Changing computer name of a domain controller

As I recall you cannot change the name of such a computer without re-installing W2K.

http://support.microsoft.com/support/kb/articles/Q195/2/42.ASP

Damn, really? I had previously read the article to which you point, but I didn't understand it that way, and I found it not very informative. Hence my question here.

One of the problem it causes is that I get a "Duplicate name exists on the network" error and the server ends up unavailable on the network.

I'm not sure I can explain why but I do know that you cannot change the name of a PDC server.  Promote one of your backup server to the primary and then re-install Windows to this one.

We're talking about W2k, so there's no PDC-BDC.

If your server is a DC, run dcpromo on another W2k Server, move all the FSMO-roles to the new DC (if it holds any - I don't know, how many DCs are involved and which one was the first one), run dcpromo on WWW to demote it to a member server and rename it. Now you can run dcpromo again to make it a DC.

If there are already other DCs, you only have to make sure, that the FSMO-roles reside on other servers before you demote WWW.

Please not so fast: I'm not a professional sys admin and I am in charge of our three servers because the previous sys admin left while we couldn't hire a real one. I've had to learn a lot, especially because our network was left in a pretty sorry state, but there are things I am still not familiar with, most of them involving Win2k in several of its aspects.

So I'd like to know what exactly are FSMO-roles, why move them to another DC, and what happens if I don't do that (i.e. if I juste demote, rename and promote back).

Thanks a lot.

JFSmith,

1. Click Start, point to Settings, click Control Panel, and then double-click System.
 
2. On the Network Identification tab, click Advanced.
 
3. If you want to change the computer name, type the new name you want in the New Computer Name box. If not, continue to the next step.
 
4. If you want to change the domain name, type the new domain name in the Domain box. If not, continue to the next step.
 
5. If you want to change the name of the DNS domain name, click More, and then type the name of the DNS domain in the "DNS domain name of this computer" box. If not, continue to the next step.
 
NOTE: When you select the "Change DNS domain name when domain membership changes"
check box, DNS domain name changes when you change to a new domain, but does not
change if you change to use a workgroup.

6. Click OK.

Dennis

Thanks a lot Dew Associates, but I wish it would be that easy. It isn't, and you should read again my first post aove. The button, which is titled Properties and not Advanced, is disabled. Right under it, there is the following message: "The identification of the computer cannot be changed because: the computer is a domain controller". What you tell me to do works only on a workstation, as far as I know.

Well JFS, here's the supporting MSKB Article:

PSS ID Number: Q232007
Article last modified on 01-02-2000
WINDOWS:2000
===========================================================
--------------------------------------------------------
The information in this article applies to:

- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Datacenter Server

JfSmith,

Are these options grayed out because you are not logged in with appropriate permissions? Are you logging in as Domain Admin?

Just a thought.

JC

I was just wondering the same thing JC!

Yes, I am logged as domain admin. :-) The note under the disabled button (which I mentioned above) is clear enough, I think...

Start checking with the registry to see if the properties button has been disabled by your predecessor.

According to the knowledgebase article mentioned by jhance the button is grayed out, because the computer is a DC - you simply cannot change anything in Network Identification on a DC, so you have to demote it, then you can rename it and - if you want - promote it again.

As of FSMO roles: this acronym stands for Flexible Single Master Operations. There are 5 of them and only one computer can hold each of this roles (some per domain, some per forest):
PDC-Emulator
Domain Naming Master
Infrastructure Master
Schema Master (forest)
RID (Relative IDentifier) Master

According to http://support.microsoft.com/support/kb/articles/Q223/7/87.ASP I was wrong: you don't need to move them manually, whenever a DC is demoted and it holds any of the FSMO roles, they are moved to another DC automaically.

To learn more about FSMO roles, check http://support.microsoft.com/support/kb/articles/Q197/1/32.ASP

schmiegu, what application does FSMO have to this situation?

Ditto with dew's question! :)

1. As I already admitted in my previous post, I was wrong, that you have to care about them, if you demote a DC
2. JfSmith asked about them after I mentioned them, so I provided some information (and a link) about FSMOs
3. I already had written a part of this comment as I detected, that I was mistaken - I just didn't like to delete this.

Okay, well, thanks a lot schmiegu. I just wanted to be sure I won't do something I shouldn't.

JFS, although some personal opinions state that you can't do as I suggested earlier as per MS's MSKB article, and that possibly there is a reg entry that's making it (the choice0 unavailable, I've yet to see anyone provide an article that says otherwise. Since you inherited this server, it's possible that your predecessor made some edits you're unaware of.

Again, you cannot change this name.  It is indeed stored in the registry but it in the SAM portion.  That part of the registry is normally invisible but even if you did use one of the tricks to view or edit it the change would not work.  You'll destroy the "DC"-ness of this server and you'll end up re-installing W2K anyway.

Dew, I will consider your point and check carefully. I'd need help though to find the right reg entry.

But I tend to think that the text written right under the disabled button ("The identification of the computer cannot be changed because: the computer is a domain controller") is more likely a correct explanation than some edits I'm unaware of. Why would have my predecessor done that in the first place?

JFS, I'll look through my MS material and find the procure, this obviously cannot me unique to you. Now, why would your predecessor do this, presuming he/she were able, that's a heck of a question that I've been trying to understand for years!

Do I have to reconfigure user accounts if I do that?

If you have a second DC, this will hold the whole AD. So you can demote the server, rename it and promote it again - nothing will be lost.
If it's the only DC, you should first promote another server to DC. Don't demote the DC if you haven't another one - your domain will be lost and you have to start from the scratch.

I agree with schmiegu on that comment!

Okay. Thank you all for the help. I have a second DC. I'll do that soon, after calling a few people (there's an insitutional network here, I don't control everything).

I'll update here again when it's done.

Okay JFS!

Sorry for the long delay. The problem is now solved, I did what you told me to (demote, change, promote back). Thanks all!