Isolate a DC - Part 4: Reset DSRM Password

This is Part 4 of a multi part blog post on Domain Recovery and DC Isolation with the aid of Powershell in todays installment we learn that Directory Services Restore Mode (DSRM) is not actually needed to perform a full forest recovery.

Reset DSRM Password

Another typically unnecessary step is getting your hands on your DSRM password - if you don’t already have it. DSRM password is only used in DSRM mode, which you don’t need for this fun exercise, but why not have it just in case!

Now this step is not really Powershell, and not really automated, if you wanted to do the later you could probably create an account, set its password, and then sync the password to the DSRM Administrator account, but I wasn’t feeling that energetic this morning. So just type your password a couple of times and be done with it.

function Reset-DSRMPassword (){
    Write-verbose "Calling NTDSUtil to reset the DSRM password on the local server"
    ntdsutil "set DSRM Password" "Reset Password on Server NULL" q q
}

Reset-DSRMPassword

All the other parts of this series are available here