«

Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added
4 new user accounts with roaming profiles and mapped drives to user
folders on the server. All user data (My Documents) was stored on the
server in there user folders. Today, those 4 accounts and their
respected folders disappeared from the server. No trace of evidence was
in the Event Viewer. Nothing.

On top of that, I could not log on to any domain account from any of the
computers. The error message stated that the computer account for this
primary domain was missing. So I logged in locally and rejoined the
computers to the domain.

Any idea what in the world happened -- especially to the 4 new accounts,
their profiles and folders?

--
Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
The I.T. Classroom - http://www.theitclassroom.com/
CertGuard, Inc. - http://www.certguard.com/
Microsoft Exam Security Newsgroup -
microsoft.public.certification.exam.security

Did someone delete the container the accounts were in on another DC before
replication occured?

--
..rev

"It is the mark of an educated man to be able to entertain a thought without
accepting it"
~Aristotle
..
"Michael D. Alligood [CertGuard, Inc.]" <> wrote in
message news:%23XbGF$$...
> Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added 4
> new user accounts with roaming profiles and mapped drives to user folders
> on the server. All user data (My Documents) was stored on the server in
> there user folders. Today, those 4 accounts and their respected folders
> disappeared from the server. No trace of evidence was in the Event Viewer.
> Nothing.
>
> On top of that, I could not log on to any domain account from any of the
> computers. The error message stated that the computer account for this
> primary domain was missing. So I logged in locally and rejoined the
> computers to the domain.
>
> Any idea what in the world happened -- especially to the 4 new accounts,
> their profiles and folders?
>
> --
> Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> The I.T. Classroom - http://www.theitclassroom.com/
> CertGuard, Inc. - http://www.certguard.com/
> Microsoft Exam Security Newsgroup -
> microsoft.public.certification.exam.security
>
>

"The Rev [MCT]" <> wrote in message
news:#J#:

> Did someone delete the container the accounts were in on another DC before
> replication occured?
>
> --
> .rev
>
> "It is the mark of an educated man to be able to entertain a thought without
> accepting it"
> ~Aristotle
> .
> "Michael D. Alligood [CertGuard, Inc.]" <> wrote in
> message news:%23XbGF$$...
> > Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added 4
> > new user accounts with roaming profiles and mapped drives to user folders
> > on the server. All user data (My Documents) was stored on the server in
> > there user folders. Today, those 4 accounts and their respected folders
> > disappeared from the server. No trace of evidence was in the Event Viewer.
> > Nothing.
> >
> > On top of that, I could not log on to any domain account from any of the
> > computers. The error message stated that the computer account for this
> > primary domain was missing. So I logged in locally and rejoined the
> > computers to the domain.
> >
> > Any idea what in the world happened -- especially to the 4 new accounts,
> > their profiles and folders?
> >
> > --
> > Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> > The I.T. Classroom - http://www.theitclassroom.com/
> > CertGuard, Inc. - http://www.certguard.com/
> > Microsoft Exam Security Newsgroup -
> > microsoft.public.certification.exam.security
> >
> >

Nope. This is a single server environment.

--
Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
The I.T. Classroom - http://www.theitclassroom.com/
CertGuard, Inc. - http://www.certguard.com/
Microsoft Exam Security Newsgroup -
microsoft.public.certification.exam.security

Well if there are no Audit logs, no accounts and no user data maybe you only
thought you did it. Mayhbe it was a dream and then you woke up.

--
..rev

"It is the mark of an educated man to be able to entertain a thought without
accepting it"
~Aristotle
..
"Michael D. Alligood [CertGuard, Inc.]" <> wrote in
message news:%...
> "The Rev [MCT]" <> wrote in message
> news:#J#:
>
>> Did someone delete the container the accounts were in on another DC
>> before
>> replication occured?
>>
>> --
>> .rev
>>
>> "It is the mark of an educated man to be able to entertain a thought
>> without
>> accepting it"
>> ~Aristotle
>> .
>> "Michael D. Alligood [CertGuard, Inc.]" <> wrote
>> in
>> message news:%23XbGF$$...
>> > Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I
>> > added 4
>> > new user accounts with roaming profiles and mapped drives to user
>> > folders
>> > on the server. All user data (My Documents) was stored on the server in
>> > there user folders. Today, those 4 accounts and their respected folders
>> > disappeared from the server. No trace of evidence was in the Event
>> > Viewer.
>> > Nothing.
>> >
>> > On top of that, I could not log on to any domain account from any of
>> > the
>> > computers. The error message stated that the computer account for this
>> > primary domain was missing. So I logged in locally and rejoined the
>> > computers to the domain.
>> >
>> > Any idea what in the world happened -- especially to the 4 new
>> > accounts,
>> > their profiles and folders?
>> >
>> > --
>> > Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
>> > The I.T. Classroom - http://www.theitclassroom.com/
>> > CertGuard, Inc. - http://www.certguard.com/
>> > Microsoft Exam Security Newsgroup -
>> > microsoft.public.certification.exam.security
>> >
>> >
>
> Nope. This is a single server environment.
>
> --
> Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> The I.T. Classroom - http://www.theitclassroom.com/
> CertGuard, Inc. - http://www.certguard.com/
> Microsoft Exam Security Newsgroup -
> microsoft.public.certification.exam.security
>
>

"The Rev [MCT]" <> wrote in message
news::

> Well if there are no Audit logs, no accounts and no user data maybe you only
> thought you did it. Mayhbe it was a dream and then you woke up.
>
> --
> .rev
>
> "It is the mark of an educated man to be able to entertain a thought without
> accepting it"
> ~Aristotle
> .
> "Michael D. Alligood [CertGuard, Inc.]" <> wrote in
> message news:%...
> > "The Rev [MCT]" <> wrote in message
> > news:#J#:
> >
> >> Did someone delete the container the accounts were in on another DC
> >> before
> >> replication occured?
> >>
> >> --
> >> .rev
> >>
> >> "It is the mark of an educated man to be able to entertain a thought
> >> without
> >> accepting it"
> >> ~Aristotle
> >> .
> >> "Michael D. Alligood [CertGuard, Inc.]" <> wrote
> >> in
> >> message news:%23XbGF$$...
> >> > Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I
> >> > added 4
> >> > new user accounts with roaming profiles and mapped drives to user
> >> > folders
> >> > on the server. All user data (My Documents) was stored on the server in
> >> > there user folders. Today, those 4 accounts and their respected folders
> >> > disappeared from the server. No trace of evidence was in the Event
> >> > Viewer.
> >> > Nothing.
> >> >
> >> > On top of that, I could not log on to any domain account from any of
> >> > the
> >> > computers. The error message stated that the computer account for this
> >> > primary domain was missing. So I logged in locally and rejoined the
> >> > computers to the domain.
> >> >
> >> > Any idea what in the world happened -- especially to the 4 new
> >> > accounts,
> >> > their profiles and folders?
> >> >
> >> > --
> >> > Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> >> > The I.T. Classroom - http://www.theitclassroom.com/
> >> > CertGuard, Inc. - http://www.certguard.com/
> >> > Microsoft Exam Security Newsgroup -
> >> > microsoft.public.certification.exam.security
> >> >
> >> >
> >
> > Nope. This is a single server environment.
> >
> > --
> > Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> > The I.T. Classroom - http://www.theitclassroom.com/
> > CertGuard, Inc. - http://www.certguard.com/
> > Microsoft Exam Security Newsgroup -
> > microsoft.public.certification.exam.security
> >
> >

That was the first thing I said! However the 4 new users had been
operating for 3 weeks, then poof. Gone right along with their home
folders, profiles and data.

--
Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
The I.T. Classroom - http://www.theitclassroom.com/
CertGuard, Inc. - http://www.certguard.com/
Microsoft Exam Security Newsgroup -
microsoft.public.certification.exam.security

"Michael D. Alligood [CertGuard, Inc.]" <> wrote in
message news:%23XbGF$$...
> Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added 4
> new user accounts with roaming profiles and mapped drives to user folders
> on the server. All user data (My Documents) was stored on the server in
> there user folders. Today, those 4 accounts and their respected folders
> disappeared from the server. No trace of evidence was in the Event Viewer.
> Nothing.
>
> On top of that, I could not log on to any domain account from any of the
> computers. The error message stated that the computer account for this
> primary domain was missing. So I logged in locally and rejoined the
> computers to the domain.
>
> Any idea what in the world happened -- especially to the 4 new accounts,
> their profiles and folders?
>
> --
> Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> The I.T. Classroom - http://www.theitclassroom.com/
> CertGuard, Inc. - http://www.certguard.com/
> Microsoft Exam Security Newsgroup -
> microsoft.public.certification.exam.security
>
>

No mention of whether you back up data or the AD...

"The Rev [MCT]" <> wrote in message
news:...
> Well if there are no Audit logs, no accounts and no user data maybe you
> only thought you did it. Mayhbe it was a dream and then you woke up.
>

I blame the Rev's bonus.

CBIC wrote:

>
> "The Rev [MCT]" <> wrote in message
> news:...
> > Well if there are no Audit logs, no accounts and no user data maybe
> > you only thought you did it. Mayhbe it was a dream and then you
> > woke up.
> >
>
> I blame the Rev's bonus.

And Neil, of course.

--
JaR
But mostly the bonus
Remove hat to reply

who else has admin permissions to your server? are there any new admin
accounts on it?

"Michael D. Alligood [CertGuard, Inc.]" <> wrote in
message news:%23XbGF$$...
> Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added 4
> new user accounts with roaming profiles and mapped drives to user folders
> on the server. All user data (My Documents) was stored on the server in
> there user folders. Today, those 4 accounts and their respected folders
> disappeared from the server. No trace of evidence was in the Event Viewer.
> Nothing.
>
> On top of that, I could not log on to any domain account from any of the
> computers. The error message stated that the computer account for this
> primary domain was missing. So I logged in locally and rejoined the
> computers to the domain.
>
> Any idea what in the world happened -- especially to the 4 new accounts,
> their profiles and folders?
>
> --
> Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> The I.T. Classroom - http://www.theitclassroom.com/
> CertGuard, Inc. - http://www.certguard.com/
> Microsoft Exam Security Newsgroup -
> microsoft.public.certification.exam.security
>
>

"Consultant" <> wrote in message
news::

> who else has admin permissions to your server? are there any new admin
> accounts on it?
>
> "Michael D. Alligood [CertGuard, Inc.]" <> wrote in
> message news:%23XbGF$$...
> > Today, my client's Windows 2000 Server freaked out. 3 weeks ago, I added 4
> > new user accounts with roaming profiles and mapped drives to user folders
> > on the server. All user data (My Documents) was stored on the server in
> > there user folders. Today, those 4 accounts and their respected folders
> > disappeared from the server. No trace of evidence was in the Event Viewer.
> > Nothing.
> >
> > On top of that, I could not log on to any domain account from any of the
> > computers. The error message stated that the computer account for this
> > primary domain was missing. So I logged in locally and rejoined the
> > computers to the domain.
> >
> > Any idea what in the world happened -- especially to the 4 new accounts,
> > their profiles and folders?
> >
> > --
> > Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
> > The I.T. Classroom - http://www.theitclassroom.com/
> > CertGuard, Inc. - http://www.certguard.com/
> > Microsoft Exam Security Newsgroup -
> > microsoft.public.certification.exam.security
> >
> >

One admin account. 2 people know it (including myself). No new admin
accounts. To be honest, and if it were possible, it looks like someone
did a Windows XP System Restore to an earlier date! It started Saturday
around 3pm. Noticeable on Monday when everyone tried to log in. When I
got that fixed by rejoining all the computer back to the domain, I
noticed the 4 newest account (about 3 weeks old) were completely gone --
along with their profiles. Today I noticed the mirror failed. So I
imported the "foreign disk" and reactivated the mirror. I really think
it is time for another server, but just want to understand what exactly
happened.

--
Michael D. Alligood, MCITP, MCTS, MCSA, MCDST
The I.T. Classroom - http://www.theitclassroom.com/
CertGuard, Inc. - http://www.certguard.com/
Microsoft Exam Security Newsgroup -
microsoft.public.certification.exam.security