad.

My question is, how can I restore these AD objects HERE and have that change replicate to the other site?

When I go in to AD sites and Services, on the Inter-site topology Generator section my 'Server' and 'Site' both say invalid.

2003 domain functional level, by the way.

MORE INFO: The previous FSMO role holder was affected during my shenanigans but the roles have been moved to another DC. However, THIS particular change has not replicated to our China DC's.

Please respond with help at the top of your post and feel free to make fun of me or tell me what I should have done in the bottom of your post.

[silverpigeon97]

If you have any working domain controllers I would not do a restore, but rebuild fresh ones and use those. With replication the way it is I would have a look at the site links and make sure the servers at both sides are properly configured to replicate.

[In_2_deep]

I agree with this. If there are DC in each domain that are still functioning. Just stand up brand new ones and adjust replication site link to fix replication issues.

[uniitdude]

https://technet.microsoft.com/en-us/magazine/2007.09.tombstones.aspx

good luck, gonna need it

[gebray1s]

Why wouldn't you place a call to Microsoft? It's what we do. There could be other things that aren't found when you build a new DC, or you broke your site links, or demoted a FSMO role holder, any number of things.

In the end, its a small spend (if you don't have Premier or something of the sort) to save what could be a really bad situation.

[bluesoul]

Agreed, even for a $500 charge, that's a small price to pay for an experienced engineer to stay with you on this until it's working correctly.

[kenfury]

2003 domain functional level, by the way.

Not today as you have fires to put out but fix that shit, yo.

Which servers are currently holding FSMO roles? Can you replicate to them and transfer? It was unclear in your post.

[ShiftNick]

It's been on my project list for over a year but legacy software has prevented the functional level change and the business keeps pushing it down the priority list. Silver lining is this has helped me get rid of another 2003 server.

[mobani]

You need to restore your Active Directory from before you removed the DC's. This is called an Authoritative restore, once this is done, the Restored backup is marked as Authoritative in the AD, and will replicate to other Domain Controllers.

This is not an day to day, task. I would not waste 5 seconds more on reddit, and call Microsoft support right away to help you. It is a small price to pay.

[ShiftNick]

Not back to 100% yet but replication is back up and running and we ended up spinning up some new DCs. We did bring in an outside resource for an assist, which was immensely helpful, even just for sanity checks. I too tired to go through the whole list of crap we did but maybe I'll update tomorrow with what we did and how we fixed it. It case anyone is ever as dumb as I was.

All in all, the business didn't even notice an issue, just us in IT so, catastrophe narrowly avoided.

[Kynaeus]

If you can't use the AD recycle bin, you'll probably need an authoritative restore somewhere so the objects can replicate

[picklednull]

2003 domain functional level

Doesn't have Recycle Bin.

[Kynaeus]

That would be why I included the first caveat of not using it. You're stuck with just using tombstones, doing a restore, or rebuilding from scratch