A small development environment has two Active Directory domain controllers. One rebooted during patch installation about three weeks ago and has remained in Safe Mode unnoticed. The other domain controller received the same patch without any apparent problems. The affected server is protected by Veeam, and I'm unsure whether the Safe Mode setting came from the patch, Veeam's application-aware AD processing, or both.
Because it has been in Safe Mode, it has not replicated with the other domain controller for roughly three weeks. Before clearing the Safe Mode boot setting and restarting it, is there anything important I should check or watch for? This is a low-risk development system, but I'd like to handle it as carefully as I would in production and document the process. The environment has only a small number of users and computer accounts and is not regularly refreshed from production.
2 Answers
Before rebooting, confirm why it is entering Safe Mode. Check the boot configuration with bcdedit, review recent patch and system logs, and verify whether the backup software or a recovery workflow set a persistent Safe Mode option. After the reboot, confirm that the Netlogon, DFS Replication, and Active Directory Domain Services services are running, then verify inbound and outbound replication and DNS health. If the Safe Mode setting returns, stop and investigate the patch or backup integration rather than repeatedly forcing normal boots.
Three weeks is well below the usual 180-day tombstone lifetime, so the DC should normally be able to boot normally and resume replication. Clear the Safe Mode boot setting, restart it, and then check Directory Services and replication health with tools such as dcdiag and repadmin. Since this is a lightly used development domain, any replication convergence should be straightforward. If it cannot boot normally or replication fails, a non-authoritative restore or rebuilding the DC would be reasonable next steps.
If you restore it, make sure the restore is non-authoritative so the healthy domain controller supplies the current directory data.