How-To: Demote a DC or manually remove a DC

Caution: Using the ntdsutil or adsiedit incorrectly may result in partial or complete loss of Active Directory functionality!

Pre-demotion check list

1. Verify that the DC is not the only GC (global catalog) server and does not hold a FSMO (operations master role)

2. Verify that the DC is not the only DC in the domain

3. Verify proper replication is happening

4. Check event logs for errors and troubleshoot accordingly

Demote DC – CLEAN

1. Run dcpromo and follow the wizard

2. Let some AD replicate then check AD and DNS to confirm DC was properly removed (see “FORCED” removal for areas to check)

Demote DC – FORCED (W2K3SP1 or later – assuming the clean method has failed for some reason)

1. Force demote by running “dcpromo /forceremoval” – this will remove the DC without contacting the other domain controllers – it will also put the DC into workgroup mode (will remove it from the domain)

2. Clean up AD

a. From a good DC, run ntdsutil

b. Type metadata cleanup

c. Type connections

d. Type connect to server <servername> #this server should be GC

e. Type q

f. Type select operation target

g. Type list domains

h. Type select domain <number>

i. Type list sites

j. Type select site <number>

k. Type list servers in site

l. Type select server <number> #the bad server number you want to remove

m. Type q

n. Type remove selected server (if you get error 8419 “the dsa object could not be found”, the object was already removed)

o. Type q until exited

3. Delete the computer account

a. Delete the computer object in AD

b. Check ADSIEdit to confirm removal

i. Run ADSIEdit.

ii. Expand the Domain NC container

iii. Expand DC=<domain>, DC=<name>

iv. Expand OU=Domain Controllers.

v. Right-click CN= then click delete (you may have to delete child objects to remove the server object)

4. FRS member object (FRS subscriber object should already be deleted with computer object)

a. Check ADSIEdit to confirm removal

i. Run ADSIEdit.

ii. Expand the Domain NC container

iii. Expand DC=<domain>, DC=<name>

iv. Expand CN=System

v. Expand CN=File Replication Service

vi. Expand CN=Domain System Volume (SYSVOL share)

vii. Right-click the domain controller you are removing then click delete

5. Clean up DNS

a. Remove the cname record in the _msdcs.root domain of forest zone in DNS

b. Delete the host name and other DNS records associated with the server (include reverse pointer records)

c. If this was also a DNS server, remove the reference to this DC under the DNS servers Name Servers tab

6. If the deleted computer is the last domain controller in a child domain, and the child domain was also deleted, use ADSIEdit to delete the trustDomain object for the child (not detailed here)

7. Delete the DC from Active Directory Sites and Services > Sites