Forcing Demotion of a Domain Controller

The other day I was attempting to install a new antivirus software on one of my company’s remote domain controllers. Everything was going fine except the antivirus couldn’t create the user account it needs to perform updates.

I checked the knowledge base for my antivirus company (It’s Sophos if you must know) and they suggested trying to manually create the account in Active Directory if it is on a Domain Controller. When I opened up Active Directory Users and Computers, it defaulted to the next closest Domain Controller. When I tried to select the server I was on, I got an error message.

Apparently, one of our Systems administrators was doing some meta data cleanup a few weeks ago to try to fix some replication errors, and may have accidentally deleted this particular server’s roll as a Domain Controller. Ouch!

It was still a part of the domain, so I tried to simply demote it and re-promote it again. This is where I ran into an issue. When I tried to demote it I got the following error:

Error: An error occurred:
Win32 Error 8419(0x20e3): The DSA object could not be found.

I tried a few things with DNS, but nothing worked. I finally had to break down and force the demotion of the server. If you have never done it, you run the following command:

dcpromo /forceremoval

This runs dcpromo and ignores all errors. Once complete, the server will reboot and will no longer be a part of the domain.

When that was complete, I deleted the server object from Active Directory Users and Computers, and forced replication to the other Domain Controllers. I then ran the ntdsutils command line utility to make sure there wasn’t any stale metadata left over.

After that I tried to rejoin the server to the domain. I wasn’t able to, apparently the SID data was still in AD. To correct that I ran newsid from Sysinternals to change the SID and rebooted it. When it came back up, I rejoined it to the domain, and ran dcpromo successfully.

I’ve been keeping my eye on it, and everything seems to be replicating without issue. Hurray!

This just goes to show you that when trouble shooting the underbelly (AKA the Schema) of Active Directory, be careful, and pay close attention to what you are doing. One simple mistake can cause big problems.

Has anything like this happened to you? What caused it? How did you fix it? Did you do something similar? Let me know in the comments.

Technorati Tags: Error 8419(0x20e3),dcpromo,force,removal,domain,controller

Read more »

Fighting Antivirus XP/2008/2009 Malware

Not sure if you have seen it, but a few of our machines at my company have been hit with different variants of Antivirus XP, Antivirus 2008 or Antivirus 2009. It comes in many other forms and names. Basically what this little bit of nasty does is installs itself, then plagues the victim with pop ups asking for them to buy a full version of the software.

We use McAfee Virus scan with Anti spyware version 8.5 and guess what, it does NOTHING to stop this nuisance. I checked McAfee's site and they know about it, and all they say is to make sure our definitions are up to date (They are by the way).

I installed Spybot on the infected machines, and that cleaned up some of it but not all. I did however find a really cool tool that completely eradicates this nasty bastard. It is called Malwarebytes Anti-Malware!

After running McAfee, Spybot, Adaware, Clamwin and AVG, Malwarebytes still picked up 42 instances of Antivirus XP/2008/2009 and other little bits of nasty! After a reboot and a second scan, it picked up another 6 before everything was back to normal.

On one of the machines infected with Antivirus 2009, it locked down all internet connections except to the bogus sites it forwards you to to buy the full version. So I had to download Malwarebytes to a thumb drive, as well as the manual updater located here (Malwarebytes manual updater). That way I was able to install Malwarebytes on the infected machine, and update it with the manual update, and get rid of that.

I HAVE EXORCISED THE DEMON! THIS PC IS CLEAR!

Malwarebytes Anti-Malware is free to use. If you want on-access protection, automatic updates, and scheduled scans you need to buy their full version. Here is a list of some key features from Malwarebytes.org:

• Support for Windows 2000, XP, and Vista.
• Light speed quick scanning.
• Ability to perform full scans for all drives.
• Malwarebytes' Anti-Malware Protection Module. (requires registration)
• Database updates released daily.
• Quarantine to hold threats and restore them at your convenience.
• Ignore list for both the scanner and Protection Module.
• Settings to enhance your Malwarebytes' Anti-Malware performance.
• A small list of extra utilities to help remove malware manually.
• Multi-lingual support.
• Works together with other anti-malware utilities.
• Command line support for quick scanning.
• Context menu integration to scan files on demand.

Have you ran into this malware? What did you use to remove it? Hit me up in the comments.

Read more »