Hello,
I work for a big international company with multi AD domains in one forest.
I am currently testing/validating the forest recovery process in an isolated lab wrote by Microsoft.
It says to restore one DC of each domain starting by the root domain in an isolated network or with the network cable unplugged.
Once restored I have to remove the global catalogue in order to avoid lingering objects. When I do so, my isolated DC has no more GC to contact when
it needs to authenticate a user's logon.
The problem is that in the doc they ask to reboot, so when I reboot I can no longer logon to the DC, doing DSRM boot I can't re add the GC role?!!
Even in the MS white paper they say to remove the GC role on the isolated DC. When I re add it I have errors like this:
Event Type: Information Event
Source: NTDS Replication Event Category: Global Catalog Event ID: 1110 Date: 19/10/2009 Time: 10:23:31 User: NT AUTHORITY\ANONYMOUS LOGON Computer: ADMGT04 Description: Promotion of this domain controller to a global catalog will be delayed for the following interval. Interval (minutes): 30
This delay is necessary so that the required
directory partitions can be prepared before the global catalog is advertised. In the registry, you can specify the number of seconds that the directory system agent will wait before promoting the local domain controller to a global catalog. For more information
about the Global Catalog Delay Advertisement registry value, see the Resource Kit Distributed Systems Guide.
So is actually possible to remove the GC role on a isolated DC when restoring?
Thank you
Stéphane