Removing a Failed DC from Active Directory

Removing a Failed DC from Active Directory

Hardware fails, hopefully not often, but what do you do if one of your DC's dies? Well it is easy enough to replace the server, reinstall the OS and promote it to a DC, but what about the old DC? Well it will have to be removed from Active Directory and it will have to be done manually, but have no fear, its not that difficult! But first a warning!  

Caution : The administrator must also make sure that replication has occurred since the failure before manually removing the NTDS Settings object for any server. Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

With that out of the way you will need two tools to perform this, ntdsutil which is included in the OS and ADSIEdit.msc which is part of the Support Tools package. We will start with ntdsutil, so open up a command prompt and type the following ntdsutil: metadata cleanup: connections server connections: connect to server {servername of an   existing  DC server connections:quit metadata cleanup: select operation target select operation target: list domains select operation target: select domain {domain number select operation target: list sites select operation target: select site {site number} select operation target: list servers in site select operation target: select server {server number of DC to be   removed  select operation target: quit metadata cleanup: remove selected server At this point you will receive a warning message, ensure you have selected the correct server and then select yes to have the server removed. At this time the server will be removed, once complete type quit to leave metadata cleanup and type quit again to exit ntdsutil.

 

Once you have deleted the DC, there are a few things to check to make sure it is gone completely. Open up the DNS Management MMC and verify the DNS records have been deleted, if not delete them. From a command prompt run ADSIEdit.msc. Expand the Domain [DC.domain.com] container and drill down to DC=Domain, DC=COM and then expand the OU=Domain Controllers folder. If an entry exists for the old DC, delete it. Go back up the tree to the Domain [DC.domain.com] container, and then locate the CN=System folder, expand CN=File Replication Service and then expand CN=Domain System Volume (SYSVOL) and if the old DC is still listed here, delete it.

Open up Active Directory Users and Computers and drill down to the Domain Controllers OU, if the old DC computer record still exists, delete it from here. Finally open up Active Directory Sites and Services and drill down to Sites | Default First Site Name | Servers and delete the record for the old DC if one still exists