Home / server / Questions / 559806
Accepted
Sandy
Asked: 2013-12-07 17:08:18 +0800 CST

How to recover Hyper-V Guest Domain Controller from Stop Error 0xc00002e2

  • 772

Host is Server 2012 with single Hyper-V guest which is a Domain Controller. When booting the DC it gives a Blue Stop Error: 0xc00002e2 and then reboots. After third reboot it shows a recovery console with options for

*Continue

*Troubleshoot

*Turn off your PC

I choose troublehsoot and open a command prompt and when I tried to run 

SFC /scannow

But receive the error: Windows Resource Protection could not start the repair service.

I tried to run chkdsk /r

And receive the error: Windows cannot run disk checking on this volume because it is write protected.

I can boot into DSRM but I'm not sure how to proceed. I try to demote the DC, but receive this error when supplying credentials:

Error verifying credentials: verification of user credential permissions failed. Failed to examine         the Active Directory forest. The error was: The operation cannot continue because LDAP connect/bind operation failed: error 58. Ther specificied server cannot perform the requested operation.)
hyper-v

3 Answers

  1. The error code is "Directory Services cannot start."

    This article has all the ntdsutil tricks you need to check your AD database.

    Disregard that the article talks about Small Business Server - the principles are the same.

    But here's the thing. You really should read the whole article, because therein are a lot of useful bits of information, such as:

    Note Microsoft does not support domain controllers after Ntdsutil or Esentutl is used to recover from Active Directory database corruption. If you perform this kind of repair, you must rebuild the domain controller for Active Directory to be in a supported configuration. The repair command in Ntdsutil uses the Esentutl utility to perform a lossy repair of the database. This kind of repair fixes corruption by deleting data from the database. Only use this kind of repair as a last resort.

    So what you should be focusing on is restoring the domain controller from a system state backup. You have a backup, right? Well, if you don't, then you should just blow away the VM and build a new domain. I'll assume you didn't have anything important on that domain controller anyway if you didn't have a backup. :)

    • 2
  2. Best Answer

    I'm going to go out on a limb and assume that this is not your only domain controller.

    Delete the DC's computer object from Active Directory Users and Computers using a version of RSAT for Vista/2008 or later. Then, go into the AD Sites & Services snap-in and delete any reference to it in there. Then, reinstall the OS and promote the server again.

    If directory services won't start, you can't do a clean demotion, so this is the best way to clean up a DC that's being taken out of service without a proper demotion. This is also why you can't demote in DSRM.

    If this is your only DC, then do what Ryan says and pray for a miracle.

    • 2

  3. My situation involved a physical server which was also an only server, so demotion/promotion would have been painful since all AD accounts would be lost in the process.

    Fortunately, I found a better/simpler solution that usually works, or at least did for me.

    • Boot into Directory Services Repair Mode (Troubleshoot / Startup Settings / Restart / Directory Services Repair Mode). It may do some repairs and reboot, requiring you to do this a second time.
    • Login with a local admin account, since AD is not available.
    • Delete (or rename) C:\Windows\NTDS\*.log.

    And reboot normally.

    However, you may also want to defrag the database while in DSRM:

    • Open a Command Prompt (Win-R, CMD, Enter). Type NTDSUTIL and press Enter.
    • Type activate instance ntds and press Enter.
    • Type Files and press Enter.
    • Type Info and press Enter. Verify the folder is actually C:\Windows\NTDS.
    • Type Compact to <path> and press Enter. I created C:\Windows\NTDS\Temp and used that.
    • Copy the new file Ntds.dit in the temp folder over top of the old one in NTDS, and delete all the *.log files.

    Reboot normally.

    References:

    • 1