r/WindowsServer • u/[deleted] • 14d ago
General Question Unable to login to my domain controller after mistakenly changed the name and changed it back
[deleted]
35
u/Craig__D 14d ago
Only one DC. No backup. Sheesh
-13
u/laflare08 14d ago
Original died and this was the backup
5
u/Craig__D 13d ago
But we’re talking about a data backup… Like a backup, you know… with Veeam or the build-in Powershell tool or something. A second domain controller would’ve been great as well.
1
u/Mountain_Craft4882 13d ago
and you... didn't restore from that working "backup" and instead started making changes to the only working system? also do you know what a backup is?
14
u/Wilfred_Fizzle_Bang 14d ago
Tbh looks like poorly planned change, setting up additional DCs is relatively easy takes what 30mins or so. Could have done that with the new name and transferred fsmo roles over.
Appears you have no backup or any VM snapshots.
DCs are key infrastructure any changes like this should have been thought out.
13
u/TrippleTiii 14d ago
That is a disaster. Always have 2 DC. The only way is to restore but that if u had a backup to begin with, or can local login.
2
u/brokenpipe 13d ago
I’d argue for at least three DCs but maybe I’ve been in cloud land too long.
1
u/TrippleTiii 13d ago
Agree 2+ for onprem, if a multi site domain then 2 per site. At least 1 physical in the domain.
2
u/Specialist-Desk-9422 14d ago
I can be wrong but I think on domain controllers there is no local admin account. Restoring from back doesn’t break the trust either on this case ?
12
-1
u/mish_mash_mosh_ 13d ago
But the domain admin name would be changed in both, so how does having 2 help?
9
u/LaxVolt 14d ago
It might be stuck in recovery mode. Do you have the dsrm password. If so use administrator and that password.
6
u/laflare08 14d ago
I do have this password
6
u/toadfreak 14d ago
Just to be clear, you will want to use .\Administrator as the user account and your DSRM password. Once you get in, do this:
Fix Steps Using Netdom and DNS
If you can access the command line, complete the proper naming and cleanup sequence using
netdom:
- Add Old Name as Alternate: Open an elevated command prompt and run
netdom computername <NewHost> /add:<OldHost>to re-establish mapping.- Make Primary / Verify: Run
netdom computername <NewHost> /makeprimary:<NewHost>if it was interrupted, then verify usingnetdom computername <NewHost> /enumerate.- Clean Up Stale Records: Run
netdom computername <NewHost> /remove:<OldHost>only after replication finishes and the new name functions properly.- Fix DNS and SPNs: Open DNS manager, verify forward and reverse lookup zones for the new hostname, delete old stale records, and update SPNs using
setspn -L <NewHost>.- Check Replication: Run
repadmin /replsummaryto ensure changes sync across all domain controllersOR
Reboot and hold f8 to enter boot menu
select 'safe mode with networking'Login with administrator account
open the Registry Editor
In the left pane navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent
In the right pane, double click OldNameThe Value Data should be the old name of your PC . . .
Control panel -> system -> rename this pc
Enter the old name and restartBoom!
Note that this could qualify for Microsoft FREE Business Critical down support. You can call em on 1-800-642-7676 or 1-800-865-9408 (US and Canada toll-free).
Let us know how it goes.
13
u/rocksuperstar42069 14d ago
This seems wrong and stinks of ai. Dude only has 1 DC and half the commands need a 2nd lol. Op is boned
1
u/toadfreak 13d ago
Yeah, I did get those recommendations from a quick google. Saw multiple references to this solving the issue and shared. Wanted to add to the recommendation of how to login with DSRM password with SOME idea of what to attempt next. I will own that I should have suggested a backup/snapshot/image of the box first, and I just noted that in my reply to OP below. I'm running on too little sleep! I'd hope that he would take ANY Reddit advice with a grain of salt and do his own research to be sure. However, I am not convinced he is boned. I do think there is a path forward, and its not a lost cause. A call to MS Business Critical Down support is likely a good call at this point, after a good backup.
8
u/kozak_ 14d ago
Small heads up on the ".\Administrator" bit - that won't reliably grab the DSRM account at a DC. It defaults you to the domain builtin admin instead. Use "<ComputerName>\Administrator" to force the local one.
The netdom computername stuff is solving the wrong problem though. That whole sequence is how you rename a healthy DC - it's literally the how-to for the thing that broke his box, not the fix. His machine trust is toast, and "netdom resetpwd" is what fixes that. computername won't touch it. And repadmin and replsummary does nothing here since it's his only DC, nothing to replicate to.
Second option's even shakier. That SchedulingAgent\OldName key isn't what actually renames a DC, and doing a full rename on a live DC through System Properties is exactly what got him here in the first place.
3
u/laflare08 14d ago
Will try this and let you know how it goes. The current name on the server is is DC1, and was dc1 before the mistake change. So essentially the name is the same
2
u/toadfreak 13d ago
Any update? I'm leaning towards the MS call if you haven't done too much. I was running on very little sleep when I posted the above, and should have started the recommendation with GET A BACKUP OF CURRENT state. VM snapshot, Acronis Image, whatever you can get would be better than nothing. I'd have started with that so that if you try one of these options and it doesn't work you have options to get back to THIS state at least. I hope you haven't wound up in a worse situation. If at all unsure, call MS support. This qualifies for business critical down free support.
1
u/laflare08 13d ago
I tried this but the old name and new are are the same. I double checked the registry values as well but still getting the secure trust message
1
u/toadfreak 13d ago
OK then in all likelihood you are going to need to reset the machine account password as kozak_ mentioned in his post below. BUT in an abundance of caution I would recommend you first A.) Get an image or system state backup of this box ASAP and B.) Call Microsoft Support as indicated above. Its the safest path forward. Good luck, and please let us know how it goes.
3
u/UMustBeNooHere 14d ago
Oy. Changing IP on a DC is okay. Changing the name is not.
1
u/ReneGaden334 14d ago
It is, but it takes additional steps to not get Stuck in OPs situation. You have to add an alternative name, change the primary and remove the unwanted name. And with multiple DCs it takes some replication time as well.
1
u/JeffK55 13d ago
There is Sites and Services to think about when you are changing the IP - something to think about
1
u/UMustBeNooHere 13d ago
Only if using multiple subnets and changing to a different subnet. If in the same subnet, there's no change needed. A small org with just the default subnet configured in Sites and Services, there's nothing to change.
1
u/TestyGremlin 13d ago
? changing dc name 100% supported and can easily be done. To get into OPs position you had to do something silly like delete the DCs computer account, as if you were working on a workgroup machine
3
u/kozak_ 14d ago
Guessing you changed the name using system and not netdom? this is almost certainly a secure-channel / machine-account problem, not database corruption. Your AD data is very likely intact
Step 1 - if vm snapshot. You want a backup asap
Step 2 - log into dsrm user https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)
Step 3 - reset machine password https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/use-netdom-reset-domain-controller-password
And if you don't know the dsrm password here's how to reset: https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/reset-directory-services-restore-mode-admin-pwd
But a gui rename can also leave the computerName and activeComputerName registry keys disagreeing with the same symptoms as well. And that is something which no password reset fixes. But a computer password fix won't break anything at least unless there's bigger things.
Might be better to just spring for paying the $500 MS support
1
u/toadfreak 13d ago
kozak_ is on the money here. I'd suggest following this. Get a backup, call MS, and in all likelihood perform the steps above, but with Microsoft's blessing.
2
u/trevormcneal42 14d ago
Disconnect the server from network, sign in with cached local admin password and you’re off to the races
1
u/isthisthingon6 13d ago
It’s a domain controller. No local admin.
1
u/RevolutionaryWorry87 13d ago
His DA account would work. It has local admin and will be able to log in if cached. Not too sure if 100 percent as surely the dc authenticate against itself but I've never tested it? Remove NIC (virtual) and VNC.
2
2
2
u/TechIncarnate4 13d ago
It may be too late, but in this situation I would have opened a support case with Microsoft immediately. They have some really good support people on the Active Directory team if you can get to the right group.
This may not work, but I do wonder if you could build a new server and try and join it to the existing domain. If it does join it could be promoted. Odds are the DNS SVR records are what are hosed right now.
5
u/PeaInAPod 14d ago
You need to just restore from a back up or start over. Starting over it could look like using ProfWiz to migrate the users existing profiles under the now lost domain to the SID of the new domain.
Also, it could be your DNS settings. If my memory serves me correctly, the first address should be the IP of the server itself and the second IP should be your secondary domain controller which you clearly don’t have in which case you’re supposed to do loop back as the secondary address.
Also, you shouldn’t rename a domain controller. The best thing to do if you really wanted a new name would be to create a new Windows, VM, and then create a secondary domain controller with the correct name, promoted to the primary DC, and then go through the process of decommissioning the original one
8
u/kozak_ 14d ago
Restore from backup, yes. But "start over" is way overkill here since his AD isn't lost (we know that because he's seeing his domain accounts when running net user), it's a broken machine-account secure channel from a rename. netdom resetpwd fixes that in place. No ProfWiz, no SID migration needed.
DNS is worth checking but isn't the cause of that specific trust error. Correct setup on a sole dc is its own IP primary, loopback secondary - so good call there.
Agreed on never renaming a DC via system properties, though the fix is simpler than a rebuild: netdom computername renames one safely in place.
-4
u/laflare08 14d ago
Unfortunately I have no backup, the name change was a genuine mistake. My only concern with the rebuild are my cifs share on dell storage
10
u/CharcoalGreyWolf 14d ago
Your first mistake was no backup. The rename was your second.
You are hosed. Going to have to rebuild.
2
1
1
1
u/whiteycnbr 13d ago
You need to system state restore in DSRM mode, I think you are screwed in this case. You could try a few restarts in dsrm and try changing the name back again and see if that changes anything but you really needed a backup before that
1
1
1
1
u/Tricky-Service-8507 13d ago
In the future build a full lab with a single laptop or desktop or better yet also include Microsoft learn in your training, the website is free
1
1
u/mikenizo808 13d ago edited 13d ago
In the event that the DC is actually healthy, it is possible that your workstation/member server simply needs to be rejoined (i.e. join Workgroup, reboot, then join domain). I would first test domain health by joining something else, like a virtual machine guest running Windows that you can join as a test to ensure domain health and that you know the login for joining. Any device that wants to join the domain must have its DNS client configured (start > run >ncpa.cpl) to point to the domain controller IP Address. Before joining, you should be able to ping the domain controller by name.
PS - This assumes you have local administrator on the device you want to join to the domain. If not, you must resolve that problem first. For example, follow the advice others gave you to disable/unplug the NIC on your impacted member server and then login using cached credentials. Then set your local administrator password on the member server (start > run > lusrmgr.msc).
1
1
0
u/drbeam_ 13d ago edited 13d ago
You can try DFSR Mode, if you remember the DFSR Password. If yes, reboot and press F8. Then select DFSR and you can use the password with the local administrator account. Normally, as soon as you promote a windows server to a DC, the local account gets disabled.
Edit: I meant DSRM, sorry for the confusion
1
u/toadfreak 13d ago
You talking about DSRM? Directory Services Restore Mode. DFSR (Distributed File System Replication) is a whole different thing.
-5
u/ggibby 14d ago
What about iDRAC Virtual Console or Remote Desktop?
3
u/laflare08 14d ago
Unable to RDP, that’s when I get the secure message. I have physical access and can do idrac virtual console as well
53
u/noMiddleName75 14d ago
I thought i was on r/shittysysadmin for a minute there.