Deleted "Managed Service Accounts" Container

Question

Unaware that the container was created as part of our 2008 R2 AD Upgrade I deleted this container (thinking that another admin was doubling up efforts) on a pre-existing "Service Accounts" OU that was created in the past.   While doing some
research months later, I was looking for a better way to deploy service accounts and ran across this new container.  I looked for various ways of recovering this including:
ldp
adrestore
browsing for the object via adexplorer.exe
I'm unable to see the object so I think my next option is to either recreate it via some sort of script or some form of re installation.    This is a highly utilized production environment therefore I'm looking for the least invasive way of
approaching this.  If it is going to be a huge hassle we'll continue down the road of the specific OU already designated and continue using policies to limit thier access to the systems.
Thanks in advance!
Kyle

Answer 1

Delete the following container as well: d262aae8-41f7-48ed-9f-35-56-bb-b6-77-57-3d
As the operations for the "Managed Service Accounts" container preformed by adprep is as shown below. (if this dosen't help, e.g. adprep still dosen't try to re-run the operation, remove the value of the revision attribute for the CN=ActiveDirectoryUpdate,CN=DomainUpdates,CN=System,DC=ForestRootDomain
- it should be '5' now)
Operation 75: {5e1574f6-55df-493e-a6-71-aa-ef-fc-a6-a1-00}
Create the following object:
• CN=Managed Service Accounts
Attributes:
• objectClass: Container
• Description: Default container for managed services accounts
• ShowInAdvancedViewOnly: FALSE
Permissions:
• (A;;RPWPCRCCDCLCLORCWOWDSDDTSW;;;SY)
• (A;;RPWPCRCCDCLCLORCWOWDSW;;;DA)
• (OA;;CCDC;ce206244-5827-4a86-ba1c-1c0c386c1b64;;AO)
• OA;;CCDC;bf967aba-0de6-11d0-a285-00aa003049e2;;AO)
• (OA;;CCDC;bf967a9c-0de6-11d0-a285-00aa003049e2;;AO)
• (A;;RPLCLORC;;;AU)
Operation 76: {d262aae8-41f7-48ed-9f-35-56-bb-b6-77-57-3d}
Add the following value to the multivalued attribute otherWellKnownObject of the domain directory partition:
• B:32:1EB93889E40C45DF9F0C64D23BBB6237:CN=Managed Service Accounts,<distinguished name of the domain>
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog