netlogon service paused at dC startup

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote in message
news:. com...
> Hello Stingray,
>
> Adding the other DCs ip address will not help for whatever reason you
> thought about.
>
> As stated in Event ID: 2103 the stopped netlogon states to the unsupported
> way of restore. So as you have only one DC i see not a way to restore the
> domain.
>
> Basically adding a DC to the domain when the problem exists will not help
> as you copy the existing AD database with the problem to the new server.
>
> For the event id 13559 see this articles, maybe they help you:
> http://support.microsoft.com/kb/819268
>
> http://support.microsoft.com/kb/887440
>
> In my opinion the best option is to start from scratch with the domain and
> make a new one with 2 DC/DNS/GC as recommended for failover and
> redundancy.
>
> Maybe you can create a trust to anew installed domain with different
> domain name and use ADMT to migrate the existing accounts and computers,
> but as there is this critical situation i am not sure if this will work.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

Hi Meinolf.

At this point, I don't think a trust can be created in the DC's current
state and would agree that starting from scratch seems to be the best option
at this point.

To Stingray:

I've seen this in the past with image restores that others have done and
been called in to fix it. It's sometimes not even worth the hours to put in
and the effort even if it were possible (I don't think it is at this point
with this DC), when a new build will take a fraction of the time and you can
move on.

Ace

Hello Ace,

i think also it will not work to create the trust and migrate to a new domain,
but as the OP is searching so hard for a way he can try to do it. He can
loose nothing, as he already has lost the domain.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote in message
> news:. com...
>
>> Hello Stingray,
>>
>> Adding the other DCs ip address will not help for whatever reason you
>> thought about.
>>
>> As stated in Event ID: 2103 the stopped netlogon states to the
>> unsupported way of restore. So as you have only one DC i see not a
>> way to restore the domain.
>>
>> Basically adding a DC to the domain when the problem exists will not
>> help as you copy the existing AD database with the problem to the new
>> server.
>>
>> For the event id 13559 see this articles, maybe they help you:
>> http://support.microsoft.com/kb/819268
>>
>> http://support.microsoft.com/kb/887440
>>
>> In my opinion the best option is to start from scratch with the
>> domain and make a new one with 2 DC/DNS/GC as recommended for
>> failover and redundancy.
>>
>> Maybe you can create a trust to anew installed domain with different
>> domain name and use ADMT to migrate the existing accounts and
>> computers, but as there is this critical situation i am not sure if
>> this will work.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> Hi Meinolf.
>
> At this point, I don't think a trust can be created in the DC's
> current state and would agree that starting from scratch seems to be
> the best option at this point.
>
> To Stingray:
>
> I've seen this in the past with image restores that others have done
> and been called in to fix it. It's sometimes not even worth the hours
> to put in and the effort even if it were possible (I don't think it is
> at this point with this DC), when a new build will take a fraction of
> the time and you can move on.
>
> Ace
>

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> wrote in message
news:. com...
> Hello Ace,
>
> i think also it will not work to create the trust and migrate to a new
> domain, but as the OP is searching so hard for a way he can try to do it.
> He can loose nothing, as he already has lost the domain.
>
> Best regards
>
> Meinolf Weber

That's a good point. :-)

Cheers!

Ace

Thanks for the Help Meinolf & Ace .. i really appriciate it.
it seems like all is lost for me regarding recovering my old DC. now
that i have to build a new domain from scratch, can you tell me if there
is a way to import user/computer accounts with their SID's onto the new
domain ? like we have couple of application integrated with Active
directory that would require reconfiguration on the server & client
desktops, and belive me its a mamoth task can take couple of days to do.
in other words i want to bring a new domain into place without
distrubing clients desktop. thats my biggest concern.

Thanks & regards once again.



On 12/26/2009 5:07 AM, Meinolf Weber [MVP-DS] wrote:
> Hello Stingray,
>
> An USN rollback occur if you have more then one DC and restore one of it
> from an unsupported backup solution. So as you said there is only one DC
> in the network USN rollback will not occur. The USN are stored on the
> DCs and on none other machines in the domain.
>
> Please post the link to the article from Microsoft with the solution you
> found.
>
> Also describe more detailed what you have done.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> I am having serious problems here, see I have a small network & a
>> single
>> active directory server in a virtual server environment, now I did a
>> mistake
>> I.e restore my DC from snapshot after its windows installation got
>> corrupt.
>> now according to Microsoft this is not supported which I found out
>> afterwards & causes a situation called USN rollback.
>> & this is now causing the netlogon service to be paused after every
>> restart
>> of the server.
>> How can I fix this ? the solution to this from Microsoft is to install
>> another dC transfer DNS & server roles to that server & remove active
>> directory from this & reinstall active directory again using dcpromo.
>> but this is not working as soon as I do all the things according to
>> Microsoft document steps & shutdown the old problem giving server,
>> things
>> stops working.clients cannot join domain, & no authentication occurs
>> now I cannot get rid of the DC with USN roll back problem, and keep
>> getting
>> the pause in netlogin service.
>> can anyone help me in this ?
>> Happy birthday of prophet Jesus to all of you.
>> regards
>>
>
>

Hello S t i n g r a y,

Check this one:
http://support.microsoft.com/kb/555636

But it will not export/import all settings, there is still requirement for
doing manual changes.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks for the Help Meinolf & Ace .. i really appriciate it.
> it seems like all is lost for me regarding recovering my old DC. now
> that i have to build a new domain from scratch, can you tell me if
> there
> is a way to import user/computer accounts with their SID's onto the
> new
> domain ? like we have couple of application integrated with Active
> directory that would require reconfiguration on the server & client
> desktops, and belive me its a mamoth task can take couple of days to
> do.
> in other words i want to bring a new domain into place without
> distrubing clients desktop. thats my biggest concern.
> Thanks & regards once again.
>
> On 12/26/2009 5:07 AM, Meinolf Weber [MVP-DS] wrote:
>
>> Hello Stingray,
>>
>> An USN rollback occur if you have more then one DC and restore one of
>> it from an unsupported backup solution. So as you said there is only
>> one DC in the network USN rollback will not occur. The USN are stored
>> on the DCs and on none other machines in the domain.
>>
>> Please post the link to the article from Microsoft with the solution
>> you found.
>>
>> Also describe more detailed what you have done.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> I am having serious problems here, see I have a small network & a
>>> single
>>> active directory server in a virtual server environment, now I did a
>>> mistake
>>> I.e restore my DC from snapshot after its windows installation got
>>> corrupt.
>>> now according to Microsoft this is not supported which I found out
>>> afterwards & causes a situation called USN rollback.
>>> & this is now causing the netlogon service to be paused after every
>>> restart
>>> of the server.
>>> How can I fix this ? the solution to this from Microsoft is to
>>> install
>>> another dC transfer DNS & server roles to that server & remove
>>> active
>>> directory from this & reinstall active directory again using
>>> dcpromo.
>>> but this is not working as soon as I do all the things according to
>>> Microsoft document steps & shutdown the old problem giving server,
>>> things
>>> stops working.clients cannot join domain, & no authentication occurs
>>> now I cannot get rid of the DC with USN roll back problem, and keep
>>> getting
>>> the pause in netlogin service.
>>> can anyone help me in this ?
>>> Happy birthday of prophet Jesus to all of you.
>>> regard

"S t i n g r a y" <> wrote in message
news:...
> Thanks for the Help Meinolf & Ace .. i really appriciate it.
> it seems like all is lost for me regarding recovering my old DC. now that
> i have to build a new domain from scratch, can you tell me if there is a
> way to import user/computer accounts with their SID's onto the new domain
> ? like we have couple of application integrated with Active directory that
> would require reconfiguration on the server & client desktops, and belive
> me its a mamoth task can take couple of days to do.
> in other words i want to bring a new domain into place without distrubing
> clients desktop. thats my biggest concern.
>
> Thanks & regards once again.

Unfortunately, any migration is task intensive. If you can create a trust,
ADMT is your best option to migrate users, groups and computer accounts
preserving SID History, otherwise, no, it will be from scratch. Meinolf
pointed out using LDIFDE as one method, but they will be new SIDs and
require you to make changes to make it work.

Ace