Ghosted a RAID5 cannot log-on

[Adysthemic]

Group,
I used Ghost Enterprise 7.5 to ghost my hardware raid 5
setup.The image was taken with no problems.I can walk around in it with
Ghostwalker.Here's the problem,although the image seems to restore
perfectly,Win2k server boots up just like it should.But
it will not let me log on.Ctrl Alt Del comes up fine.I type
in name and password (domain admin) and it looks like
it's going to work,and up pops Ctrl Alt Del again.Cannot
log on to domain or local box.I have an account on both the local machine
and the domain.Any ideas,opinions?
Adythemic

 

[Adysthemic]

boot a win98 flop and run fdisk/mbr ... does work often but not always ...


Joep

--
D I Y D a t a R e c o v e r y . N L - Data & Disaster Recovery Tools

http://www.diydatarecovery.nl
http://www.diydatarecovery.com

Please include previous correspondence!

DiskPatch - MBR, Partition, boot sector repair and recovery.
iRecover - FAT, FAT32 and NTFS data recovery.
MBRtool - Freeware MBR backup and restore.

Thanks Jeop I'll give that a try.However it does in fact boot,all the way up
to the logon,Adysthemic

 

[Edward J. Neth]

A few questions:

What happened to the original machine (the one that was used to generate the
clone image)?
If it is still on the network, you will have problems -- you have two
servers with identical security identifiers (SIDs), which is not a supported
configuration.

Did you run sysprep before and change the identity of the machine after you
ghosted it?

If you cannot log into the machine locally, you likely have a damaged
security accounts manager (SAM) -- if you cannot log into the domain, you
likely also have a SID problem.

What functions were this server performing (was it the active directory
server you were trying to clone)?

 

[Joep]

Hello,

I had the same thing happen with DriveImage and it is a solution from the MS
KB. For me it walys worked, but from others I occasionally hear it doesn't.

 

[J.Clarke]

It was just a test.A member server.I ghosted the box,removed it's good
array.Put three new drives in,built the set to be raid 5 in the
adaptec util.Restored the image,doing nothing to it.
Went just fine it seemed.Unplugged the network cables
just in case it would have some effect on the DC.Booted
up everything OK tried to log on locally,appeared to take,
then the Ctrl Alt Del popped up again.No error message.In frustration
I hooked it back to the network and tried to log on to the domain.Same
thing.Put the original set of drives back in and all is well.Perhaps I
should have tried a rebuild in the adaptec util just for kicks
but I wanted to make darn sure that the orignal set still worked,in
case I did something to the hardware settings or something.This server
has to be back on line Monday
4am.So next week I'll try again and look around the net for a possible
cause.Anyone tried that PQ V2i?Better than ghost?Raid5
compat?,Adythemic

Have you followed the procedures at

 

[Adysthemic]

A few questions:

What happened to the original machine (the one that was used to generate the
clone image)?
If it is still on the network, you will have problems -- you have two
servers with identical security identifiers (SIDs), which is not a supported
configuration.

Did you run sysprep before and change the identity of the machine after you
ghosted it?

If you cannot log into the machine locally, you likely have a damaged
security accounts manager (SAM) -- if you cannot log into the domain, you
likely also have a SID problem.

What functions were this server performing (was it the active directory
server you were trying to clone)?

It was just a test.A member server.I ghosted the box,removed it's good
array.Put three new drives in,built the set to be raid 5 in the adaptec
util.Restored the image,doing nothing to it.
Went just fine it seemed.Unplugged the network cables
just in case it would have some effect on the DC.Booted
up everything OK tried to log on locally,appeared to take,
then the Ctrl Alt Del popped up again.No error message.In frustration I
hooked it back to the network and tried to log on to the domain.Same
thing.Put the original set of drives back in and all is well.Perhaps I
should have tried a rebuild in the adaptec util just for kicks
but I wanted to make darn sure that the orignal set still worked,in case I
did something to the hardware settings or something.This server has to be
back on line Monday
4am.So next week I'll try again and look around the net for a possible
cause.Anyone tried that PQ V2i?Better than ghost?Raid5 compat?,Adythemic

 

[J.Clarke]

Snipped>
John
No. It is the same hardware.Adysthemic

I thought you said you put 3 new drives in. That's not the same
hardware.

 

[J.Clarke]

John,
Sure it is.Exactly the same,make model etc.I believe MS is talking
about a restore to a machine that has a different video
card,Motherboard,network card etc.The exact same make and model of
hard drive is not different hardware as I see it,just
mho,though.Thanks for looking into it,I need all the help I can find
on this.It would increase my confidence by leaps and bounds to know I
could restore an image if I screw up.I'm going to try again next
weekend,I'll post the results.The only thing I can think of is
rebuilding the array after the restore.If you find anything else I'd
sure appreciate the pointer,Adysthemic

Can't find it now, but Microsoft does have an article in the
knowledgebase somewhere that discusses the effects of moving a Windows
installation to a drive with a different serial number. There is a
security consequence and there is a corrective action--I got bitten by
this one a while back. Trouble is I didn't note the article number
anywhere.

 

[Adysthemic]

I thought you said you put 3 new drives in. That's not the same
hardware.

John,
Sure it is.Exactly the same,make model etc.I believe MS is talking about a
restore to a machine that has a different video card,Motherboard,network
card etc.The exact same make and model of hard drive is not different
hardware as I see it,just mho,though.Thanks for looking into it,I need all
the help I can find on this.It would increase my confidence by leaps and
bounds to know I could restore an image if I screw up.I'm going to try again
next weekend,I'll post the results.The only thing I can think of is
rebuilding the array after the restore.If you find anything else I'd sure
appreciate the pointer,Adysthemic

 

[J.Clarke]

I'll look through the KB.That sure would explain this behaviour.I have
though,ghosted and restored many win2k pro machines,and restored to
bigger hard drives of many different brands with no problem.Never
tried ghosting and restoring a server though.Adythemic

It's specific to server and has something to do with the way Active
Directory was implemented. There's a second security key in addition to
the SID, and that key is IIRC tied to the disk serial number, but I
can't remember what it's called--if I could then finding the article
would be easy.

 

[Adysthemic]

Can't find it now, but Microsoft does have an article in the
knowledgebase somewhere that discusses the effects of moving a Windows
installation to a drive with a different serial number. There is a
security consequence and there is a corrective action--I got bitten by
this one a while back. Trouble is I didn't note the article number
anywhere.

I'll look through the KB.That sure would explain this behaviour.I have
though,ghosted and restored many win2k pro machines,and restored to bigger
hard drives of many different brands with no problem.Never tried ghosting
and restoring a server though.Adythemic

 

[Adysthemic]

It's specific to server and has something to do with the way Active
Directory was implemented. There's a second security key in addition to
the SID, and that key is IIRC tied to the disk serial number, but I
can't remember what it's called--if I could then finding the article
would be easy.

--

Thanks John,
I seriously doubted you at first but you have me convinced enough to go
deeply searching,:>), it seems to be the only thing at the moment that makes
any sense.I've never seen anything about win2k security being tied to unique
hardware id's,but heck the new XP is,after all.The KB article that you
posted the link to, seems to be focused on a complete hardware change.I
always have believed that same hardware meant identical components and not
unique serial numbers i.e. mac adresses, hard coded serials etc.I keep a
data base of my employers client images so restoring is even less hassle
than a sysprepped box .I can restore to any brand /size drive.I've restored
maybe 10 or so in the last year.Just delete from AD put the clone back on
the net rejoin domain,bingo,that is what I expected with the member
server.Seems though that nobody supports a raid 5 clone ,officially
anyway.But a hardware raid 5 should be transparent to Ghost I'd
think,Adysthemic