Domain controller fail

[Valentin17]

My DC based on Ubuntu Server 16.04. has failed. I now that I can not create new users, change passwords etc.

But my question is this. Would PCs that are members of that domain be able to login to their PCs for unlimited time (days, months)?

I pointed my DHCP server to old DNS server and everything is working without any problems.

 

Would there be any surprises in the future?

 

Thank you very much for all your help.

[thevictor390]

If anybody besides you is using this domain, you will be surprised how often people forget their password. "In theory" you can keep logging in indefinitely (if the passwords did not have expiration) in practice it just takes one unexpected event to bring your whole operation down.

[Valentin17]

20 minutes ago, thevictor390 said:

If anybody besides you is using this domain, you will be surprised how often people forget their password. "In theory" you can keep logging in indefinitely (if the passwords did not have expiration) in practice it just takes one unexpected event to bring your whole operation down.

I am a domain admin, my passwords for all accounts are stored in a secure place.

What do you mean by this "practice it just takes one unexpected event to bring your whole operation down"? Any example.

Thanks.

[thevictor390]

3 minutes ago, Valentin17 said:

I am a domain admin, my passwords for all accounts are stored in a secure place.

What do you mean by this "practice it just takes one unexpected event to bring your whole operation down"? Any example.

Thanks.

Windows could just one day decide to start telling you "we can't sign you in with this credential because your domain isn't available" or "The trust relationship between this workstation and the primary domain failed" or whatever other random common error you get with domains, and you won't have a way to resolve it.

[Valentin17]

7 minutes ago, thevictor390 said:

Windows could just one day decide to start telling you "we can't sign you in with this credential because your domain isn't available" or "The trust relationship between this workstation and the primary domain failed" or whatever other random common error you get with domains, and you won't have a way to resolve it.

I was afraid of this. That's what I meant when I asked for advice.

What could i do at this point with my PCs? Can i leave a domain without a DC?

[thevictor390]

2 minutes ago, Valentin17 said:

I was afraid of this. That's what I meant when I asked for advice.

It might continue to work for a long time, but personally, I would be afraid of something like this happening.

[Egon3]

Are your PCs Windows clients? Typically Windows will keep AD user credentials cached indefinitely by default, unless you defined a limit in GPO/registry. However, I have had experiences in the past where a Windows Update would wipe out the cached creds and the user will have to connect back to the domain network to log in and cache again. I've seen it happen many times (I used to support WFH users at a large org that didn't yet have a cloud presence for WFH users).

 

You can remove a PC from a domain while inaccessible. Just go into system preferences and set yourself back to a workgroup. It may prompt for credentials but you can just put in anything since it won't actually authenticate against anything.

 

If your PCs are Ubuntu clients, then I apologize I don't have much working experience in that scenario.

[Valentin17]

10 hours ago, Egon3 said:

Are your PCs Windows clients? Typically Windows will keep AD user credentials cached indefinitely by default, unless you defined a limit in GPO/registry. However, I have had experiences in the past where a Windows Update would wipe out the cached creds and the user will have to connect back to the domain network to log in and cache again. I've seen it happen many times (I used to support WFH users at a large org that didn't yet have a cloud presence for WFH users).

 

You can remove a PC from a domain while inaccessible. Just go into system preferences and set yourself back to a workgroup. It may prompt for credentials but you can just put in anything since it won't actually authenticate against anything.

 

If your PCs are Ubuntu clients, then I apologize I don't have much working experience in that scenario.

My PCs are all Windows 10. Thanks.