1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

server lockdown

Discussion in 'Networks' started by michael78, Feb 7, 2006.

  1. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    Guys been a big ballsup where I work our main Domain Controller has locked itself down and won't allow anyone to log into it. No accounts were deleted and we aren't sure why this has happend.

    does anyone know of a way to get around this or a cause of why this may of happend.



    Cheers in Advance

    Michael
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  2. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    When you say "locked up" I'm assuming that you mean it has somehow had some security applied to it that has changed something?

    You have tried just un plugging the power to it and re booting it havent you?

    Need more info - What OS, are there other DC's, etc?
     
  3. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    Simon, it's a windows 2000 server that seems to have locked down all permissions and won't allow anyone to access the OS to gain control. The lads I work with say they haven't touched it and it's hosted offsite. We did power it off and on again removing the plug as well. We are sorta screwed as it's our master of operations server...:eek:
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  4. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    Can't you assign the FSMO roles to other DC's?

    At least then you're giving yourself some leverage.
     
  5. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    what is the exact message that you get when you try to log on?
     
  6. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    It says can't loggon interactively
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  7. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    That sounds asthough you don't have the permissions to (duh! State the obvious Simon!)

    Are you trying to log in as the Domain Administrator?

    You say that this DC is not local to you, can someone who is local to it try logging on? it may simply be a problem with the VPN, Terminal Services, or however you access the DC normally?
     
  8. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    Simon, it's hosted at a nearby site the lads have been onsite to try everything. We have full admin rights but something has caused it to lockdown the server. As it stands we might have to rebuild the whole companies network as it won't allow the policies to be migrated onto another server. Thats 9 sites across the UK...:blink
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  9. Pablo1888

    Pablo1888 Byte Poster

    119
    0
    19
    Hi Slypie,

    I think I had the same problem you mention with a home lab I had set up. I couldn't login to the DC interactively. You have to use a program which comes with the W2K Resource kit called ntrights.exe. I had a copy but I don't have it anymore. Here's a link that might help you also.
     
    Certifications: MOUS Master, MCP 70-210, A+
    WIP: CCNA
  10. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199

    FOOOOOOK!!!!!! :eek:

    I hope Pablo1888's link can help you then. :blink
     
  11. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    cheers for the help guys. I've tried ntrights program without any luck. It looks like we are well and truly screwed. Me thinks I need a change in career...:D
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  12. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    Seems rather strange to me though that a server can automatically change it's security policies.

    Do you not have any backups of the system state? can you not perform a restore from an earlier time?
     
  13. d-Faktor
    Honorary Member

    d-Faktor R.I.P - gone but never forgotten.

    810
    0
    39
    slypie,

    do you have the admin tools installed on a workstation, and can you currently still successfully administer the domain with the appropriate account? if so, then you would only need to rebuild the server in the worst case, not the entire network.

    someone asked if you tried to logon as domain admin. you answered you had full admin rights. that's not quite the same. so, is it a (or the) domain admin account that is locked out? if so, are there other accounts that are member of the domain admins group, and have you tried them? have you tried the same account, or the same other domain admin accounts on other domain controllers? again, if so, then you would only need to rebuild the server in the worst case, not the entire network.

    you said "it won't allow the policies to be migrated onto another server". i'm not sure what that means, let alone what it has to do with transferring the fsmo roles. the roles are to be seized. the server has nothing to allow or disallow. it can be completely down, and the roles can still be seized by another domain controller.
     
  14. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    The domain Server that has died is our master of operations domain controller. I don't understand what has happend with it locking down the security. Unfortunately my manager for some reason demoted our Newcastle server screwing the newcastle office up. We can't promote the server as our main domain controller is screwed. I feel like throttling my manger as it's caused a lot of crap for us all and a lot of work.

    Either someone has been messing with the server (it's hosted at an external site not managed by us) or they have been hacked. Potentially we might have to rebuild 20+ servers and re-add 250 clients across 9 sites...:cry:
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  15. simongrahamuk
    Honorary Member

    simongrahamuk Hmmmmmmm?

    6,199
    125
    199
    Slypie, when you say that the server is your "master of operations domain controller" can you clarify a bit more on that?

    Its a term that I've never heard before, yeah I'm familliar with the FSMO roles but as d-faktor said these can be re assigned.

    Are you saying that you don't have another DC in the network?
     
  16. MarkN

    MarkN Nibble Poster

    79
    3
    15
    Slypie

    Hello -

    How many DC's have you in the domain?

    The interactive logon issue could be due to:

    1. Group policy - there is a setting for "log on interactively"
    2. Some has applied a security template (inf) file

    Given you can't log on have you tried installing the admin tools locally and running dsa.msc to connect to a DC and looking at the policies for the server - can you run RSOP against the server?

    When your lads went on site did they try and log on locally?

    Mark
     
    Certifications: MCSE NT4\W2K,CNE,CCEA,ASE
    WIP: CCNA
  17. MarkN

    MarkN Nibble Poster

    79
    3
    15
    Certifications: MCSE NT4\W2K,CNE,CCEA,ASE
    WIP: CCNA
  18. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    it's our main domain controller that all our other domain controllers are controlled from.
     
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  19. michael78

    michael78 Terabyte Poster

    2,085
    29
    141
    Certifications: A+ | Network+ | Security+ | MCP | MCDST | MCTS: Hyper-V | MCTS: AD | MCTS: Exchange 2007 | MCTS: Windows 7 | MCSA: 2003 | ITIL Foundation v3 | CCA: Xenapp 5.0 | MCITP: Enterprise Desktop Administrator on Windows 7 | MCITP: Enterprise Desktop Support Technician on Windows 7
    WIP: Online SAN Overview, VCP in December 2011
  20. d-Faktor
    Honorary Member

    d-Faktor R.I.P - gone but never forgotten.

    810
    0
    39
    there is no such thing in active directory. all domain controllers are equal, although one is a bit more equal than the others. :blink
    the only thing that can differentiate that domain controller from the others is based on the fsmo roles, and you don't need that domain controller to transfer those.

    [edit] i might add that i (we) have asked a couple of questions, and you didn't answer them. it's difficult to help you if you don't help us help you.
     

Share This Page

Loading...