Secondary Domain Controller - error 0xc00002e2

[jtek]

Ok, so I have a client and didn't realize application awareness wasn't enabled on one job. We have a secondary domain controller off a sbs 2011 server.

All servers run on a local disk on the main server but the secondary domain controller was set to store the disks on a synology station. Something happened to the synology and it went offline and even though it came back up it corrupted the disk on the secondary domain controller and now it won't boot. I restored the secondary domain controller using a backup and after the restore I got the error code 0xc00002e2. I went an looked and the job set to backup this server didn't have application awareness turned on so it doesn't know how to restore the server with the AD database in tact.

It is enabled on the other jobs so the other domain controllers will be fine if we need a restore.

I can easily build a new box and promote it so it will be the new secondary domain controller. But this server also has the azure sync tool on it and I would like to export the azure settings so I can reinstall on the new server and import the config.

I have read a lot of articles on using the Directory Services Repair mode but I am unclear on what approach to take as most seem to be for the primary controller. I found one article where he talks about deleting that role using DSR and then it will boot. Should I just go that route so I can get it up and running to export the config or is there a way of saving the server without having to rebuild a new box?

I found this post but this seems to be recovering a domain controller where it is the primary and not the secondary.

http://blog.msallal.com/2015/02/windows ... error.html

Obviously my concern is performing the wrong function using DSR and I corrupt the primary domain controller db as well, if that is even possible.

Thanks,

J

[sg_sc]

You need to boot the machine in "directory services restore mode", login with the local Administrator and the password you had to set when promoting the DC.
Move all the *.log files inside c:\windows\NTDS\ to a folder elsewhere.
Try to reboot in normal mode.

If it's not working go back in DSRM,
repeat the moving of any log files in c:\windows\NTDS\,
Open up a CMD (with Run as admin),
Enter the command "esentutl /p c:\windows\NTDS\ntds.dit",
Enter the command "ntdsutil",
In the ntdsutil prompt now enter the following commands (no quotes):
"activate instance ntds"
"Files"
"Compact to c:\temp\"
"quit"
"quit"

Now move the c:\windows\NTDS\ntds.dit file to a save folder elsewhere.
Copy the c:\temp\ntds.dit file to c:\windows\NTDS\
Again remove all the .LOG files inside c:\windows\NTDS
Reboot normally.
More information about this offline defragmentation: https://technet.microsoft.com/nl-be/library/cc794920(v=ws.10).aspx

All these commands are performed on the local database of the secondary DC, not on the live AD of the PDC. If the server boots again it will start replicating with the PDC and the AD database will be updated from the PDC.

If you have SYSVOL issues on the secondary DC you need to trigger a non-authoritative restore NTFRS, this will tell the system to drop the SYSVOL and re-copy the SYSVOL from the PDC.

[foggy]

Hi Joey, to try to retrieve Azure AD Sync Tool settings, you can try to restore the failed DC into the isolated environment and follow this article starting from p.9 "Check the integrity of the Active Directory database". If you manage to fix the database and the system will boot fine, most likely you will be able to run the tool.

[jtek]

So since I learned you have to enable application awareness the hard way by having issues restoring my domain controller I am having the hardest time getting consistent backups. Most of the time VSS is failing on the machines. One client will run flawlessly for days and then it will fail three times in a row in one night for a random server. Another client I can't get it to work at all on a SBS 2011 box and half the time the secondary domain controller won't back up. I have had to disable it on most of the SQL Servers because it would never work. Luckily I am doing nightly backups of the sql databases so if I need to restore I can just restore one of the bak files.

Does everyone else have a hard time getting consistent backups using application awareness? I have been working with support but going back and forth a lot and is taking a while.

Last night I disabled application awarness on the sbs 2011 box just to make sure I got a decent backup of the box and files at the very least.

Thanks,

J

[sg_sc]

you don't have to disable application awareness. You can set it to ignore the failures and produce only warnings.

[jtek]

Does that mean if it generates a warning then it will still get the backup of the server but if the application awareness part fails then just that part will fail when restoring the server?

[foggy]

Yes, you will be able to restore the entire VM, but application consistency is not guaranteed.