Restoring Domain Controller

[lawsonlee]

I had to do a fresh install of a domain controller with no system state or backups, but I do have the old SYSVOL folder. Can I copy that to the new install and restore the previous domain?

 

[ChatGPT]

Hi @lawsonlee, Restoring a Domain Controller (DC) without system state backups can be challenging; however, having the old SYSVOL folder can potentially help in recovering some of your Group Policy objects, scripts, and other settings. Unfortunately, just copying the SYSVOL folder won't be sufficient to restore the entire domain. Here's why and what you can do:

Why Just Copying SYSVOL Isn't Enough​

SYSVOL contains important data for domain infrastructure, but the critical domain controller data, including Active Directory Domain Services (AD DS), user accounts, and more, are stored in the NTDS.DIT database, which is part of the system state. Simply copying SYSVOL will not restore your AD DS information, Security Identifiers (SIDs), or any other essential components of the domain structure.

Potential Steps to Recover​

• Rebuild the Domain:
• Run DCPROMO to establish a new domain.
• Create an environment with the same domain name and structure. [*Restoring SYSVOL:
• You can restore the SYSVOL content to help recover Group Policy objects and scripts. Here’s how:
• Copy SYSVOL Content: Copy the contents from the old SYSVOL folder to C:\Windows\SYSVOL\domain.
• Fix Permissions: Ensure that NTFS and share permissions are correctly set on the new SYSVOL folder to match the old settings.
• Re-register FRS/DFSR: If you were using the File Replication Service (FRS), you need to reconfigure it. Ensure Distributed File System Replication (DFSR) is configured for Windows Server 2008 and later. For more details, you can follow the official https://docs.microsoft.com/en-us/windows-server/storage/dfs-replication/dfsr-overview. [*Reconfigure and Verify:
• Use the Group Policy Management Console to Import GPOs.
• Ensure that the Domain Name System (DNS) is properly configured and functional.
• Recreate user accounts and other AD DS objects manually.

Practical Advice​

Restoring a domain entirely without proper backups is risky and means some data might be permanently lost or will need to be reconfigured manually. Ensure regular backups and AD DS system state backups in the future to avoid similar situations. Let me know if you need further assistance or detailed steps on any of these processes. Best of luck with your restoration! Remember, every chaotic Active Directory challenge is just another opportunity to improve your disaster recovery plan! Cheers!

 

[lawsonlee]

Great information! Looks like it's all moot now. Apparently, when I promoted the server, it removed the files in the Windows.old folder. The only thing left in there is a PerfLogs and Users folder. Luckily, there aren't that many machines to re-add. I was hoping to be able to get the workstations back on the domain without having to rejoin it and losing some local configurations.