Original DC is down, now group policy doesn't work

[silverspecv]

I had a single DC on the lan, so I added a second one, and then eventually the first one's hard drive crashed, so it is completely down, unrecoverable. I thought everything would be fine on the secondary controller, but my group policies don't work. I can add users and manage their passwords via the new DC, so it is at least semi-functional. There are other glitches that let me know something is wrong, such as adding new users, and I get a message saying that it can't confirm if the new user is unique, etc.. but those are minor annoyances.. The current REAL problem is that my terminal server now allows and joe user to turn off the server via shutdown!! When I try to edit the group policy of an OU, it says "the domain controller for group policy operations is unavailable".. I have file/print sharing turned on and the whatchacallit helper service running. The DC's DNS was not pointed to itself, so I did that, but it didn't help. I ran netdiag /fix and dcdiag /fix, that didn't work either.. I have to think it is still trying to authenticate something with the old crashed server, but I can't tell what. Any ideas? Can I post up some more info that would help?

 

[buddafish]

had you moved any of the FSMO roles over to the 2nd sever after you dcpromo'd it? if not, you will need to seize all 5 of those roles. also, if server #2 was not a global catalog, make it one. this will get your domain closer to it's original state. then you can trouble-shoot the gp issue. a re-boot will probably be necessary after seizing the roles. ntdsutil.exe will be your friend for this process.

check out this link:

http://support.microsoft.com/kb/255504

scottie

 

[silverspecv]

Thanks, buddafish.. you're right, the answer is definitely in there somewhere. I hadn't done anything with fsmo roles yet. I used ntdsutil with somewhat ambiguous results. I tried seizing each of the roles repeatedly. Some of them seemed to seize while others failed, but I'm not sure. Anyway, I rebooted afterward, and now I don't get that error message when I try to edit group policies, but the policy does not seem to be in effect on the terminal server that the gpo applies to. I did a force refresh on it and tried again a few minutes later, and the security was still wide open.. I'll wait a little longer and try again. If it still doesn't work, I'll start over the dcdiag, netdiag, and ntdsutil and post the "errors" if they are indeed errors.. they're sorta cryptic

Oh yeah, does the terminal server have to be configured to use the dc as its primary dns server?