Recovery Guide

Reintroduce a rebuilt domain controller without repeating stale metadata or SYSVOL issues.

This page is for the period after a DC rebuild looks successful on paper, but the team still needs to prove the controller is cleanly reintroduced, replicating correctly, and not carrying forward the same conditions that forced the rebuild.

Search DC RecoveryOpen AD Domain
Situation

A rebuilt DC is not finished when promotion completes.

Directory health depends on clean metadata, functional replication, SYSVOL state, DNS correctness, and valid time posture. Rebuilds fail operationally when teams stop at promotion success and skip the follow-through.

What To Verify

Prove the replacement controller is healthy in context.

  • Confirm old metadata was cleaned up before or during replacement.
  • Validate replication inbound and outbound across all required naming contexts.
  • Check SYSVOL/DFSR state and policy/file availability from clients.
  • Verify DNS registration and DC locator behavior for the rebuilt node.
  • Confirm time source and Kerberos behavior match the intended role.
Working Sequence

Reintroduce deliberately.

  • Validate health from existing peers before directing clients toward the rebuilt DC.
  • Retest policy and authentication from a client that will actually use that controller.
  • Watch replication and SYSVOL over time, not just immediately after promotion.
  • Only then return the rebuilt node to normal service expectations.