Issue with domain controller

Felix · 17 Feb 2010 at 16:49

I am currently installing a new domain controller to replace an older server. On the last step of changing the name of the 2 servers the new one has some how changed its name on the server but not updated it in active directory.

I now can't change it back to the original name as it says the account doesn't exist nor can I do a dcpromo to demote it, remove it from the domain and then add it back on this time hopefully correctly changing its account name in active directory. The promote it again.

There are no FSMO roles on this server, only a global cat.

Any ideas?

paradigm · 17 Feb 2010 at 16:52

Can you detail the EXACT course of actions, including names (even if fake names, just to make for easier reading), that got you into this mess?

Hard to work out a solution without knowing the problem in its entirety.

Django x2 · 17 Feb 2010 at 17:02

Did you join it to the domain before changing its name?

Felix · 17 Feb 2010 at 18:13

Sorry for the lack of detail.

The old domain controller is 2003 DC3 - domain schema and forest schema both updated to version 47. I bring a new 2008 server online with the name DC-3, I promote it, they run side by side for a week. On Monday I demoted the old server.

Today I change the ip address of the old server DC3 to a spare ip, I reboot. I change the name to OLDDC3 reboot again. All fine.

On the new server DC-3 I change the IP address to the old servers and rebooted. I then tried to change the name, however it says the name already exists. I click ok and try again. Same thing. I reboot the new server log in to try again and the name has changed. I check AD but it hasn't in the list of domain controllers.

Sin_Chase · 17 Feb 2010 at 18:46

Did you reset and/or delete the DC3 computer account before trying to call the new 2008 box that?

Felix · 17 Feb 2010 at 18:49

No, because after the rename on DC3 the account was changed to OLDDC3.

iaind · 17 Feb 2010 at 19:19

Try a search of AD to make sure it's not hiding in an OU somewhere

Felix · 17 Feb 2010 at 19:40

Yup tried that.

iaind · 17 Feb 2010 at 20:24

DNS record maybe?

Out of interest, why does it need to have the same name?

Felix · 17 Feb 2010 at 20:29

I'll double check but surely with AD integrated DNS the record will have had its name change too.

Regarding the same name, there are various services and 3rd party devices that authenticate using the server and they have the DNS name rather than the IP address.

Little_Crow · 17 Feb 2010 at 20:33

Not necessarily, just because you've changed the Name or IP doesn't mean that the old one has been removed from DNS.

iaind · 17 Feb 2010 at 20:38

You could always set up a DNS alias...never done it with a DC before though

Little_Crow · 17 Feb 2010 at 20:40

Just another potential option, I've not done it on a 2008 DC, but did you do an 'ipconfig /registerdns' and 'dcdiag /fix' afterwards?

That's the procedure from MS when changing the IP of a DC for 2003, I did it recently and the old IP got left in DNS which is the source of my previous post.

Django x2 · 18 Feb 2010 at 00:10

Sounds like DNS is holding something to me. Check through ADSI Edit too for the old domain controller. To resolve, I'd bring up a VM DC, move all the FSMO roles to that, ensure AD and DNS are set up correctly and then start again.

Felix · 18 Feb 2010 at 08:05

Like I said, there are no FSMO roles on the DC, no DNS, it is just a domain controller with a global cat on it. There are 2 other domain controllers in that domain and they already have the FSMO roles. This DC is purely for redundancy and authentication for various devices and services.

Felix · 18 Feb 2010 at 10:42

I think my only choice is to remove the DC from AD manually following these instructions http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Anyone attempted this before?

Thanks for the help btw.

Django x2 · 18 Feb 2010 at 12:04

Put it this way. If its come from Daniel Petri, it's going to work

mrbios · 18 Feb 2010 at 12:05

Did you give the new server long enough to see and replicate the change in name of the old server? If you switch the two over too quickly with multiple DCs it probably wouldn't be too happy

Felix · 18 Feb 2010 at 12:31

I think that is what has happened, the new DC has been on for over a week but I think the demotion and then the name/ip changes have been too quick.

I'll get the new server reinstalled and just avoid the name change and find what devices and services are affected.

Thanks