Recover SBS 2011 from USN Journal Rollback state RRS feed

  • Question

  • Hi,

    I was unfortunately forced to use Veeam B&R with NON-Application Aware backup to roll-back entire SBS 2011 server to restore functionality. This brought SBS 2011 into USN Journal Rollback state 0x4, so now I have the following situation:

    • SBS 2011 with Exchange into USB Rollback 0x4 state, with NETLOGON service Paused
    • and 2 additional DCs in the same domain. Those replicate between each other just fine

    Maybe important thing is, that since that happened (yesterday), there has been actually NO SIGNIFICANT CHANGES to AD objects made since we did rollback. No passwords changed, no GPOs changed, no new users....just regular users logins/logouts and Exchange mail usage during the business day.

    So, SBS is now stuck and does not allow USN Journal any changes. I've gone through quite some tech articles, and they suggest DEMOTING problematic DC from domain, which I think in my case is not an option (it's SBS with Exchange...if SBS in some scenario would be possible to demote, it probably would broke). Secondly, they suggest restoring only System State...but unfortunately no other backup is healthy, only Veeam with non-app-aware state. As 3rd solution articles suggest to demote all other DCs and dcpormo them back.

    But all this seems too intrusive to me.

    Why I cannot simply do authoritative DC restore, burflags, restore SYSVOL and voila, wouldn't it be up and running?

    Only one article I found suggested this:

    1.     Check for USN rollback by using the command Repadmin /showutdvec (KB Article: 875495, 885875)

    2.     Check the Registry value "HKLM\System\CurrentControlSet\Services\NTDS\Parameters, "DSA Not Writable" (REG_DWORD) and its value is 0x4.
    Both (1) and (2) are confirmed, state in REG is 0x4, and NETLOGON service paused

    3.     Delete "DSA Not Writable" (REG_DWORD) from registry and reboot the server.
    Hmmm...this looks logical to me. What do you think? Is this my easy solution?


    Thursday, April 11, 2019 7:48 PM