Win2008R2 DC blue screen on startup

Today I hade a very mysterious problem on one Win2008R2 DC. The server was denoted as a RODC and promoted as a RWDC. After a few reboots the server was working good and workstations used the new server. A few days later from the I did a new reboot and got a blue screen:
STOP: c00002e2 Directory Services could not start because of the following error: A device attached to the system is not functioning. Error Status: 0xc0000001. Please shutdown this system and reboot into Directory Services Restore mode, check the event log for more detailed information.
I started in DS Restore mode (F8 after BIOS Post) and the server booted up. The first screen that I saw was:
Failure configuring Windows features. Reverting changes. Do not turn off your computer.
 After this the computer shutdown (but I got the same blue screen error). A new boot into DS Restore mode got me additional configuration of the server:
Preparing to configure Windows. Do not turn of your computer.
However my problem wasn't solved this time. After logging on into the server in DS Restore mode I looked at the event logs but there was no additional information stored here. I looked at my NTFS file system to verify that NTDS files were present (and they where). I looked in services.msc to see if  Active Directory Domain Services was present and it was. I started ntdsutil to look at the files and then I got a nasty JET Database Error:
"Could not initialize the Jet engine: Jet Warning 1." Failed to open DIT for AD DS/LD instance NTDS. Error -2147418113
 Basically something was missing and I looked at the registy for the Active Directory Domain Services (NTDS); HKLM\SYSTEM\CurrentControlSet\services\NTDS. I was missing a bunch of keys (=registry folders) in this branch; Diagnostics, Parameters and RID values. So my fixing started (as I had my NTDS.dit file on the local file system). I copied the registry keys from another working DC and modified the following keys under  ...\NTDS;

  • \Diagnostics\* (added all keys)
  • \Parameters\* (added all keys)
  • \Parameters\DS Drive Mappings (edited to correct GUID for volume)
    To find your volume GUID use mountvol.exe
  • \Parameters\Machine DN Name (edited to correct value)
  • \Parameters\DSA Database Epoch (deleted value)
After doing the registry fixing my DC started and replication worked with my other domain controllers. When Windows did it's configuring (that somehow caused the problem in the first place) it also set some of the other services to disabled (and I enabled these in services.msc);
  • DFS Namespace (dfs)
  • DFS Replication (dfsr)
  • DNS Server (dns)
  • Intersite Messaging (ismserv)
  • Kerberos Key Distribution Center (kdc)
Now I'm going to denote the server, move all services to a fresh/clean installed server and promote the new server to be my DC on the site.
A few links that helped me during troubleshooting:

2 comments:

Anonymous said...

Thanks!
This was exactly my problem and once i found your post it took me 10 minutes to repair.

Saved my A** and $515.00 for Microsoft after hours support.

Thanks again

Hans Van Dijk said...

YOU SAVED MY LIFE!
Thank you so much!

Luckely, I had the right registry values in ControlSet002, so editing was not nessesary.

Many many thanks for posting your solution!