Bad Day

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

I've had quite a bad day i think. Not as bad as leehaa's perhaps, but...

Got into work today to discover i was the only person in my team in. so i had to do everything myself.

We had heaps of leavers to process (mind numbing, repetitive work).

But the icing on the cake? I accidentally deleted a group that is used by several hundred people to allow access to a particular piece of software. Nightmare.

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

 

oh dear, perhaps you should ware a t-shirt like this tommorrow?
http://www.cafepress.com/cp/moredetails.aspx?showBleed=false&ProductNo=94802939&pr=F

G

 

I think just about all of us have had at least one day like this, group deleting included. Hang in there. Tomorrow will probably be better.

 

How do you think I feel when I get in and discover that the only other person there is Boyce?



JK!

 

Whoops! Ah well you're only human. At least you won't be making that mistake again in a hurry!

 

They have, its authoritative/non-authoritative restore. But its not easy to implement, and apparently isnt worth the hassle for a single group.

We managed to get it sorted in the end, recreating the group was sufficient to sort the problem. But i was getting daggers from management.

I certainly wont be making the same mistake in a hurry, they revoked my rights to delete groups! Well, technically thats not right - i can create/delete in another area, then have to move them into that area. So presumeably if i wanted to delete a group id have to move the group before deleting.

 

Reminds me of the day my old superior accidently popped our 3 RAID drives out on how domain controller, need I say more what we done all weekend?

Stick in there mate, everyone has a few days like that!

 

Or a recycle bin

 

nope, although the restores can be limited to as little as a single user account, but it appears to revolve around wiping an entire DC to get it back.

You basically wipe the entire DC, and restore it using a non-authoritative restore, this tells the DC to take anything from another DC as gospel - you can then restore specific accounts/groups/ous/etc using the authoritative restore - in this manner, that particular object is considered gospel by all other DCs - but you see why its a pain in the arse.

 

a system state restore wouldnt work for a deleted group. Within AD, a delete overrides all other actions. If you did a system restore on the dc, you would roll it back to a previous version, with the information on it, but the next replication would wipe it.

The only way to sort it is to use the authoritative restore.

Or at least thats what i was told/read

 

I had a week of bad days worth. printers and faxes braking. All kinds of computer issues etc. I once by accident renamed an OU in AD which caused a whole bunch of people getting connection issues, luckly I was able to fix rename the OU back to the way it was before having to go and comfrunt my superiors. So when I told them what happen and why everyone got disconnected at least I also told them the the OU is back to the way it was and everyone should be ok now. They didnt really care just said to be more carefull.

But yean Ferhgal we all had them.

 

Im not sure that would work either. Since we're on a multisite domain and noticed almost instantly, if that would have worked, we could have done it on a remote DC and it would have just replicated back. Deletes take precedence over everything else (and i think AD keeps a note of used GUIDS - so if it is on the list but not in use then its been deleted).

I could be wrong on that though. I might try and test it out sometime if i get my lab back up and running,

On the flipside of this - we managed to recreate the group, and put everyone back in (we got the members list using a script on one of those remote servers). Luckily the backend software deployment software didnt use that particular group for its mechanisms, so there was no issues arising from it.

They've revoked my ability to delete groups in the live area, but thats to be expected after something like this. I can still create. My manager spoke to me today and told me not to stress about it, everyone makes mistakes, which is good.

Fergal

 

Exactly Fergal it happens to everyone and you'll see before you know it you'll be back with the same rights and probably more.

Its all good.