Please help; I have no idea what to do an I know it’s DNS

So, I‘m part of a small MSP and I had a client call about phone (voip) issues. I go out and checked the one AD/DNS server and see it says it’s unlicensed, troubleshooter doesn’t work and can’t change key; I get it working finally giving Network service access to some registry folders. I keep looking for phone issues and see that the dns forwarders are wrong in DNS so I correct them. I'm looking at firewall traffic and QOS and everything coming back good so I head out.

I get a call that users can’t reach internet so I hop in again. Server nslookup; has no idea who the server is. GPO couldn’t open; says can’t find domain. Same for AD trusts. DNS server is not starting giving error 1067 saying its looking for 127.0.0.1 (tried setting 127.0.0.1 or the internal IP of the server for server DNS) for the interface (the servers internal IPv4 was checked in interfaces when I could last see it) in event view and to change it in DNS server manager but I can’t open that. I tried to remove the DNS service from the server after reconfiguring ISP DNS to the firewall dhcp scope for internal (firewall handles dhcp but server does/did dns) but that also errors about windows remote management service (again network service account staple) isn't started.

I keep running into the same thing time and time again; it’s like the network service is being restricted as I keep getting access denied or services that depend on it aren’t working. The only other thing I have a theory about is SentinelOne was deployed to this server but it’s not in the portal. On 10/3 in the logs; I see this device was pushed a decommission automatically at 8pm when we aren’t working. When I check the server, it has sentinelone installed but I can’t remove it because it just loops.

I’m thinking SentinelOne hosed my server because the network service user seems to be highly restricted and SentinelOne has only been in play for about 3 months. I’m going to start with a cleanup of it with support when I get in tomorrow. Has anyone seen this before and any idea what to do about my DNS/Server problem? I’m really at the end of my rope and not sure what to do except a disaster recovery with my backup vendor and then move over data; but sentinelone will still be on the backup and not in the portal for removal so I’m still stuck I bet.