Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

AD School of Hard Knocks

Lesson learned: Prepare for all kinds of problems, even the less common ones. This entails reviewing your AD backup plan and making sure your disaster-recovery strategy encompasses the possibility of losing all your domain controllers. We took several steps, and missteps, to recover our AD, which I explain below.

In Recovery

When you lose both directory mirrors, it's difficult to save AD. At first we tried demoting the damaged domain controller, reinstalling AD and forcing replication of its database. Trouble was, we hadn't documented which controller was providing which Windows 2000 Server operations master role. We had to seize and transfer missing roles and remove the damaged controller from the domain so replication could begin. We then experienced more problems, including excruciatingly slow replication, so we decided to scrap the recovery process and rebuild AD from scratch.

First came the task of rebuilding the domain by entering and testing the technology department's users and groups. AD users and groups have properties including names, passwords, profiles, workstations and group membership that have to be entered, copied or created, depending on the installation's requirements. At Gulf Coast Community College, we use a combination of profiles and workstations for a user to control the desktop until sign-off. In Classroom 209, for instance, Student 209 has a profile that dictates he is allowed to use workstations located only in that classroom. Some users are assigned certain applications, and there are administrative users as well. After we had to manually re-enter all the college's 200 users identified in AD, we decided to automate the user and group-building process.

The Command-Line Syntax

click to enlarge

We checked out several scripts on the Internet for building AD users and groups. Most didn't include all the properties we needed or didn't work as advertised. After further research, we decided to use the WSH (Windows Scripting Host), the Visual Basic Scripting engine and the ADSI (Active Directory Scripting Interface) for creating our homegrown script.

  • 1