bobó§:sgºÛ^:ç]»×iÞÂÊh²Ö¥‰«

I got the following error today upon bootup of Windows Server 2003 SP 2 R2
Enterprise:
------------------------------------------------------------------
The Active Directory is rebuilding indices. Please wait…

Security Accounts Manager initialization failed because of the followingi
error: Directory Service cannot start. Error Status: 0xc00002e1. Please click
OK to shutdown this system and reboot into Directory Services Restore Mode,
check the event log for more detailed information.
------------------------------------------------------------------
Rebooting in Directory Services Restore Mode allows me to check he Directory
Service event log. Below are three of those errors:

================================================== ===
Event Type: Error
Event Source: NTDS ISAM
Event Category: Logging/Recovery
Event ID: 477
Date: 4/25/2007
Time: 8:50:45 AM
User: N/A
Computer: RC-SERVER-4
Description:
NTDS (532) NTDSA: The log range read from the file "E:\WINDOWS\NTDS\edb.log"
at offset 9272832 (0x00000000008d7e00) for 512 (0x00000200) bytes failed
verification due to a range checksum mismatch. The read operation will fail
with error -501 (0xfffffe0b). If this condition persists then please restore
the logfile from a previous backup.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

================================================== ===

Event Type: Error
Event Source: NTDS ISAM
Event Category: Logging/Recovery
Event ID: 465
Date: 4/25/2007
Time: 8:50:45 AM
User: N/A
Computer: RC-SERVER-4
Description:
NTDS (532) NTDSA: Corruption was detected during soft recovery in logfile
E:\WINDOWS\NTDS\edb.log. The failing checksum record is located at position
18111:191. Data not matching the log-file fill pattern first appeared in
sector 18112. This logfile has been damaged and is unusable.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

================================================== ===

Event Type: Error
Event Source: NTDS ISAM
Event Category: Logging/Recovery
Event ID: 465
Date: 4/25/2007
Time: 8:50:46 AM
User: N/A
Computer: RC-SERVER-4
Description:
NTDS (532) NTDSA: Corruption was detected during soft recovery in logfile
E:\WINDOWS\NTDS\edb.log. The failing checksum record is located at position
END. Data not matching the log-file fill pattern first appeared in sector
18112 (0x000046C0). This logfile has been damaged and is unusable.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
================================================== ===

I can't boot normally and must boot to Directory Services mode. I can't
remove AD while in Directory Services mode. So it seems I must fix the
edb.log file.

What do I do from here?

--
Bob

jorge silva

Hi Bob
Sounds like a DB corruption.
Some possible solutions:
1 - Try to restore from backup.
2 - Reboot in DSRM, and try to perform a DB repair an/or clean the log files
and .chk file.
3 - If you have more than 1 DC for that network, you can force the demotion
on the dead DC and perform metadata cleanup, then you can re add the server
again as additional DC.
also check:
http://support.microsoft.com/kb/258062
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

--------------------------------------------------

v-miluo

Thanks Jorge for his kindly answer!

Mike Luo

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

bobó§:sgºÛ^:ç]»×iÞÂÊh²Ö¥‰«

Thanks Jorge,

In article 332199, I'm following procedure: If the domain controller cannot
start in normal mode.

Step 5 reads "Log on with the administrator account and password that is
used for Directory Service Repair mode".

What does step 5 mean? Is it asking me to F8 boot into Directory Service
Repair mode? Or is it asking me to boot normally and log on with the the same
administrator account and password that I used earlier when I first when into
Directory Service Repair mode?

--
Bob

v-miluo

Hello Bob,

It means to boot into Directory Service Repair mode. The following steps
should be performed under Directory Service Repair mode.

Mike Luo

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

jorge silva

Thank you Mike.

Bob, as Mike said these operations are done through DSRM, and the DSRM
password is needed.
The DSRM Password is defined when you run Dcpromo, and can be changed with
Ntdsutil, you should consult your network security/configuration paper work
and check what password is.
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

bobó§:sgºÛ^:ç]»×iÞÂÊh²Ö¥‰«

Thanks Jorge and Mike, but its too late. I already logged in under "Normal"
mode as that seemed to make more sense to me and it worked out fine.

I couldn't understand why I would need to log in to Directory Services mode
all over again, so I followed the step litterally (in that it didn't actually
say to log into Directory Services mode).

btw: Once all this is complete, my DNS Server started posting event 4007's.
I had to manually delete the following key to resolve it.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DNS Server\Zones

--
Bob

jorge silva

Hi Bob
Assuming that your Server already have AD installed you can only repair or
restore the AD database in DSRM mode.
--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services