Home / server / Questions / 571194
Accepted
Ash
Asked: 2014-01-31 19:33:48 +0800 CST

Login to disconnected domain controller

  • 772

I cannot login to a long-time disconnected domain controller running Server 2008 R2.

I have tried resetting the "local" Administrator password using the following method, but still cannot login.

http://www.howtogeek.com/106333/how-to-reset-your-forgotten-domain-admin-password-on-server-2008-r2/

Can someone please help?

windows-server-2008-r2

2 Answers

  1. Best Answer

    If the machine has been disconnected from the network longer than your Active Directory (AD) forest's tombstone lifetime be sure not to allow the machine to actually replicate with any existing domain controllers (DCs). (You can get the tombstone lifetime by running dsquery * "cn=directory service,cn=windows nt,cn=services,cn=configuration,dc=<forestDN>" –scope base –attr tombstonelifetime, substituting in the DN of your AD forest, obviously).

    If you don't have a working password from the AD instance running on the machine boot it in Directory Services Restore Mode (DSRM) and logon with the password set when the machine was promoted to a DC.

    If you don't have the DSRM password you can reset it with any number of third-party utilities (I like http://pogostick.net/~pnh/ntpasswd/, personally).

    (There are any number of other "hacks" that will get you onto the machine, but that's how I'd do it, personally.)

    • 3

  2. I have never had a problem using the utilman trick. I recommend that method. BUT you don't have to reset the "Administrator" password - you COULD look at C:\Users and pick ANY account that had domain admin rights and reset that password. (It's possible if the account was disabled that's why it doesn't appear to have worked for you).

    Also, I would leave the DC DISCONNECTED from the network when you try to logon - with no network detected, it should skip a bunch of checks/attempts to communicate with the domain making the whole process faster.

    • 0