» Восстановление контроллера домена Win Server 2008 r2

[more] [more] Microsoft Windows [Version 6.1.7601]
(c) Корпорация Майкрософт (Microsoft Corporation), 2009. Все права защищены.

C:\Users\administrator>dcdiag

Диагностика сервера каталогов

Выполнение начальной настройки:
Выполняется попытка поиска основного сервера...
Основной сервер = dc1
* Идентифицирован лес AD.
Сбор начальных данных завершен.

Выполнение обязательных начальных проверок

Сервер проверки: Default-First-Site-Name\DC1
Запуск проверки: Connectivity
......................... DC1 - пройдена проверка Connectivity

Выполнение основных проверок

Сервер проверки: Default-First-Site-Name\DC1
Запуск проверки: Advertising
......................... DC1 - пройдена проверка Advertising
Запуск проверки: FrsEvent
......................... DC1 - пройдена проверка FrsEvent
Запуск проверки: DFSREvent
......................... DC1 - пройдена проверка DFSREvent
Запуск проверки: SysVolCheck
......................... DC1 - пройдена проверка SysVolCheck
Запуск проверки: KccEvent
......................... DC1 - пройдена проверка KccEvent
Запуск проверки: KnowsOfRoleHolders
......................... DC1 - пройдена проверка KnowsOfRoleHolders
Запуск проверки: MachineAccount
......................... DC1 - пройдена проверка MachineAccount
Запуск проверки: NCSecDesc
......................... DC1 - пройдена проверка NCSecDesc
Запуск проверки: NetLogons
......................... DC1 - пройдена проверка NetLogons
Запуск проверки: ObjectsReplicated
......................... DC1 - пройдена проверка ObjectsReplicated
Запуск проверки: Replications
......................... DC1 - пройдена проверка Replications
Запуск проверки: RidManager
......................... DC1 - пройдена проверка RidManager
Запуск проверки: Services
......................... DC1 - пройдена проверка Services
Запуск проверки: SystemLog
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:17
Строка события:
Драйвер HP Universal Printing PS для принтера HP LaserJet P2015 Seri
es (192.168.79.144) не опознан. Обратитесь к сетевому администратору, чтобы он у
становил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:18
Строка события:
Драйвер Samsung ML-1860 Series для принтера !!192.168.79.110!Samsung
ML-1860 Series не опознан. Обратитесь к сетевому администратору, чтобы он устан
овил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:19
Строка события:
Драйвер HP Universal Printing PCL 6 для принтера !!192.168.79.110!HP
LaserJet P2015 Series UPD PCL 6 не опознан. Обратитесь к сетевому администратор
у, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:20
Строка события:
Драйвер HP Universal Printing PS для принтера HP Universal Printing
PS не опознан. Обратитесь к сетевому администратору, чтобы он установил нужный д
райвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:21
Строка события:
Драйвер PDFCreator для принтера PDFCreator не опознан. Обратитесь к
сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:22
Строка события:
Драйвер PDF Architect Driver для принтера PDF Architect не опознан.
Обратитесь к сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:25
Строка события:
Драйвер Xerox PC Fax для принтера Xerox PC Fax не опознан. Обратитес
ь к сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:26
Строка события:
Драйвер Xerox WorkCentre 3220 PCL 6 для принтера Xerox WorkCentre 32
20 PCL 6 не опознан. Обратитесь к сетевому администратору, чтобы он установил ну
жный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:27
Строка события:
Драйвер Xerox WorkCentre 3220 PS для принтера Xerox WorkCentre 3220
PS не опознан. Обратитесь к сетевому администратору, чтобы он установил нужный д
райвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 14:58:28
Строка события:
Драйвер Send To Microsoft OneNote Driver для принтера Отправить в On
eNote 2007 не опознан. Обратитесь к сетевому администратору, чтобы он установил
нужный драйвер.
Возникло предупреждение. Код события (EventID): 0x00001695
Время создания: 11/26/2013 15:07:23
Строка события:
Ошибка при динамической регистрации или удалении одной или нескольки
х записей DNS, связанных с доменом DNS "ALTSRK.loc.". Эти записи используются д
ругими компьютерами для поиска данного сервера как контроллера домена (если указ
ан домен Active Directory) или как сервера LDAP (если указанный домен является р
азделом приложений).
Возникло предупреждение. Код события (EventID): 0x00001695
Время создания: 11/26/2013 15:07:23
Строка события:
Ошибка при динамической регистрации или удалении одной или нескольки
х записей DNS, связанных с доменом DNS "DomainDnsZones.ALTSRK.loc.". Эти записи
используются другими компьютерами для поиска данного сервера как контроллера до
мена (если указан домен Active Directory) или как сервера LDAP (если указанный д
омен является разделом приложений).
Возникло предупреждение. Код события (EventID): 0x00001695
Время создания: 11/26/2013 15:07:23
Строка события:
Ошибка при динамической регистрации или удалении одной или нескольки
х записей DNS, связанных с доменом DNS "ForestDnsZones.ALTSRK.loc.". Эти записи
используются другими компьютерами для поиска данного сервера как контроллера до
мена (если указан домен Active Directory) или как сервера LDAP (если указанный д
омен является разделом приложений).
Возникло предупреждение. Код события (EventID): 0x8000001D
Время создания: 11/26/2013 15:38:05
Строка события:
Центр распространения ключей (KDC) не может найти подходящий сертифи
кат для использования при регистрации смарт-карт или KDC-сертификат не может быт
ь проверен. Регистрация смарт-карт не может работать правильно, если данная проб
лема не разрешена. Для исправления неполадки либо проверьте существующий сертифи
кат KDC при помощи certutil.exe, либо запросите новый KDC-сертификат.
Возникла ошибка. Код события (EventID): 0xC00038D6
Время создания: 11/26/2013 15:38:33
Строка события:
Службе пространства имен не удалось инициализировать сведения о дове
рительных отношениях между лесами на этом контроллере домена; она будет периодич
ески повторять выполнение операции. Код возврата находится в данных.
Возникло предупреждение. Код события (EventID): 0x000003F6
Время создания: 11/26/2013 15:38:32
Строка события:
Разрешение имен для имени _ldap._tcp.Default-First-Site-Name._sites.
dc._msdcs.ALTSRK.loc истекло после отсутствия ответа от настроенных серверов DNS
.
Возникло предупреждение. Код события (EventID): 0x0000000C
Время создания: 11/26/2013 15:38:41
Строка события:
NTP-клиент поставщика времени: этот компьютер настроен на использова
ние доменной иерархии для определения своего источника времени, но при этом он я
вляется эмулятором основного контроллера домена Active Directory для домена в ко
рне леса, поэтому в доменной иерархии не существует компьютера, расположенного в
ыше, который можно использовать как источник времени. Рекомендуется настроить на
дежную службу времени в корневом домене или вручную настроить основной контролле
р домена Active Directory для синхронизации с внешним источником времени. В прот
ивном случае этот компьютер будет выступать в роли заслуживающего доверия источн
ика времени в доменной иерархии. Если внешний источник времени не настроен или н
е используется для этого компьютера, можно отключить NTP-клиент.
Возникла ошибка. Код события (EventID): 0x00004E8A
Время создания: 11/26/2013 15:40:42
Строка события:
Не удалось удалить интерфейс Внутренний из диспетчера маршрутизации
для протокола IPV6. Произошла следующая ошибка: Параметр задан неверно.
Возникла ошибка. Код события (EventID): 0x00004E8A
Время создания: 11/26/2013 15:40:42
Строка события:
Не удалось удалить интерфейс {83AFE65A-BB1A-4D50-B2EB-F9BE9ADC576B}
из диспетчера маршрутизации для протокола IPV6. Произошла следующая ошибка: Не у
дается завершить выполнение функции.
Возникла ошибка. Код события (EventID): 0x00004E8A
Время создания: 11/26/2013 15:40:42
Строка события:
Не удалось удалить интерфейс {67882722-8A01-4429-B39E-45425BDF1D23}
из диспетчера маршрутизации для протокола IPV6. Произошла следующая ошибка: Не у
дается завершить выполнение функции.
Возникло предупреждение. Код события (EventID): 0x000727AA
Время создания: 11/26/2013 15:40:43
Строка события:
Службе WinRM не удалось создать следующие имена участников-служб: WS
MAN/dc1.ALTSRK.loc, WSMAN/dc1.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:01
Строка события:
Драйвер HP Universal Printing PS для принтера HP LaserJet P2015 Seri
es (192.168.79.144) не опознан. Обратитесь к сетевому администратору, чтобы он у
становил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:04
Строка события:
Драйвер HP Universal Printing PCL 6 для принтера !!192.168.79.110!HP
LaserJet P2015 Series UPD PCL 6 не опознан. Обратитесь к сетевому администратор
у, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:04
Строка события:
Драйвер HP Universal Printing PS для принтера HP Universal Printing
PS не опознан. Обратитесь к сетевому администратору, чтобы он установил нужный д
райвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:05
Строка события:
Драйвер Xerox PC Fax для принтера Xerox PC Fax не опознан. Обратитес
ь к сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:08
Строка события:
Драйвер PDF Architect Driver для принтера PDF Architect не опознан.
Обратитесь к сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:08
Строка события:
Драйвер PDFCreator для принтера PDFCreator не опознан. Обратитесь к
сетевому администратору, чтобы он установил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:09
Строка события:
Драйвер Samsung ML-1860 Series для принтера !!192.168.79.110!Samsung
ML-1860 Series не опознан. Обратитесь к сетевому администратору, чтобы он устан
овил нужный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:10
Строка события:
Драйвер Xerox WorkCentre 3220 PCL 6 для принтера Xerox WorkCentre 32
20 PCL 6 не опознан. Обратитесь к сетевому администратору, чтобы он установил ну
жный драйвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:10
Строка события:
Драйвер Xerox WorkCentre 3220 PS для принтера Xerox WorkCentre 3220
PS не опознан. Обратитесь к сетевому администратору, чтобы он установил нужный д
райвер.
Возникла ошибка. Код события (EventID): 0x00000457
Время создания: 11/26/2013 15:43:11
Строка события:
Драйвер Send To Microsoft OneNote Driver для принтера Отправить в On
eNote 2007 не опознан. Обратитесь к сетевому администратору, чтобы он установил
нужный драйвер.
Возникла ошибка. Код события (EventID): 0xC0002719
Время создания: 11/26/2013 15:53:14
Строка события:
Не удалось установить связь DCOM с компьютером 212.19.149.226 через
один из настроенных протоколов.
......................... DC1 - не пройдена проверка SystemLog
Запуск проверки: VerifyReferences
......................... DC1 - пройдена проверка VerifyReferences


Выполнение проверок разделов на: DomainDnsZones
Запуск проверки: CheckSDRefDom
......................... DomainDnsZones - пройдена проверка
CheckSDRefDom
Запуск проверки: CrossRefValidation
......................... DomainDnsZones - пройдена проверка
CrossRefValidation

Выполнение проверок разделов на: ForestDnsZones
Запуск проверки: CheckSDRefDom
......................... ForestDnsZones - пройдена проверка
CheckSDRefDom
Запуск проверки: CrossRefValidation
......................... ForestDnsZones - пройдена проверка
CrossRefValidation

Выполнение проверок разделов на: Schema
Запуск проверки: CheckSDRefDom
......................... Schema - пройдена проверка CheckSDRefDom
Запуск проверки: CrossRefValidation
......................... Schema - пройдена проверка
CrossRefValidation

Выполнение проверок разделов на: Configuration
Запуск проверки: CheckSDRefDom
......................... Configuration - пройдена проверка
CheckSDRefDom
Запуск проверки: CrossRefValidation
......................... Configuration - пройдена проверка
CrossRefValidation

Выполнение проверок разделов на: ALTSRK
Запуск проверки: CheckSDRefDom
......................... ALTSRK - пройдена проверка CheckSDRefDom
Запуск проверки: CrossRefValidation
......................... ALTSRK - пройдена проверка
CrossRefValidation

Выполнение проверок предприятия на: ALTSRK.loc
Запуск проверки: LocatorCheck
......................... ALTSRK.loc - пройдена проверка LocatorCheck
Запуск проверки: Intersite
......................... ALTSRK.loc - пройдена проверка Intersite

C:\Users\administrator> [/more] [/more]

Возникла следующая проблема.
Один из трёх DC (2012 R2) по техническим причинам был отключён на срок около месяца. После того, как его включили, остальные два DC наотрез отказываются с ним иметь дело. Попытался при загрузке восстановить AD (выбор по <F8>), не помогло. Можно, конечно, грохнуть DC, да поднять новый, но может ещё можно его реанимировать?
P. S. Если нужна информация из DCDiag, приведу её.

BVV63 Вообще-то tombstone lifetime windows server 2012 по дефолту 180 дней, странно, что у тебя через 30 дней слетело. Его кстати можно менять.
http://www.dell.com/support/article/us/en/19/SLN283178/EN


Сейчас надо по repadmin посмотреть что там и как не реплицируется

repadmin /showrepl
dcdiag /test:replications

Далее думать.

Обычно трабла из-за SYSVOL возникает, начни с этого, читай статью
https://support.microsoft.com/en-us/kb/315457
Суть - останавливается служба NTFRS на всех контроллерах (net stop ntfrs), в реестре правится параметр D2 на D4, далее в определенном порядке запускаются службы NTFRS ( net start ntfrs)

Читай с пункта How to rebuild the domain SYSVOL replica set across enterprise environments
Возможно поможет простое копирование SYSVOL с другого контроллера, прочти конец статьи
How to temporarily stabilize the domain SYSVOL tree


Команды для принудительной репликации в консоли
repadmin /syncall полное_имя_контроллера # с которым делаешь репликацию

Еще одна статья
Восстановление AD из System State на другом железе
http://sysrtfm.ru/windows-sever-2003/vosstanovlenie-ad-iz-system-state-na-drugom-zheleze/
Начало пропусти. читай с пункта
2 — В домене несколько контроллеров домена:

ipmanyak
В статье https://support.microsoft.com/en-us/kb/315457 дошёл до

Цитата:

ntfrsutl ds |findstr /i "root stage"

и на проблемном DC никакого ответа не получил. Тогда выполнил просто

Код: ntfrsutl ds

покажи
repadmin /showrepl
dcdiag /v
dcdiag /test:replications

ntfrsutl ds |findstr /i "root stage" - это можно не делать, если после
всех действий с D4 D2 и рестартов ntfrs
и repadmin /syncall полное_имя_контроллера и repadmin /showrepl покажет, что всё в норме.

Пробовал сначала действия в конце статьи - How to temporarily stabilize the domain SYSVOL tree ?

repadmin /showrepl что сообщал ?


Добавлено:
Если на серваке ничего ценного нет, то проще и быстрее вывести его из доменконтроллеров и поднять заново. Но без репликации может не дать вывести нормально и придется принудительно выводить

Удаление данных из Active Directory после неудачного понижения роли контроллера домена
http://support.microsoft.com/kb/216498/ru
http://support.microsoft.com/kb/216498/en

ipmanyak

Цитата:

repadmin /showrepl

[more]
Repadmin: running command /showrepl against full DC localhost

DIS\MZ3

DSA Options: IS_GC DISABLE_INBOUND_REPL DISABLE_OUTBOUND_REPL

Site Options: (none)

DSA object GUID: 79a0e382-2465-4c23-b4ef-2e00a1561207

DSA invocationID: 3fd1401b-f09c-46b6-a9dc-e2b5076b7129



==== INBOUND NEIGHBORS ======================================



DC=mz,DC=intra

DIS\DC1 via RPC

DSA object GUID: ed40e239-a588-4281-88d7-2194e8c5016a

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 07:24:35.

DIS\MZ2 via RPC

DSA object GUID: eee91c6c-a3ff-41f2-835b-be2784b6eb4e

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 07:24:40.



CN=Configuration,DC=mz,DC=intra

DIS\DC1 via RPC

DSA object GUID: ed40e239-a588-4281-88d7-2194e8c5016a

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

87 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.

DIS\MZ2 via RPC

DSA object GUID: eee91c6c-a3ff-41f2-835b-be2784b6eb4e

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.



CN=Schema,CN=Configuration,DC=mz,DC=intra

DIS\DC1 via RPC

DSA object GUID: ed40e239-a588-4281-88d7-2194e8c5016a

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.

DIS\MZ2 via RPC

DSA object GUID: eee91c6c-a3ff-41f2-835b-be2784b6eb4e

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.



DC=DomainDnsZones,DC=mz,DC=intra

DIS\DC1 via RPC

DSA object GUID: ed40e239-a588-4281-88d7-2194e8c5016a

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 07:24:06.

DIS\MZ2 via RPC

DSA object GUID: eee91c6c-a3ff-41f2-835b-be2784b6eb4e

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 07:24:27.



DC=ForestDnsZones,DC=mz,DC=intra

DIS\DC1 via RPC

DSA object GUID: ed40e239-a588-4281-88d7-2194e8c5016a

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.

DIS\MZ2 via RPC

DSA object GUID: eee91c6c-a3ff-41f2-835b-be2784b6eb4e

Last attempt @ 2015-04-24 07:48:43 failed, result 8457 (0x2109):

The destination server is currently rejecting replication requests.

88 consecutive failure(s).

Last success @ 2015-04-01 06:57:42.



Source: DIS\MZ2

******* 88 CONSECUTIVE FAILURES since 2015-04-01 07:24:40

Last error: 8457 (0x2109):

The destination server is currently rejecting replication requests.



Source: DIS\DC1

******* 88 CONSECUTIVE FAILURES since 2015-04-01 07:24:35

Last error: 8457 (0x2109):

The destination server is currently rejecting replication requests.
[/more]

Цитата:

dcdiag /v

[more]

Directory Server Diagnosis


Performing initial setup:

Trying to find home server...

* Verifying that the local machine MZ3, is a Directory Server.
Home Server = MZ3

* Connecting to directory service on server MZ3.

* Identified AD Forest.
Collecting AD specific global data
* Collecting site info.

Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=mz,DC=intra,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
The previous call succeeded
Iterating through the sites
Looking at base site object: CN=NTDS Site Settings,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
Getting ISTG and options for the site
* Identifying all servers.

Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=mz,DC=intra,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
The previous call succeeded....
The previous call succeeded
Iterating through the list of servers
Getting information for the server CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
Getting information for the server CN=NTDS Settings,CN=MZ2,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
Getting information for the server CN=NTDS Settings,CN=MZ3,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
objectGuid obtained
InvocationID obtained
dnsHostname obtained
site info obtained
All the info for the server collected
* Identifying all NC cross-refs.

* Found 3 DC(s). Testing 1 of them.

Done gathering initial info.


Doing initial required tests


Testing server: DIS\MZ3

Starting test: Connectivity

* Active Directory LDAP Services Check
Determining IP4 connectivity
* Active Directory RPC Services Check
......................... MZ3 passed test Connectivity



Doing primary tests


Testing server: DIS\MZ3

Starting test: Advertising

Warning: DsGetDcName returned information for \\MZ2.mz.intra, when we

were trying to reach MZ3.

SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.

......................... MZ3 failed test Advertising

Test omitted by user request: CheckSecurityError

Test omitted by user request: CutoffServers

Starting test: FrsEvent

* The File Replication Service Event log test
There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.
A warning event occurred. EventID: 0x800034FA

Time Generated: 04/23/2015 23:19:34

Event String:

Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller MZ3.mz.intra for FRS replica set configuration information.



Could not find computer object for this computer. Will try again at next polling cycle.





A warning event occurred. EventID: 0x800034FA

Time Generated: 04/23/2015 23:28:09

Event String:

Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller MZ3.mz.intra for FRS replica set configuration information.



Could not bind to a Domain Controller. Will try again at next polling cycle.





......................... MZ3 passed test FrsEvent

Starting test: DFSREvent

The DFS Replication Event Log.
Skip the test because the server is running FRS.

......................... MZ3 passed test DFSREvent

Starting test: SysVolCheck

* The File Replication Service SYSVOL ready test
File Replication Service's SYSVOL is ready
......................... MZ3 passed test SysVolCheck

Starting test: KccEvent

* The KCC Event log test
Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
......................... MZ3 passed test KccEvent

Starting test: KnowsOfRoleHolders

Role Schema Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
[DC1] DsBindWithSpnEx() failed with error -2146893022,

The target principal name is incorrect..
Warning: DC1 is the Schema Owner, but is not responding to DS RPC

Bind.

[DC1] LDAP bind failed with error 8341,

A directory service error has occurred..
Warning: DC1 is the Schema Owner, but is not responding to LDAP Bind.

Role Domain Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
Warning: DC1 is the Domain Owner, but is not responding to DS RPC

Bind.

Warning: DC1 is the Domain Owner, but is not responding to LDAP Bind.

Role PDC Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
Warning: DC1 is the PDC Owner, but is not responding to DS RPC Bind.

Warning: DC1 is the PDC Owner, but is not responding to LDAP Bind.

Role Rid Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
Warning: DC1 is the Rid Owner, but is not responding to DS RPC Bind.

Warning: DC1 is the Rid Owner, but is not responding to LDAP Bind.

Role Infrastructure Update Owner = CN=NTDS Settings,CN=DC1,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra
Warning: DC1 is the Infrastructure Update Owner, but is not responding

to DS RPC Bind.

Warning: DC1 is the Infrastructure Update Owner, but is not responding

to LDAP Bind.

......................... MZ3 failed test KnowsOfRoleHolders

Starting test: MachineAccount

Checking machine account for DC MZ3 on DC MZ3.
* SPN found :LDAP/MZ3.mz.intra/mz.intra
* SPN found :LDAP/MZ3.mz.intra
* SPN found :LDAP/MZ3
* SPN found :LDAP/MZ3.mz.intra/MZ
* SPN found :LDAP/79a0e382-2465-4c23-b4ef-2e00a1561207._msdcs.mz.intra
* SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/79a0e382-2465-4c23-b4ef-2e00a1561207/mz.intra
* SPN found :HOST/MZ3.mz.intra/mz.intra
* SPN found :HOST/MZ3.mz.intra
* SPN found :HOST/MZ3
* SPN found :HOST/MZ3.mz.intra/MZ
* SPN found :GC/MZ3.mz.intra/mz.intra
......................... MZ3 passed test MachineAccount

Starting test: NCSecDesc

* Security Permissions check for all NC's on DC MZ3.
The forest is not ready for RODC. Will skip checking ERODC ACEs.
* Security Permissions Check for

DC=ForestDnsZones,DC=mz,DC=intra
(NDNC,Version 3)
* Security Permissions Check for

DC=DomainDnsZones,DC=mz,DC=intra
(NDNC,Version 3)
* Security Permissions Check for

CN=Schema,CN=Configuration,DC=mz,DC=intra
(Schema,Version 3)
* Security Permissions Check for

CN=Configuration,DC=mz,DC=intra
(Configuration,Version 3)
* Security Permissions Check for

DC=mz,DC=intra
(Domain,Version 3)
......................... MZ3 passed test NCSecDesc

Starting test: NetLogons

* Network Logons Privileges Check
Verified share \\MZ3\netlogon
Verified share \\MZ3\sysvol
......................... MZ3 passed test NetLogons

Starting test: ObjectsReplicated

MZ3 is in domain DC=mz,DC=intra
Checking for CN=MZ3,OU=Domain Controllers,DC=mz,DC=intra in domain DC=mz,DC=intra on 1 servers
Object is up-to-date on all servers.
Checking for CN=NTDS Settings,CN=MZ3,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra in domain CN=Configuration,DC=mz,DC=intra on 1 servers
Object is up-to-date on all servers.
......................... MZ3 passed test ObjectsReplicated

Test omitted by user request: OutboundSecureChannels

Starting test: Replications

* Replications Check
[Replications Check,Replications Check] Inbound replication is

disabled.

To correct, run "repadmin /options MZ3 -DISABLE_INBOUND_REPL"

[Replications Check,MZ3] Outbound replication is disabled.

To correct, run "repadmin /options MZ3 -DISABLE_OUTBOUND_REPL"

......................... MZ3 failed test Replications

Starting test: RidManager

* Available RID Pool for the Domain is 33607 to 1073741823
* DC1.mz.intra is the RID Master
......................... MZ3 failed test RidManager

Starting test: Services

* Checking Service: EventSystem
* Checking Service: RpcSs
* Checking Service: NTDS
* Checking Service: DnsCache
* Checking Service: NtFrs
* Checking Service: IsmServ
* Checking Service: kdc
* Checking Service: SamSs
* Checking Service: LanmanServer
* Checking Service: LanmanWorkstation
* Checking Service: w32time
w32time Service is stopped on [MZ3]

* Checking Service: NETLOGON
NETLOGON Service is paused on [MZ3]

......................... MZ3 failed test Services

Starting test: SystemLog

* The System Event log test
An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:16:36

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0xC00038D6

Time Generated: 04/24/2015 07:18:55

Event String:

The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation. The return code is in the record data.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:21:19

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was ldap/DC1.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:21:36

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:26:35

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was E3514235-4B06-11D1-AB04-00C04FC2DCD2/ed40e239-a588-4281-88d7-2194e8c5016a/mz.intra@mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:26:37

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:26:50

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was E3514235-4B06-11D1-AB04-00C04FC2DCD2/eee91c6c-a3ff-41f2-835b-be2784b6eb4e/mz.intra@mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:28:27

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz3$. The target name used was cifs/MZ3.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:29:12

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was LDAP/MZ2.mz.intra/mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:29:12

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was LDAP/MZ2.mz.intra/MZ. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:31:38

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:34:28

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz3$. The target name used was LDAP/MZ3. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 07:34:28

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was DNS/dc1.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:36:39

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:41:40

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:46:40

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:51:42

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 07:56:43

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 08:01:44

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:03:13

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz3$. The target name used was ldap/MZ3.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:04:19

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was cifs/MZ2.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:06:44

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was LDAP/MZ2.mz.intra/mz.intra@MZ.INTRA. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:06:45

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server mz2$. The target name used was ldap/MZ2.mz.intra/mz.intra@MZ.INTRA. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 08:06:45

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x000003EE

Time Generated: 04/24/2015 08:11:46

Event String:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:15:36

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was LDAP/ed40e239-a588-4281-88d7-2194e8c5016a._msdcs.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

An error event occurred. EventID: 0x40000004

Time Generated: 04/24/2015 08:15:36

Event String:

The Kerberos client received a KRB_AP_ERR_MODIFIED error from the server dc1$. The target name used was ldap/dc1.mz.intra. This indicates that the target server failed to decrypt the ticket provided by the client. This can occur when the target server principal name (SPN) is registered on an account other than the account the target service is using. Ensure that the target SPN is only registered on the account used by the server. This error can also happen if the target service account password is different than what is configured on the Kerberos Key Distribution Center for that target service. Ensure that the service on the server and the KDC are both configured to use the same password. If the server name is not fully qualified, and the target domain (MZ.INTRA) is different from the client domain (MZ.INTRA), check if there are identically named server accounts in these two domains, or use the fully-qualified name to identify the server.

......................... MZ3 failed test SystemLog

Test omitted by user request: Topology

Test omitted by user request: VerifyEnterpriseReferences

Starting test: VerifyReferences

The system object reference (serverReference)

CN=MZ3,OU=Domain Controllers,DC=mz,DC=intra and backlink on

CN=MZ3,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra are

correct.
The system object reference (serverReferenceBL)

CN=MZ3,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=mz,DC=intra

and backlink on

CN=NTDS Settings,CN=MZ3,CN=Servers,CN=DIS,CN=Sites,CN=Configuration,DC=mz,DC=intra

are correct.
The system object reference (frsComputerReferenceBL)

CN=MZ3,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=mz,DC=intra

and backlink on CN=MZ3,OU=Domain Controllers,DC=mz,DC=intra are

correct.
......................... MZ3 passed test VerifyReferences

Test omitted by user request: VerifyReplicas


Test omitted by user request: DNS

Test omitted by user request: DNS


Running partition tests on : ForestDnsZones

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... ForestDnsZones passed test

CrossRefValidation


Running partition tests on : DomainDnsZones

Starting test: CheckSDRefDom

......................... DomainDnsZones passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... DomainDnsZones passed test

CrossRefValidation


Running partition tests on : Schema

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Schema passed test CrossRefValidation


Running partition tests on : Configuration

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... Configuration passed test CrossRefValidation


Running partition tests on : mz

Starting test: CheckSDRefDom

......................... mz passed test CheckSDRefDom

Starting test: CrossRefValidation

......................... mz passed test CrossRefValidation


Running enterprise tests on : mz.intra

Test omitted by user request: DNS

Test omitted by user request: DNS

Starting test: LocatorCheck

[MZ2] LDAP bind failed with error 8341,

A directory service error has occurred..
Warning: Couldn't verify this server as a GC in this servers AD.
GC Name: \\MZ2.mz.intra

Locator Flags: 0xe00071fd
Error: The server returned by DsGetDcName() did not match

DsListRoles() for the PDC

PDC Name: \\MZ2.mz.intra
Locator Flags: 0xe00071fd
Time Server Name: \\MZ2.mz.intra
Locator Flags: 0xe00071fd
Preferred Time Server Name: \\MZ2.mz.intra
Locator Flags: 0xe00071fd
KDC Name: \\MZ2.mz.intra
Locator Flags: 0xe00071fd
......................... mz.intra passed test LocatorCheck

Starting test: Intersite

Skipping site DIS, this site is outside the scope provided by the

command line arguments provided.
......................... mz.intra passed test Intersite
[/more]

Цитата:

dcdiag /test:replications

[more]

Directory Server Diagnosis


Performing initial setup:

Trying to find home server...

Home Server = MZ3

* Identified AD Forest.
Done gathering initial info.


Doing initial required tests


Testing server: DIS\MZ3

Starting test: Connectivity

......................... MZ3 passed test Connectivity



Doing primary tests


Testing server: DIS\MZ3

Starting test: Replications

[Replications Check,Replications Check] Inbound replication is

disabled.

To correct, run "repadmin /options MZ3 -DISABLE_INBOUND_REPL"

[Replications Check,MZ3] Outbound replication is disabled.

To correct, run "repadmin /options MZ3 -DISABLE_OUTBOUND_REPL"

......................... MZ3 failed test Replications



Running partition tests on : ForestDnsZones


Running partition tests on : DomainDnsZones


Running partition tests on : Schema


Running partition tests on : Configuration


Running partition tests on : mz


Running enterprise tests on : mz.intra
[/more]

Цитата:

Если на серваке ничего ценного нет, то проще и быстрее вывести его из доменконтроллеров и поднять заново. Но без репликации может не дать вывести нормально и придется принудительно выводить

На серваке нет ничего ценного. Принудительно DC я выводил не раз, не привыкать.

Цитата:

How to temporarily stabilize the domain SYSVOL tree ?

Нет, не пробовал. Показалось рискованным.

Восстановил. Если, конечно, можно так выразиться. Оказывается, там просто служба "Netlogon" была в состоянии "Paused". И ведь смотрел я на службы, но как-то невнимательно: при беглом взгляде надписи "Running" и "Paused" похожи, ага.

Но как же так: почему при перезагрузках (коих было немало), состояние "Paused" не снялось?

Вообщем ситуация такая server 2008 standart, на сервере поднят контроллер домена с АД , DNS и DHCP , на нем же стоит
Kerio WinRoute Firewall 6.7.1 Две сетевые карты одна смотр ит наружу в интернет, другая в локалку.
Есть полный бэкап сервера снятый Acronis Backup&Recovery ,( железо на котором стоял контроллер домена и делался бэкап необратимо вышло из строя.)
Как (пошагово) поднять контроллер домена с прежними настройками из резервной копии ? При запуске dcpromo сообщается, что АД будет необратимо удалена.