Rebuild Procedure for Malfunctioning Domain Controller in the CSCF Active Directory

The domain controller intacta in the CS-GENERAL domain died a couple of weeks ago. This left the CS-GENERAL domain relying strictly on one domain controller (serverus) for authentication.

Since both serverus and intacta retain essentially the same information it was possible to quickly wipe intacta clean and place a new Windows 2003 image on the server. The procedure is as follows.

  1. If the failing domain controller (intacta) is an operational master, then transfer (if possible) all operational master roles to an alternate domain controller: serverus. This is done using the Active Directory Users and Computers programme in the Administators tools.
  2. Shutdown intacta.
  3. Delete intacta's computer entry from the domain.
  4. Pull out intacta's mirror drive for safe keeping.
  5. Reapply CSCF Windows 2003 OS image onto intacta (following README instructions).
  6. Boot intacta, follow through with driver install process. Specify elisa and eponina as primary and secondary DNS servers.
    Disable unused network adaptor.
  7. Patch the server using Windows Update in Internet Explorer.
  8. Convert intacta to a domain controller using dcpromo.exe command. Follow the wizard to make intacta a domain controller in CS-GENERAL.
    A server reboot will have to take place when this is complete.
  9. Wait for domain controllers in CS-GENERAL to synchronize (about 90 minutes).
  10. In Directory Service logs on intacta check for any remaining issues.
  11. Seize any remaining operational master roles to serverus using the NTDSUTIL.EXE commmand. There is a nice MS Knowledge Base article #255504 that outlines how to perform this task.
  12. Reboot intacta.
  13. Reassign operational master roles back to intacta.
  14. Once statisfied that intacta is work properly, replace the server's mirror drive and re-establish mirroring.
NOTE: In spite of the fact that one of the two domain controllers in CS-GENERAL was down, no one noticed that there was anything wrong with the domain during the repair period.