# Active Directory Forest got deleted



## panchofgm (Jun 8, 2012)

Hello everybody, I have a huge problem, I was trying to have two user desktops connected to a server that I use as a network drive. I logged in with the Administrator user and password in both of the computers at the same time and made the connection well (I didn't know I had to make the connections with the users login) separately, and now all my Active Directory in my Domain Controller forest is gone, I don't know what happened. I actually can not log into windows server 2003 (my DC) without logging into Directory Services Restore Mode. 

Whenever I try to do it the standard way there is a System Error: 
* Security Accounts Manager initialization failed because of the following error: Directory service cannot start. Error Status: 0xc00002e1. Please click OK to shutdown this system and reboot into Directory Services Restore Mode, check the event log for more detailed information.

Does somebody know what happened and how to solve this? I'm trying not to go crazy right now. Appreciate your time. Thanks.


----------



## Wand3r3r (Sep 17, 2010)

Connecting two workstations to the domain has no effect on AD or the server.

I would suspect you have a hardware issue. 

Download the run memcheck on the memory
Download the hard drive manufacturers diagnostic utility and run it.

Do you have a backup with system state?


----------



## panchofgm (Jun 8, 2012)

Hi, 

I've done the memcheck test, and no errors have been found. I do have a backup with system state and I restored it already, without any change. I followed the wizard and checked the box with the System State... at the end of the restoring process the Status was: Completed with skipped files. I opened the Event Log and found these errors:

Event ID: 477
Source: NTDS ISAM
Description: NTDS (436) NTDSA:The log range read from the file: "C:\WINDOWS\NTDS\edb.log" at offset 4096(0x0000000000001000) for 843264(0x000cde00) bytes failed verification due to a range checksum mismatch. The read operation will fail with error -501(0xfffffe0b). If this condition persists then please restore the logfile from a previous backup.

Event ID: 465
Source: NTDS ISAM
Description: NTDS (436) NTDSA: Corruption was detected during soft recovery in logfile C:C:\WINDOWS\NTDS\edb.log. The failing checksum record is located at position 8:0. Data not matching the log-file fill pattern first appeared in sector 1655. This logfile has been damaged and is unusable.

Event ID: 300
Source: NTDS ISAM
Description: NTDS (436) NTDSA: The database engine is initianting recovery steps.

Event ID: 452
Source: NTDS ISAM
Description: NTDS (436) NTDSA: Database C:\WINDOWS\NTDS\ntds.dit requires logfiles 573-573 in order to recover succesfully. Recovery could only locate logfiles starting at 583.

Event ID: 454
Source: NTDS ISAM
Description: NTDS (436) NTDSA: Database recovery/rstore failed with unexpected error -543.

Event ID: 1168
Source: NTDS General
Description: Internal error: An Active Directory error has occurred.
Aditional Data
Error value (decimal):
-543
Error value (hex): 
fffffde1
Internal ID:
40749

Event ID: 1003
Source: NTDS General 
Description: Active Directory could not be initialized.
The operating system cannot recover from this error.
User Action
Restore the local domain controller from backup media.
Additional Data
Error value:
-543 %2

Other tests that has been performed and results:

- Checksum @ntdsutil.exe
Results: Operation terminated with error_1206 JET_errDatabaseCorrupted, Non database file or corrupted db

- Integrity
Results: Database is CORRUPTED

- Semantic Database Analysis
Semantic checker: Go
Opening database Current.*** Error: DBInitializeJetDatabase failed with Jet Error -543.

As an additional information, I have this current files in C:\WINDOWS\NTDS\
edb00246.log
edb.chk
edb.log
ntds.dit
ntds.INTEG.RAW
res1.log
res2.log


----------



## panchofgm (Jun 8, 2012)

Does this below sound crazy or could it be a solution?
Since I've got the database corrupted somehow, I was thinking if I can de-install the Domain Controller from the server, then re-install the DC again with the good files and then try to restore the server with the backup.bak I've got.


----------



## Wand3r3r (Sep 17, 2010)

You should test the hard drive first. You are not going anywhere if the harddrive is failing or has platter/disk errors.


----------



## panchofgm (Jun 8, 2012)

Thanks Wand3r3r,

There is no disk errors, just the Active Directory database is corrupted, so if I uninstall the Domain Controller from my domain and try to re-installe it again... what will happen with my website, and other servers I've got, since they are not going to be found with in the network or am I not thinking straight right now? I guess my biggest concern is that the website would be down for a long time. What should I do? Appreciate your help! Thanks!


----------



## Wand3r3r (Sep 17, 2010)

did you at least run chkdsk /f on the drive?

if there are no disk errors then how do you explain the DB corruption?
There are only three things I know that will do this;
faulty disk
faulty ram
faulty cpu

These would also explain why your restore failed. If you don't have a good foundation [hardware] your house [AD] will not stand.

You speak about "uninstalling the domain controller". But you only mention a single server. If this is the case you have nothing to uninstall. 

Please clarify if this in a domain with only one server

Your AD and web pages are only as good as your last full backup with system state if this is a single server.


----------



## panchofgm (Jun 8, 2012)

Hi, I did run the chkdsk /f ... and the results were 0kB in bad sectors, so I don't know what could be wrong. I checked the Event Viewer and saw these errors:

Event ID: 1000
Source: Application Error
Description: Faulting application tcpsvcs.exe, version 5.2.3790.0, faulting module ntdll.dll, version 5.2.3790.4937, fault address 0x0004cd12.

Event ID: 477
Source: ESENT
Description: wins (2044) The log range read from the file "C:\WINDOWS\system32\wins\j500007A.log" art offset 170496 (0x0000000000029a00) for 512 (0x00000200) bytes failed verification due to a range checksum mismatch. The read operation will fail with error -501 (0xfffffe0b), If this condition persists then please restore the logfile from a previous backup.

Event ID: 465
Source: ESENT
Description: wins (2044) Corruption was detected during soft recovery in logfile C:\WINDOWS\system32\wins\j500007A.log The failing checksum record is located at position 333:22. Data not matching the log-file fill pattern first appeared in sector 352. This logfile has been damaged and is unusable.

Event ID: 454
Source: ESENT
Description: wins (2044) Database recovery/restore failed with unexpected error -501.

Event ID: 450
Source: ESENT
Description: tcpsvcs (1740) Restore. A gap in the logfile sequence was detected. Logfile C:\WINDOWS\System32\dhcp\j5014EC5.log is missing. Other logfiles past this one may also be required. This meesage may appear again if the missing logfiles are not restored.

Event ID: 412
Source: ESENT
Description: tcpsvcs (1740) Unable to read the header of the logfile C:\WINDOWS\System32\dhcp\j50.log. Error -501.

*****

I have 4 servers in my network, one is the Domain Controller and the others act as an Application servers (Database, email, website, etc) Right now from the client computers we don't have access to the Database server, because there is this issue with the Active Directory due to the empty file in the DC.


----------



## Wand3r3r (Sep 17, 2010)

rule number one in AD is you always have a second DC for AD failover.

Do you have a known good backup with system state?

If so rebuild the server and reload the backup software. don't dcpromo the server. A full restore including system state should get you back to where you were at the time of the backup.

If this is not successful you will need to rebuild the network from scratch.


----------



## panchofgm (Jun 8, 2012)

Thanks Wand3r3r,

I appreciate your help and tips... I guess I'm going to start from scratch all over again, so I don't have any extra issues with loading the year old backup I've got. Have a great day!


----------



## Wand3r3r (Sep 17, 2010)

Good luck and keep us updated.


----------

