Incorrectly replaced DC

[gousers]

The company's Network consists of 2 servers, one DC and a
SQL server. Their programmer decided to replace thier DC
with a newer server. Programmer installed os and added
the new server to the domain so he could copy files over.
Next ran dcpromo. Once AD was installed shut down former
DC and changed the IP on the new DC to the old DC's IP
address and rebooted new DC.

I don't know how AD was installed on new DC, I guessing
2nd domain controller in existing domain.

Next day, the business had no network. Users could not
login, couldn't even use DNS to surf internet.

Company asked if I would help them out. Looking over
their setup didn't reveal to much, so I thought to try
and move AD to the SQL server by adding it as a 2nd
domain controller to existing domain. When I went to
authorize the SQL as a DHCP server the authorization
console still showed the original DC. The console showed
three servers the oringinal DC still with it's original
IP address, the new DC with it's old IP address that it
was assigned when first installed, and the sql server
with it's correct ip address.

I'm thinking I can fix them with ntdsutil.exe, but am
having trouble getting it to list servers. I can connect
to the domaim and the current DC and Sql server but I can
not get an active site. I'm trying to get the list
servers in site option to work. I've been reading about
ntdsutil.exe in the kb but I'm not figuring it out.

Is ntdsutil.exe the right tool?
Can someone tell how to use the tool?

The business is back up, but their network is very flaky.
Their drive connections keep going offline. Permissions
don't take effect. I can give an account full access to a
drive, folder or file and when they attempt to access the
resource they get denied access. I can give access to
another resource and the access it with no errors.

I've thought about using dcpromo to remove AD completly
and the reinstall AD, but would really like to figure out
how to fix it. Rather not throw in the towell

Thanks.

 

[Charles McMillan]

It looks like the initial problem was that the initial DC,
the first one created, had all of the FSMO roles.
Creating a second DC does not automatically transfer or
load balance any the five roles. When the first DC was
taken offline there were no FSMO roles master to handle
any of the functions. With no Infrastructure master AD
cannot check for group membership and will not let anyone
log on.

If the original DC is still around bring it back online
and then transfer all of the FSMO roles to the second DC.
I would also have another DC and make it a Global Catalog
server so that users can log on in the event that the
Infrastructure master is down for maintenance.

After the FSMO roles are transfered you can run DCPROMO on
the first DC to demote it down and then remove the
object. You could also use NTDSutil in METADATA Cleanup
mode to remove it from AD. There is an excellent MS
article on the subject. I have used it many times in my
network to removed DCs that will not boot so that I can
run DCPROMO to demote them.

Demoting a DC is preferable to cleaning out AD but
sometimes you have not choice. My situation is very unique
in that I have a distributed network, all over the world
and many admins who have not had the benefit of MS
training.