Windows 2008 R2 host running Hyper-V. I meant to run "sysprep /audit /reboot" on one of the virtual machines, but ended up running that on the host (doing this through 2 layers of RDP - bad idea). The server was one of two domain controllers, but thankfully not in production yet. The second controller is fine, I shut it down to prevent any additional replication.
I know that audit mode can be disabled by removing a registry key, but the question is what is the state of the server? Can it come back up as an AD member or does it need to be reinstalled?
Running "sysprep /generalize" would be the end of the machine, but what happens without that flag? What was changed, what was lost?
Don't have system state backups. This was a new sever I've been configuring for the past few weeks.
I'd still like to know if the server could have been recovered in theory, but at this point I decided to backup as much as I can and reinstall the OS. Seems like the safer thing to do.