What's going on with the domain?

Question

Windows Server

Please help me with another problem. Something happened to the domain server (aka DNS server, aka DHCP server). There are literally some glitches with it - errors of entering network shares are pouring in, I tried to remove one machine from the domain, when I add it back I get an error - the network path was not found. Can you tell me what to check first? Desirable in detail.

UPD
It turned out that the CD was infected with some rubbish. After treatment with Cureit, it did not get better, but in addition, the ability to connect to it via RDP disappeared. The picture is similar on other computers infected with the same rubbish. Where to dig now and what to repair is an open question ...

Answer 1

Windows Logs (System, Security)

Answer 2

Where to dig and what to fix - I would simply re-create the domain, enter still uninfected machines into the new domain, and turn off the old CD and erase it if it is a VM. And on the new CD, at least I would set a policy that prohibits SMB1 for the server, especially if it's 2008R2 - most likely, a worm came through SMB1. If this is not possible, deploy another CD, enter dcpromo into the domain, transfer roles, then stop the broken CD and check if the domain is working. If yes, OK, otherwise fix the replication and then still kill the instance eaten by the virus.