Full restore to Windows 2003 with Active Directory

Discussion in 'Microsoft Windows 2000 Active Directory' started by Maida Dunn, Feb 2, 2004.

  1. Maida Dunn

    Maida Dunn Guest

    I have Netbackup and did a full restore to my DC from a tape backup.
    Everything was restored including the System State. Now when I boot up I get
    the following message

    Lsass.exe System Error
    Directory Service could not start because of the following error. A
    transaction recover failed.

    I went into Directory service restore mode and ran the following

    ntdsutil
    files
    recover
    quit

    I'm still getting the same error. How can I fix this and what is the proper
    procedure for a restore.

    Thanks for all you help!!!!!
     
    Maida Dunn, Feb 2, 2004
    #1
    1. Advertisements

  2. What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    In ntdsutil in dsrestore mode go into files/info and verify that the path
    you see for ntds.dit, logs, etc matches up with the same path/s you see when
    you view those in the registry under
    hklm\system\ccs\services\ntds\parameters.
    Also verify that the ntds folder has at least admins and system with FC.

    --
    David Brandt
    Microsoft Corporation

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Please do not send e-mail directly to this alias. This alias is for
    newsgroup purposes only.
    "Maida Dunn" <> wrote in message
    news:...
    > I have Netbackup and did a full restore to my DC from a tape backup.
    > Everything was restored including the System State. Now when I boot up I

    get
    > the following message
    >
    > Lsass.exe System Error
    > Directory Service could not start because of the following error. A
    > transaction recover failed.
    >
    > I went into Directory service restore mode and ran the following
    >
    > ntdsutil
    > files
    > recover
    > quit
    >
    > I'm still getting the same error. How can I fix this and what is the

    proper
    > procedure for a restore.
    >
    > Thanks for all you help!!!!!
    >
    >
     
    David Brandt [MSFT], Feb 2, 2004
    #2
    1. Advertisements

  3. Maida Dunn

    Maida Dunn Guest

    Yes the error is 0xc0000227 and the path/s match.


    "David Brandt [MSFT]" <> wrote in message
    news:401e87cf$...
    > What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    > In ntdsutil in dsrestore mode go into files/info and verify that the path
    > you see for ntds.dit, logs, etc matches up with the same path/s you see

    when
    > you view those in the registry under
    > hklm\system\ccs\services\ntds\parameters.
    > Also verify that the ntds folder has at least admins and system with FC.
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:...
    > > I have Netbackup and did a full restore to my DC from a tape backup.
    > > Everything was restored including the System State. Now when I boot up I

    > get
    > > the following message
    > >
    > > Lsass.exe System Error
    > > Directory Service could not start because of the following error. A
    > > transaction recover failed.
    > >
    > > I went into Directory service restore mode and ran the following
    > >
    > > ntdsutil
    > > files
    > > recover
    > > quit
    > >
    > > I'm still getting the same error. How can I fix this and what is the

    > proper
    > > procedure for a restore.
    > >
    > > Thanks for all you help!!!!!
    > >
    > >

    >
    >
     
    Maida Dunn, Feb 2, 2004
    #3
  4. Maida Dunn

    Maida Dunn Guest

    The folder permissions our correct also. Thanks

    "David Brandt [MSFT]" <> wrote in message
    news:401e87cf$...
    > What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    > In ntdsutil in dsrestore mode go into files/info and verify that the path
    > you see for ntds.dit, logs, etc matches up with the same path/s you see

    when
    > you view those in the registry under
    > hklm\system\ccs\services\ntds\parameters.
    > Also verify that the ntds folder has at least admins and system with FC.
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:...
    > > I have Netbackup and did a full restore to my DC from a tape backup.
    > > Everything was restored including the System State. Now when I boot up I

    > get
    > > the following message
    > >
    > > Lsass.exe System Error
    > > Directory Service could not start because of the following error. A
    > > transaction recover failed.
    > >
    > > I went into Directory service restore mode and ran the following
    > >
    > > ntdsutil
    > > files
    > > recover
    > > quit
    > >
    > > I'm still getting the same error. How can I fix this and what is the

    > proper
    > > procedure for a restore.
    > >
    > > Thanks for all you help!!!!!
    > >
    > >

    >
    >
     
    Maida Dunn, Feb 2, 2004
    #4
  5. I don't know if this is an IBM box running Tivoli, but if so, then you may
    want to contact IBM. Aside from that, it appears that the ntds.dit may be
    corrupted. Bad backup, bad restore, etc but hard to tell at this point.
    You can run the "repair" in ntdsutil to see if that will get it going, but a
    lot of cases that I saw with this ended up with the dc either being
    reinstalled, or preferably, demoted and then re-promoted back to dc which
    appears to have resolved a lot of them. If it holds fsmo roles and will
    demote gracefull, good, but if not then they will need to be seized to
    another dc and then force demoted and a metadata cleanup done before
    re-introducing it back in. If the other dc is not already a gc, then it
    will need to be made one as well.

    255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    Controller
    http://support.microsoft.com/?id=255504

    216498 HOW TO: Remove Data in Active Directory After an Unsuccessful Domain
    http://support.microsoft.com/?id=216498

    332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion of
    Active
    http://support.microsoft.com/?id=332199

    --
    David Brandt
    Microsoft Corporation

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Please do not send e-mail directly to this alias. This alias is for
    newsgroup purposes only.
    "Maida Dunn" <> wrote in message
    news:uXvX%...
    > The folder permissions our correct also. Thanks
    >
    > "David Brandt [MSFT]" <> wrote in message
    > news:401e87cf$...
    > > What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    > > In ntdsutil in dsrestore mode go into files/info and verify that the

    path
    > > you see for ntds.dit, logs, etc matches up with the same path/s you see

    > when
    > > you view those in the registry under
    > > hklm\system\ccs\services\ntds\parameters.
    > > Also verify that the ntds folder has at least admins and system with FC.
    > >
    > > --
    > > David Brandt
    > > Microsoft Corporation
    > >
    > > This posting is provided "AS IS" with no warranties, and confers no

    > rights.
    > > Please do not send e-mail directly to this alias. This alias is for
    > > newsgroup purposes only.
    > > "Maida Dunn" <> wrote in message
    > > news:...
    > > > I have Netbackup and did a full restore to my DC from a tape backup.
    > > > Everything was restored including the System State. Now when I boot up

    I
    > > get
    > > > the following message
    > > >
    > > > Lsass.exe System Error
    > > > Directory Service could not start because of the following error. A
    > > > transaction recover failed.
    > > >
    > > > I went into Directory service restore mode and ran the following
    > > >
    > > > ntdsutil
    > > > files
    > > > recover
    > > > quit
    > > >
    > > > I'm still getting the same error. How can I fix this and what is the

    > > proper
    > > > procedure for a restore.
    > > >
    > > > Thanks for all you help!!!!!
    > > >
    > > >

    > >
    > >

    >
    >
     
    David Brandt [MSFT], Feb 2, 2004
    #5
  6. Maida Dunn

    Maida Dunn Guest

    It's a Dell box no Tivoli should a restore from a tape back using a third
    party call Veritas NetBackup DataCenter work. (Thanks for your help)
    "David Brandt [MSFT]" <> wrote in message
    news:401e9cbe$...
    > I don't know if this is an IBM box running Tivoli, but if so, then you may
    > want to contact IBM. Aside from that, it appears that the ntds.dit may be
    > corrupted. Bad backup, bad restore, etc but hard to tell at this point.
    > You can run the "repair" in ntdsutil to see if that will get it going, but

    a
    > lot of cases that I saw with this ended up with the dc either being
    > reinstalled, or preferably, demoted and then re-promoted back to dc which
    > appears to have resolved a lot of them. If it holds fsmo roles and will
    > demote gracefull, good, but if not then they will need to be seized to
    > another dc and then force demoted and a metadata cleanup done before
    > re-introducing it back in. If the other dc is not already a gc, then it
    > will need to be made one as well.
    >
    > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    > Controller
    > http://support.microsoft.com/?id=255504
    >
    > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful

    Domain
    > http://support.microsoft.com/?id=216498
    >
    > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion of
    > Active
    > http://support.microsoft.com/?id=332199
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:uXvX%...
    > > The folder permissions our correct also. Thanks
    > >
    > > "David Brandt [MSFT]" <> wrote in message
    > > news:401e87cf$...
    > > > What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    > > > In ntdsutil in dsrestore mode go into files/info and verify that the

    > path
    > > > you see for ntds.dit, logs, etc matches up with the same path/s you

    see
    > > when
    > > > you view those in the registry under
    > > > hklm\system\ccs\services\ntds\parameters.
    > > > Also verify that the ntds folder has at least admins and system with

    FC.
    > > >
    > > > --
    > > > David Brandt
    > > > Microsoft Corporation
    > > >
    > > > This posting is provided "AS IS" with no warranties, and confers no

    > > rights.
    > > > Please do not send e-mail directly to this alias. This alias is for
    > > > newsgroup purposes only.
    > > > "Maida Dunn" <> wrote in message
    > > > news:...
    > > > > I have Netbackup and did a full restore to my DC from a tape backup.
    > > > > Everything was restored including the System State. Now when I boot

    up
    > I
    > > > get
    > > > > the following message
    > > > >
    > > > > Lsass.exe System Error
    > > > > Directory Service could not start because of the following error. A
    > > > > transaction recover failed.
    > > > >
    > > > > I went into Directory service restore mode and ran the following
    > > > >
    > > > > ntdsutil
    > > > > files
    > > > > recover
    > > > > quit
    > > > >
    > > > > I'm still getting the same error. How can I fix this and what is the
    > > > proper
    > > > > procedure for a restore.
    > > > >
    > > > > Thanks for all you help!!!!!
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    Maida Dunn, Feb 2, 2004
    #6
  7. Maida Dunn

    Maida Dunn Guest

    One more thing please - the online help states you need:
    a.. To restore the System State data on a domain controller, you must first
    start your computer in Directory Services Restore Mode. This will allow you
    to restore the SYSVOL directory and the Active Directory.

    Then a full restore from Veritas Nebackup wouldn't work because it has to be
    connected to the network. Is this correct?

    Confused - sorry

    "David Brandt [MSFT]" <> wrote in message
    news:401e9cbe$...
    > I don't know if this is an IBM box running Tivoli, but if so, then you may
    > want to contact IBM. Aside from that, it appears that the ntds.dit may be
    > corrupted. Bad backup, bad restore, etc but hard to tell at this point.
    > You can run the "repair" in ntdsutil to see if that will get it going, but

    a
    > lot of cases that I saw with this ended up with the dc either being
    > reinstalled, or preferably, demoted and then re-promoted back to dc which
    > appears to have resolved a lot of them. If it holds fsmo roles and will
    > demote gracefull, good, but if not then they will need to be seized to
    > another dc and then force demoted and a metadata cleanup done before
    > re-introducing it back in. If the other dc is not already a gc, then it
    > will need to be made one as well.
    >
    > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    > Controller
    > http://support.microsoft.com/?id=255504
    >
    > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful

    Domain
    > http://support.microsoft.com/?id=216498
    >
    > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion of
    > Active
    > http://support.microsoft.com/?id=332199
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:uXvX%...
    > > The folder permissions our correct also. Thanks
    > >
    > > "David Brandt [MSFT]" <> wrote in message
    > > news:401e87cf$...
    > > > What error was associated with the lsass, was it 0xc0000227, 2E1, etc.
    > > > In ntdsutil in dsrestore mode go into files/info and verify that the

    > path
    > > > you see for ntds.dit, logs, etc matches up with the same path/s you

    see
    > > when
    > > > you view those in the registry under
    > > > hklm\system\ccs\services\ntds\parameters.
    > > > Also verify that the ntds folder has at least admins and system with

    FC.
    > > >
    > > > --
    > > > David Brandt
    > > > Microsoft Corporation
    > > >
    > > > This posting is provided "AS IS" with no warranties, and confers no

    > > rights.
    > > > Please do not send e-mail directly to this alias. This alias is for
    > > > newsgroup purposes only.
    > > > "Maida Dunn" <> wrote in message
    > > > news:...
    > > > > I have Netbackup and did a full restore to my DC from a tape backup.
    > > > > Everything was restored including the System State. Now when I boot

    up
    > I
    > > > get
    > > > > the following message
    > > > >
    > > > > Lsass.exe System Error
    > > > > Directory Service could not start because of the following error. A
    > > > > transaction recover failed.
    > > > >
    > > > > I went into Directory service restore mode and ran the following
    > > > >
    > > > > ntdsutil
    > > > > files
    > > > > recover
    > > > > quit
    > > > >
    > > > > I'm still getting the same error. How can I fix this and what is the
    > > > proper
    > > > > procedure for a restore.
    > > > >
    > > > > Thanks for all you help!!!!!
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    Maida Dunn, Feb 2, 2004
    #7
  8. You do Have to be in ds restore mode to restore the system state. If
    veritas nees to be on the box in order to do the restore, then you may need
    to install it on that machine while in safe/ds restoer mode.

    --
    David Brandt
    Microsoft Corporation

    This posting is provided "AS IS" with no warranties, and confers no rights.
    Please do not send e-mail directly to this alias. This alias is for
    newsgroup purposes only.
    "Maida Dunn" <> wrote in message
    news:...
    > One more thing please - the online help states you need:
    > a.. To restore the System State data on a domain controller, you must

    first
    > start your computer in Directory Services Restore Mode. This will allow

    you
    > to restore the SYSVOL directory and the Active Directory.
    >
    > Then a full restore from Veritas Nebackup wouldn't work because it has to

    be
    > connected to the network. Is this correct?
    >
    > Confused - sorry
    >
    > "David Brandt [MSFT]" <> wrote in message
    > news:401e9cbe$...
    > > I don't know if this is an IBM box running Tivoli, but if so, then you

    may
    > > want to contact IBM. Aside from that, it appears that the ntds.dit may

    be
    > > corrupted. Bad backup, bad restore, etc but hard to tell at this point.
    > > You can run the "repair" in ntdsutil to see if that will get it going,

    but
    > a
    > > lot of cases that I saw with this ended up with the dc either being
    > > reinstalled, or preferably, demoted and then re-promoted back to dc

    which
    > > appears to have resolved a lot of them. If it holds fsmo roles and will
    > > demote gracefull, good, but if not then they will need to be seized to
    > > another dc and then force demoted and a metadata cleanup done before
    > > re-introducing it back in. If the other dc is not already a gc, then it
    > > will need to be made one as well.
    > >
    > > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    > > Controller
    > > http://support.microsoft.com/?id=255504
    > >
    > > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful

    > Domain
    > > http://support.microsoft.com/?id=216498
    > >
    > > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion of
    > > Active
    > > http://support.microsoft.com/?id=332199
    > >
    > > --
    > > David Brandt
    > > Microsoft Corporation
    > >
    > > This posting is provided "AS IS" with no warranties, and confers no

    > rights.
    > > Please do not send e-mail directly to this alias. This alias is for
    > > newsgroup purposes only.
    > > "Maida Dunn" <> wrote in message
    > > news:uXvX%...
    > > > The folder permissions our correct also. Thanks
    > > >
    > > > "David Brandt [MSFT]" <> wrote in message
    > > > news:401e87cf$...
    > > > > What error was associated with the lsass, was it 0xc0000227, 2E1,

    etc.
    > > > > In ntdsutil in dsrestore mode go into files/info and verify that the

    > > path
    > > > > you see for ntds.dit, logs, etc matches up with the same path/s you

    > see
    > > > when
    > > > > you view those in the registry under
    > > > > hklm\system\ccs\services\ntds\parameters.
    > > > > Also verify that the ntds folder has at least admins and system with

    > FC.
    > > > >
    > > > > --
    > > > > David Brandt
    > > > > Microsoft Corporation
    > > > >
    > > > > This posting is provided "AS IS" with no warranties, and confers no
    > > > rights.
    > > > > Please do not send e-mail directly to this alias. This alias is for
    > > > > newsgroup purposes only.
    > > > > "Maida Dunn" <> wrote in message
    > > > > news:...
    > > > > > I have Netbackup and did a full restore to my DC from a tape

    backup.
    > > > > > Everything was restored including the System State. Now when I

    boot
    > up
    > > I
    > > > > get
    > > > > > the following message
    > > > > >
    > > > > > Lsass.exe System Error
    > > > > > Directory Service could not start because of the following error.

    A
    > > > > > transaction recover failed.
    > > > > >
    > > > > > I went into Directory service restore mode and ran the following
    > > > > >
    > > > > > ntdsutil
    > > > > > files
    > > > > > recover
    > > > > > quit
    > > > > >
    > > > > > I'm still getting the same error. How can I fix this and what is

    the
    > > > > proper
    > > > > > procedure for a restore.
    > > > > >
    > > > > > Thanks for all you help!!!!!
    > > > > >
    > > > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    David Brandt [MSFT], Feb 2, 2004
    #8
  9. Maida Dunn

    Maida Dunn Guest

    Hi David,
    If you unable to bring the machine up what would be the correct recovery
    process?
    The DC has Active Directory, WINS, DHCP and DNS
    My NT 4.0 restore was pretty easy. re-installed NT4.0 installed Netbackup
    and did a full restore.



    "David Brandt [MSFT]" <> wrote in message
    news:401ebf74$...
    > You do Have to be in ds restore mode to restore the system state. If
    > veritas nees to be on the box in order to do the restore, then you may

    need
    > to install it on that machine while in safe/ds restoer mode.
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:...
    > > One more thing please - the online help states you need:
    > > a.. To restore the System State data on a domain controller, you must

    > first
    > > start your computer in Directory Services Restore Mode. This will allow

    > you
    > > to restore the SYSVOL directory and the Active Directory.
    > >
    > > Then a full restore from Veritas Nebackup wouldn't work because it has

    to
    > be
    > > connected to the network. Is this correct?
    > >
    > > Confused - sorry
    > >
    > > "David Brandt [MSFT]" <> wrote in message
    > > news:401e9cbe$...
    > > > I don't know if this is an IBM box running Tivoli, but if so, then you

    > may
    > > > want to contact IBM. Aside from that, it appears that the ntds.dit

    may
    > be
    > > > corrupted. Bad backup, bad restore, etc but hard to tell at this

    point.
    > > > You can run the "repair" in ntdsutil to see if that will get it going,

    > but
    > > a
    > > > lot of cases that I saw with this ended up with the dc either being
    > > > reinstalled, or preferably, demoted and then re-promoted back to dc

    > which
    > > > appears to have resolved a lot of them. If it holds fsmo roles and

    will
    > > > demote gracefull, good, but if not then they will need to be seized to
    > > > another dc and then force demoted and a metadata cleanup done before
    > > > re-introducing it back in. If the other dc is not already a gc, then

    it
    > > > will need to be made one as well.
    > > >
    > > > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    > > > Controller
    > > > http://support.microsoft.com/?id=255504
    > > >
    > > > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful

    > > Domain
    > > > http://support.microsoft.com/?id=216498
    > > >
    > > > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion

    of
    > > > Active
    > > > http://support.microsoft.com/?id=332199
    > > >
    > > > --
    > > > David Brandt
    > > > Microsoft Corporation
    > > >
    > > > This posting is provided "AS IS" with no warranties, and confers no

    > > rights.
    > > > Please do not send e-mail directly to this alias. This alias is for
    > > > newsgroup purposes only.
    > > > "Maida Dunn" <> wrote in message
    > > > news:uXvX%...
    > > > > The folder permissions our correct also. Thanks
    > > > >
    > > > > "David Brandt [MSFT]" <> wrote in message
    > > > > news:401e87cf$...
    > > > > > What error was associated with the lsass, was it 0xc0000227, 2E1,

    > etc.
    > > > > > In ntdsutil in dsrestore mode go into files/info and verify that

    the
    > > > path
    > > > > > you see for ntds.dit, logs, etc matches up with the same path/s

    you
    > > see
    > > > > when
    > > > > > you view those in the registry under
    > > > > > hklm\system\ccs\services\ntds\parameters.
    > > > > > Also verify that the ntds folder has at least admins and system

    with
    > > FC.
    > > > > >
    > > > > > --
    > > > > > David Brandt
    > > > > > Microsoft Corporation
    > > > > >
    > > > > > This posting is provided "AS IS" with no warranties, and confers

    no
    > > > > rights.
    > > > > > Please do not send e-mail directly to this alias. This alias is

    for
    > > > > > newsgroup purposes only.
    > > > > > "Maida Dunn" <> wrote in message
    > > > > > news:...
    > > > > > > I have Netbackup and did a full restore to my DC from a tape

    > backup.
    > > > > > > Everything was restored including the System State. Now when I

    > boot
    > > up
    > > > I
    > > > > > get
    > > > > > > the following message
    > > > > > >
    > > > > > > Lsass.exe System Error
    > > > > > > Directory Service could not start because of the following

    error.
    > A
    > > > > > > transaction recover failed.
    > > > > > >
    > > > > > > I went into Directory service restore mode and ran the following
    > > > > > >
    > > > > > > ntdsutil
    > > > > > > files
    > > > > > > recover
    > > > > > > quit
    > > > > > >
    > > > > > > I'm still getting the same error. How can I fix this and what is

    > the
    > > > > > proper
    > > > > > > procedure for a restore.
    > > > > > >
    > > > > > > Thanks for all you help!!!!!
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    Maida Dunn, Feb 3, 2004
    #9
  10. Maida Dunn

    Maida Dunn Guest

    One more question:
    If I have AD installed should I install it on another machine to act as a
    backup AD?
    I've been reading how to uninstall AD but you'll loose all your information
    correct?

    Thanks again!

    "David Brandt [MSFT]" <> wrote in message
    news:401ebf74$...
    > You do Have to be in ds restore mode to restore the system state. If
    > veritas nees to be on the box in order to do the restore, then you may

    need
    > to install it on that machine while in safe/ds restoer mode.
    >
    > --
    > David Brandt
    > Microsoft Corporation
    >
    > This posting is provided "AS IS" with no warranties, and confers no

    rights.
    > Please do not send e-mail directly to this alias. This alias is for
    > newsgroup purposes only.
    > "Maida Dunn" <> wrote in message
    > news:...
    > > One more thing please - the online help states you need:
    > > a.. To restore the System State data on a domain controller, you must

    > first
    > > start your computer in Directory Services Restore Mode. This will allow

    > you
    > > to restore the SYSVOL directory and the Active Directory.
    > >
    > > Then a full restore from Veritas Nebackup wouldn't work because it has

    to
    > be
    > > connected to the network. Is this correct?
    > >
    > > Confused - sorry
    > >
    > > "David Brandt [MSFT]" <> wrote in message
    > > news:401e9cbe$...
    > > > I don't know if this is an IBM box running Tivoli, but if so, then you

    > may
    > > > want to contact IBM. Aside from that, it appears that the ntds.dit

    may
    > be
    > > > corrupted. Bad backup, bad restore, etc but hard to tell at this

    point.
    > > > You can run the "repair" in ntdsutil to see if that will get it going,

    > but
    > > a
    > > > lot of cases that I saw with this ended up with the dc either being
    > > > reinstalled, or preferably, demoted and then re-promoted back to dc

    > which
    > > > appears to have resolved a lot of them. If it holds fsmo roles and

    will
    > > > demote gracefull, good, but if not then they will need to be seized to
    > > > another dc and then force demoted and a metadata cleanup done before
    > > > re-introducing it back in. If the other dc is not already a gc, then

    it
    > > > will need to be made one as well.
    > > >
    > > > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a Domain
    > > > Controller
    > > > http://support.microsoft.com/?id=255504
    > > >
    > > > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful

    > > Domain
    > > > http://support.microsoft.com/?id=216498
    > > >
    > > > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion

    of
    > > > Active
    > > > http://support.microsoft.com/?id=332199
    > > >
    > > > --
    > > > David Brandt
    > > > Microsoft Corporation
    > > >
    > > > This posting is provided "AS IS" with no warranties, and confers no

    > > rights.
    > > > Please do not send e-mail directly to this alias. This alias is for
    > > > newsgroup purposes only.
    > > > "Maida Dunn" <> wrote in message
    > > > news:uXvX%...
    > > > > The folder permissions our correct also. Thanks
    > > > >
    > > > > "David Brandt [MSFT]" <> wrote in message
    > > > > news:401e87cf$...
    > > > > > What error was associated with the lsass, was it 0xc0000227, 2E1,

    > etc.
    > > > > > In ntdsutil in dsrestore mode go into files/info and verify that

    the
    > > > path
    > > > > > you see for ntds.dit, logs, etc matches up with the same path/s

    you
    > > see
    > > > > when
    > > > > > you view those in the registry under
    > > > > > hklm\system\ccs\services\ntds\parameters.
    > > > > > Also verify that the ntds folder has at least admins and system

    with
    > > FC.
    > > > > >
    > > > > > --
    > > > > > David Brandt
    > > > > > Microsoft Corporation
    > > > > >
    > > > > > This posting is provided "AS IS" with no warranties, and confers

    no
    > > > > rights.
    > > > > > Please do not send e-mail directly to this alias. This alias is

    for
    > > > > > newsgroup purposes only.
    > > > > > "Maida Dunn" <> wrote in message
    > > > > > news:...
    > > > > > > I have Netbackup and did a full restore to my DC from a tape

    > backup.
    > > > > > > Everything was restored including the System State. Now when I

    > boot
    > > up
    > > > I
    > > > > > get
    > > > > > > the following message
    > > > > > >
    > > > > > > Lsass.exe System Error
    > > > > > > Directory Service could not start because of the following

    error.
    > A
    > > > > > > transaction recover failed.
    > > > > > >
    > > > > > > I went into Directory service restore mode and ran the following
    > > > > > >
    > > > > > > ntdsutil
    > > > > > > files
    > > > > > > recover
    > > > > > > quit
    > > > > > >
    > > > > > > I'm still getting the same error. How can I fix this and what is

    > the
    > > > > > proper
    > > > > > > procedure for a restore.
    > > > > > >
    > > > > > > Thanks for all you help!!!!!
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    Maida Dunn, Feb 3, 2004
    #10
  11. Its always a good idea to have at least 2 Domain Controllers just for this
    purpose and failover.

    tx

    --
    Jeromy Statia [MSFT]

    This posting is provided "AS IS" with no warranties, and confers no rights.


    "Maida Dunn" <> wrote in message
    news:#...
    > One more question:
    > If I have AD installed should I install it on another machine to act as a
    > backup AD?
    > I've been reading how to uninstall AD but you'll loose all your

    information
    > correct?
    >
    > Thanks again!
    >
    > "David Brandt [MSFT]" <> wrote in message
    > news:401ebf74$...
    > > You do Have to be in ds restore mode to restore the system state. If
    > > veritas nees to be on the box in order to do the restore, then you may

    > need
    > > to install it on that machine while in safe/ds restoer mode.
    > >
    > > --
    > > David Brandt
    > > Microsoft Corporation
    > >
    > > This posting is provided "AS IS" with no warranties, and confers no

    > rights.
    > > Please do not send e-mail directly to this alias. This alias is for
    > > newsgroup purposes only.
    > > "Maida Dunn" <> wrote in message
    > > news:...
    > > > One more thing please - the online help states you need:
    > > > a.. To restore the System State data on a domain controller, you must

    > > first
    > > > start your computer in Directory Services Restore Mode. This will

    allow
    > > you
    > > > to restore the SYSVOL directory and the Active Directory.
    > > >
    > > > Then a full restore from Veritas Nebackup wouldn't work because it has

    > to
    > > be
    > > > connected to the network. Is this correct?
    > > >
    > > > Confused - sorry
    > > >
    > > > "David Brandt [MSFT]" <> wrote in message
    > > > news:401e9cbe$...
    > > > > I don't know if this is an IBM box running Tivoli, but if so, then

    you
    > > may
    > > > > want to contact IBM. Aside from that, it appears that the ntds.dit

    > may
    > > be
    > > > > corrupted. Bad backup, bad restore, etc but hard to tell at this

    > point.
    > > > > You can run the "repair" in ntdsutil to see if that will get it

    going,
    > > but
    > > > a
    > > > > lot of cases that I saw with this ended up with the dc either being
    > > > > reinstalled, or preferably, demoted and then re-promoted back to dc

    > > which
    > > > > appears to have resolved a lot of them. If it holds fsmo roles and

    > will
    > > > > demote gracefull, good, but if not then they will need to be seized

    to
    > > > > another dc and then force demoted and a metadata cleanup done before
    > > > > re-introducing it back in. If the other dc is not already a gc,

    then
    > it
    > > > > will need to be made one as well.
    > > > >
    > > > > 255504 Using Ntdsutil.exe to Seize or Transfer FSMO Roles to a

    Domain
    > > > > Controller
    > > > > http://support.microsoft.com/?id=255504
    > > > >
    > > > > 216498 HOW TO: Remove Data in Active Directory After an Unsuccessful
    > > > Domain
    > > > > http://support.microsoft.com/?id=216498
    > > > >
    > > > > 332199 Using the DCPROMO /FORCEREMOVAL Command to Force the Demotion

    > of
    > > > > Active
    > > > > http://support.microsoft.com/?id=332199
    > > > >
    > > > > --
    > > > > David Brandt
    > > > > Microsoft Corporation
    > > > >
    > > > > This posting is provided "AS IS" with no warranties, and confers no
    > > > rights.
    > > > > Please do not send e-mail directly to this alias. This alias is for
    > > > > newsgroup purposes only.
    > > > > "Maida Dunn" <> wrote in message
    > > > > news:uXvX%...
    > > > > > The folder permissions our correct also. Thanks
    > > > > >
    > > > > > "David Brandt [MSFT]" <> wrote in message
    > > > > > news:401e87cf$...
    > > > > > > What error was associated with the lsass, was it 0xc0000227,

    2E1,
    > > etc.
    > > > > > > In ntdsutil in dsrestore mode go into files/info and verify that

    > the
    > > > > path
    > > > > > > you see for ntds.dit, logs, etc matches up with the same path/s

    > you
    > > > see
    > > > > > when
    > > > > > > you view those in the registry under
    > > > > > > hklm\system\ccs\services\ntds\parameters.
    > > > > > > Also verify that the ntds folder has at least admins and system

    > with
    > > > FC.
    > > > > > >
    > > > > > > --
    > > > > > > David Brandt
    > > > > > > Microsoft Corporation
    > > > > > >
    > > > > > > This posting is provided "AS IS" with no warranties, and confers

    > no
    > > > > > rights.
    > > > > > > Please do not send e-mail directly to this alias. This alias is

    > for
    > > > > > > newsgroup purposes only.
    > > > > > > "Maida Dunn" <> wrote in message
    > > > > > > news:...
    > > > > > > > I have Netbackup and did a full restore to my DC from a tape

    > > backup.
    > > > > > > > Everything was restored including the System State. Now when I

    > > boot
    > > > up
    > > > > I
    > > > > > > get
    > > > > > > > the following message
    > > > > > > >
    > > > > > > > Lsass.exe System Error
    > > > > > > > Directory Service could not start because of the following

    > error.
    > > A
    > > > > > > > transaction recover failed.
    > > > > > > >
    > > > > > > > I went into Directory service restore mode and ran the

    following
    > > > > > > >
    > > > > > > > ntdsutil
    > > > > > > > files
    > > > > > > > recover
    > > > > > > > quit
    > > > > > > >
    > > > > > > > I'm still getting the same error. How can I fix this and what

    is
    > > the
    > > > > > > proper
    > > > > > > > procedure for a restore.
    > > > > > > >
    > > > > > > > Thanks for all you help!!!!!
    > > > > > > >
    > > > > > > >
    > > > > > >
    > > > > > >
    > > > > >
    > > > > >
    > > > >
    > > > >
    > > >
    > > >

    > >
    > >

    >
    >
     
    Jeromy Statia [MSFT], Feb 3, 2004
    #11
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Dani

    compatibility between W2K Active Directory and W2k3 Active Directory

    Dani, Sep 15, 2003, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    1
    Views:
    672
    Matjaz Ladava [MVP]
    Sep 15, 2003
  2. Guest

    Arguments for 2003 Active directory versus 2000 active directory?

    Guest, Dec 19, 2003, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    4
    Views:
    846
    Jimmy Harper [MSFT]
    Dec 23, 2003
  3. Mas Libman [MSFT]

    Active Directory, Active Directory Federation Services and Microsoft Integration Identiy Server

    Mas Libman [MSFT], May 6, 2005, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    0
    Views:
    1,403
    Mas Libman [MSFT]
    May 6, 2005
  4. Gary M

    question on upgrading from active directory 2000 to active directory 2003

    Gary M, Feb 28, 2007, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    2
    Views:
    578
    Jorge de Almeida Pinto [MVP - DS]
    Mar 16, 2007
  5. RajKiran

    How important is Active Directory ? Cant we get rid of Active Directory ?

    RajKiran, Aug 10, 2007, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    1
    Views:
    1,379
Loading...

Share This Page