Help! Every User Account Disabled

[OhSnapWord]

I have a client with an Active Directory Domain Controller. It seems that somebody has gained unauthorized access and disabled every single user account. There is no way to log into the domain. The system is Windows Server 2008 R2. Any help will be greatly appreciated.

 

[iPwn]

You need to log on to the Domain Controller with the local admin account. (enter ".\" in the username to designate local) Then, perform an authoritative restore (assuming replication) as you don't know if those were the only changes made.

Edit: Not knowing your experience level here; there are two ways to do this.

1. Console access inside the server room. (use ".\administrator" to logon)

2. Connect a PC to the local network and open an RDP session with the DC. If the DC supports pre-authentication and you get a login screen before seeing a full blown login window, then specify the account name as "host\user", or "DC1\administrator".

If the DC does not use pre-auth, then simply use ".\administrator" once you are connected to the DC and see the full blown screen with logon.

As far as enabling accounts:

You could do this through the command line using dsmod. Open a command prompt and type:

dsmod user "OU=[B]sparta[/B],DC=[B]sparta[/B],DC=[B]local[/B]" -disabled no

Notes:
OU= this is the root level OU
DC= this is the domain name. You have to put each part as a separate DC= so the above is for a domain of sparta.local

 

[OhSnapWord]

I managed to change the admin password and got in. Thanks for the info.