Looking for some additional help on this becuase I have not found anything similar in my research.
BACKGROUND:
2003 Domain 2 DC’s
The PDC failed (2 drives in a RAID5)
No recovery of the PDC data possible becuase there was no backup being performed.
The BDC was also running DNS but was NOT a Global Catalog Server for the domain. I checked the FSMO roles on the BDC and it was the Schema and the Operations Masters. My only option was to seize the remaining roles to the BDC (including the RID Master). Replaced the HDDs in the PDC did a clean install of Win2003, promoted to the domain (as a different name) DC. After I verified all was functioning correctly other than a couple of minor events, managment approved a budget to purchase new hardware per my recommendation. Within a week I had 2 new servers!! So I Installed Win2003R2 on both, designated a DC1 and DC2, promoted to the domain, setup DNS, Replications, DFS, AD, and transfered the roles to the appropriate DCs from the old harware (2 to DC1 and 3 to DC2). Now everything is working fine and after a testing period I demoted the old DCs and renamed them to file servers.
All services are functioning fine until my oeprators start saying that if they have to reboot a server (oh, the domain consists of approx 100 servers)they get an error when logging in “Domain cannot be contacted….computer account not found…” but after several reboots they are able to login. This investigation lead immediately to DNS and SID. DNS is correct, but SIDs are not!
So I checked each domain member SID – guess what…all members other than 2 or 3 that I joined after the new DCs have the wrong sid on the computer account than what AD says it is. I assume in seizing the RID Master upon the initial failure and there being no GC server with the AD data that the SID pool was lost or corrupted and the new RID started a new allocation pool. Now I have a dommain comprised of incorrect SIDs for each computer account, which is beginning to cause some problems applying GPOs as I strengthen AD for the domain’s security.
I’ve tried several tests and updates, none of which seem promising to be the resolution to this problem.
Does anyone know a way to have the DC force the computers to update it’s SID and RID with the information it has stored in AD? Not having to go to each server and manually change it is ideal and since this is a 24/7 production domain the downtime/outage is a big issue when reboots are required.
Thanks in advance for any insight into this issue!!