Hello,

If you ever need to start a Domain Controller in Directory Service Restore Mode, you know the pain to find the appropriate password. When the DC is up and running, you can reset this password pretty easily with ntdsutil.exe. Managing it by hand is error prone and so not offer any benefits, so let’s make a GPO !

Synchronize DSRM Password with a Domain Account

Step 1 : Create an AD user to sync password from :

That’s it, now we need to tell the Domain Controllers to pull the password from this account, and set it as their DSRM password.

Step 2 : Create a GPO :

Create a GPO and link it to the Domain Controller OU :

Name it :

Edit it :

Add a schedule task :

Fill in the blanks :

The important part is the “Arguments” box :

“SET DSRM PASSWORD” “SYNC FROM DOMAIN ACCOUNT DsrmAdmin” Q Q

Choose a schedule, you want to ensure that your DC will be up, and not under pressure :

Your GPO is ready for use !

Step 3 (Optional) :

If you’re in a hurry and on a recent operating system (>2012 for the management console, >2008 for the DC), you can force a remote GpUpdate :

Then, in the next 15 minutes, all of your Domain Controllers will refresh their GPO.