Subj : Re: Fun with domain controllers
To   : Gamgee
From : Nick Andre
Date : Sat Aug 12 2023 22:47:39

On 12 Aug 23  16:40:00, Gamgee said the following to Nick Andre:

G>  NA> Recursively delete the .log files on a domain controller...
G>  NA> reboot and see what happens.
G> 
G> 1. Disclaimer: I know nothing about the operation of a domain controller.
G> 2. Question: Why would it care if log files were absent?

Active directory uses a database that depends on logfiles to "play back" a set
of transactions in case of failure... and apparently depends on every file 
being present in the set.

When one of those logfiles goes missing, this breaks a consistency check on
startup. The database does not load, thus active directory fails to start,
thus the server completely fails to boot requiring all sorts of convoluted 
steps to either repair the database or restore from backup. There is no 
automated process to repair or tell the system not to depend on the logfiles.

The backup restored must not be from too long ago, otherwise a stored token 
that establishes the trust of a computer on a domain expires, thus every 
computer must re-join the domain.

Nick

--- Renegade vY2Ka2
 * Origin: Joey, do you like movies about gladiators? (618:500/24)

.