Virtualized a child DC - need to recover due to USN rollback

the only way to recover from USN rollback is to demote the DC and repromote
it.

also see:
http://blogs.dirteam.com/blogs/jorge...03/08/597.aspx

use the KBs for the steps with more detailed info on how to recover

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------

"Troy Thompson" <Troy Thompson@discussions.microsoft.com> wrote in message
news:CAB03BA8-41EF-47E7-8B4D-3AC2D8A3837A@microsoft.com...
> I now realize that converting a DC from a physical machine to a virtual
> machine has its own set of caveats. That said: I need to recover from a
> USN
> rollback situation.
>
> Scenario:
> - Parent PDC Zeus is Windows 2000 Server (corporate.com)
> --- Child PDC Alpha is Windows 2000 Server (dev.corporate.com)
> ------ Member server Vulcan is Windows 2003 Server and a member of
> dev.corporate.com.
>
> I converted Alpha (the child domain PDC) from a physical system to a
> virtual
> machine, but didn't realize that Active Directory needs more attention
> when
> this sort of cloning happens. I just shut down the physical box, and
> booted
> the virtual machine. The NetLogon service on Alpha pauses, throwing Event
> ID
> 2103: "The Active Directory database has been restored using an
> unsupported
> restoration procedure." I just resumed NetLogon, and it looks happy. I
> assumed this would sort itself out after a while, but it hasn't.
>
> After some research, I discovered http://support.microsoft.com/kb/885875/
> which indicates the proper solution is a complete reinstall of AD;
> however, I
> don't have a fresh system state backup (though I still have the physical
> PDC
> idling in the server room).
>
> Is there any way to uninstall AD and reinstall AD on this child domain
> PDC,
> without having to redo all the permissions on the member server? Will the
> parent PDC just "magically" see the reinstalled child PDC and sync
> everything? Or does uninstalling AD on the child PDC mean all the
> permissions
> set on the member server are orphaned?
>
> Would it be possible to add a child domain BDC, promote it, then demote
> and
> uninstall AD from the child PDC? Or would the added child BDC have
> bogus/broken replication data, since the USN on the child PDC was rolled
> back?
>
> My goal is to resolve the child domain NetLogon problems without having to
> redo all of the share and permission settings on the child domain member
> server.