Ntds.dit corrupted

[Bilal AlTarazy]

Hi,

I have a domain with multiple DCs, the primary DC hosting all the FSMO rolls, has crashed after a power failure. I receive a BSOD with the following error:

“STOP: c00002e2 Directory Services could not start because of the following error: A device attached to the system is not functioning.

I found some entries in a forum that discussed mixed up drive letters, my system partition lost the letter C:\ for some reason, thus I switched that back.

I then restarted and booted into DSRM.

I then made a backup of the c:\windows\ntds\ directory and continued to run the following command to check the integrity of the database:

esentutl /g c:\windows\ntds\ntds.dit

The scan completes and I received an error message that the database is corrupted.

"Operation terminated with error -1206 (JET_errDatabaseCorrupted, Non database file or corrupted db) after 7.16 seconds.

I then followed a procedure on a forum to check the DB with NTDSUTIL

I opened NTDSUTIL, connected to the active instance, typed file, typed info and receive no errors.

But when I run Semantic Database Analysis without the fixup option, I received loads of errors.

I then ran the analysis with the fixup option and received a lot of errors again with the below as the result:

Error: Inconsistent SD refcounts detected.

I then did a soft recovery of the DB and got the message that the recovery was successful.

I then ran the Semantic Analysis again to test the recovery, but I receive a lot of errors again stating:

*** Errer: JetDelte/Update failed with [ Jet Error -344].

I then read that a defrag must be done on the DB, I then ran an offline defrag and received the below:

operation terminated with error -327(JET_errBadPageLink,database corrupted)

Unfortunately there are not system backups for the server.

Any advice will be appreciated.

Regards,

[#2]

Hello,

I read in your first line that you have multiple DC's. That's a good thing!

I would scrap this broken DC, even though it has the FSMO roles on. I would then Seize the FSMO Roles on to another DC.

To do that, open a PowerShell window on a DC that you would like to Seize the FSMO roles to and then type the following command. Just make sure you enter your DC name where it says Target_DC_name

Move-ADDirectoryServerOperationMasterRole -Identity "Target_DC_name" –OperationMasterRole PDCEmulator,RIDMaster,InfrastructureMaster,SchemaMaster,DomainNamingMaster

Any issues or questions let me know, Happy to help further if I can.

Richard

[#3]

I'd probably just power it off and seize roles on another functional DC

https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-t...

then do cleanup.

https://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx

then build a new one.

If you have multiple DCs I'd use dcdiag / repadmin tools to verify health before starting. Then I'd stand up the new one, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to verify health, when all is good you can decommission / demote old one.