Link to home
Start Free TrialLog in
Avatar of MrFett
MrFett

asked on

Win2K Active Directory - Stubborn Redundant Child Domain

Hi all,

I am trying to delete a child domain setup in active directory (and trusted as this is done by default for AD child domains).  The problem is that the DC for the child domain died a death and wasn't needed anymore so was left.  My main domain DC is now pining for its child ALL THE TIME and is causing Netlogon errors to appear in the Event Viewer.  When I try and delete the redundant child domain from the Domains and Trusts panel, remove is greyed out, if I try and edit it in anyway, I get an error message telling me the DC for this domain (the child domain) could not be contacted.

Any ideas?

Ta

Bob
Avatar of sr75
sr75
Flag of United States of America image

It is possible.  You have to go and use a utility called ntdsutil.  Here is the MS Knowledge base article for what you want to do.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q216498&

HOW TO: Remove Data in Active Directory After an Unsuccessful Domain Controller Demotion
View products that this article applies to.
This article was previously published under Q216498
IN THIS TASK
SUMMARY
Procedure
SUMMARY
This article describes how to remove data in Active Directory after an unsuccessful domain controller demotion.

Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.

The Active Directory Installation Wizard (Dcpromo.exe) is used for promoting a server to a domain controller and for demoting a domain controller to a member server (or to a stand-alone server in a workgroup if the domain controller is the last in the domain). As part of the demotion process, the wizard removes the configuration data for the domain controller from Active Directory. This data takes the form of an NTDS Settings object that exists as a child of the server object in Active Directory Sites and Services.

The information is in the following location in Active Directory:
CN=NTDS Settings,CN=<servername>,CN=Servers,CN=<sitename>,CN=Sites,CN=Configuration,DC=<domain>...

The attributes of the NTDS Settings object include data representing how the domain controller is identified in respect to its replication partners, the naming contexts that are maintained on the machine, whether the domain controller is a global catalog server, and the default query policy. The NTDS Settings object is also a container that may have child objects that represent the domain controller's direct replication partners. This data is required for the domain controller to operate in the environment, but is retired upon demotion.

In the event that the NTDS Settings object is not removed correctly (for example, if the NTDS Settings object is not correctly removed from a demotion attempt), the administrator can use the Ntdsutil.exe utility to manually remove the NTDS Settings object. The following steps list the procedure for removing the NTDS Settings object in Active Directory for a particular domain controller. At each Ntdsutil menu, the administrator can type help for more information about the available options.

Caution The administrator must also make sure that replication has occurred since the demotion before manually removing the NTDS Settings object for any server. Using the Ntdsutil utility incorrectly may result in partial or complete loss of Active Directory functionality.

back to the top
Procedure
Click Start, point to Programs, point to Accessories, and then click Command Prompt.
At the command prompt, type ntdsutil, and then press ENTER.
Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur.
Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do so, type set creds domain nameusernamepassword and press ENTER. For a null password, type null for the password parameter.
Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server.

Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message:

Error 2094. The DSA Object cannot be deleted0x2094
Type quit, and then press ENTER. The Metadata Cleanup menu appears.
Type select operation target and press ENTER.
Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number.
Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine if the server being removed is the last domain controller of that domain.
Type list sites and press ENTER. A list of sites, each with an associated number, is displayed.
Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose.
Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed.
Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name Server (DNS) host name, and the location of the server's computer account you want to remove.
Type quit and press ENTER. The Metadata Cleanup menu appears.
Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message:

Error 8419 (0x20E3)
The DSA object could not be found
the NTDS Settings object may already be removed from Active Directory as the result of another administrator removing the NTDS Settings object, or replication of the successful removal of the object after running the DCPROMO utility.

Note You may also see this error when you try to bind to the domain controller that is going to be removed. Ntdsutil has to bind to a domain controller other than the one that is going to be removed with metadata cleanup.
Type quit at each menu to quit the Ntdsutil utility. You should receive confirmation that the connection disconnected successfully.
Remove the cname record in the _msdcs.root domain of forest zone in DNS. Assuming that DC is going to be reinstalled and re-promoted, a new NTDS Settings object is created with a new GUID and a matching cname record in DNS. You do not want the DC's that exist to use the old cname record.

As best practice you should delete the hostname and other DNS records. If the lease time that remains on Dynamic Host Configuration Protocol (DHCP) address assigned to offline server is exceeded then another client can obtain the IP address of the problem DC.
Now that the NTDS Settings object has been deleted, you can delete the computer account, the FRS member object, the cname (or Alias) record in the _msdcs container, the A (or Host) record in DNS, the trustDomain object for a deleted child domain, and the domain controller.
Use ADSIEdit to delete the computer account. To do this, follow these steps:
Start ADSIEdit.
Expand the Domain NC container.
Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
Expand OU=Domain Controllers.
Right-click CN=domain controller name, and then click Delete.
If you receive the "DSA object cannot be deleted" error when you try to delete the object, change the UserAccountControl value. To change the UserAccountControl value, right-click the domain controller in ADSIEdit, and then click Properties. Under Select a property to view, click UserAccountControl. Click Clear, change the value to 4096, and then click Set. You can now delete the object.

Note The FRS subscriber object is deleted when the computer object is deleted because it is a child of the computer account.
Use ADSIEdit to delete the FRS member object. To do this, follow these steps:
Start ADSIEdit.
Expand the Domain NC container.
Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
Expand CN=System.
Expand CN=File Replication Service.
Expand CN=Domain System Volume (SYSVOL share).
Right-click the domain controller you are removing, and then click Delete.
In the DNS console, use the DNS MMC to delete the A record in DNS. The A record is also known as the Host record. To delete the A record, right-click the A record, and then click Delete. Also delete the cname (also known as the Alias) record in the _msdcs container. To do so, expand the _msdcs container, right-click the cname, and then click Delete.

Important If this was a DNS server, remove the reference to this DC under the Name Servers tab. To do this, in the DNS console, click the domain name under Forward Lookup Zones, and then remove this server from the Name Servers tab.

Note If you have reverse lookup zones, also remove the server from these zones.
If the deleted computer was the last domain controller in a child domain and the child domain was also deleted, use ADSIEdit to delete the trustDomain object for the child. To do this, follow these steps:
Start ADSIEdit.
Expand the Domain NC container.
Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.
Expand CN=System.
Right-click the Trust Domain object, and then click Delete.
Use Active Directory Sites and Services to remove the domain controller. To do this, follow these steps:
Start Active Directory Sites and Services.
Expand Sites.
Expand the server's site. The default site is Default-First-Site-Name.
Expand Server.
Right-click the domain controller, and then click Delete.
Also here is another article that I think will be easier:

http://www.jsiinc.com/SUBJ/tip4900/rh4984.htm

4984 » How do I remove a domain controller from Active Directory after an unsuccessful demotion?



Microsoft Knowledge Base article Q216498 contains:

This article describes how to remove data in the Active Directory after an unsuccessful domain controller demotion.



MORE INFORMATION
WARNING : If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client and incorrectly modify the attributes of Active Directory objects, you can cause serious problems that may require you to reinstall Microsoft Windows 2000 Server and/or Microsoft Exchange 2000 Server. Microsoft cannot guarantee that problems resulting from the incorrect modification of Active Directory object attributes can be solved. Modify these attributes at your own risk.

The DCPROMO (Dcpromo.exe) utility is used for promoting a server to a domain controller and demoting a domain controller to a member server (or to a standalone server in a workgroup if the domain controller is the last in the domain). As part of the demotion process, the DCPROMO utility removes the configuration data for the domain controller from the Active Directory. This data takes the form of an "NTDS Settings" object, which exists as a child to the server object in the Active Directory Sites and Services Manager .

The information is in the following location in the Active Directory:

CN=NTDS Settings,CN=<servername>,CN=Servers,CN=<sitename>,CN=Sites,CN=Configuration,DC=<domain>...

The attributes of the NTDS Settings object include data representing how the domain controller is identified in respect to its replication partners, the naming contexts that are maintained on the machine, whether or not the domain controller is a Global Catalog server, and the default query policy. The NTDS Settings object is also a container that may have child objects that represent the domain controller's direct replication partners. This data is required for the domain controller to operate within the environment, but is retired upon demotion.

In the event that the NTDS Settings object is not removed properly (for example, the NTDS Settings object is not properly removed from a demotion attempt), the administrator can use the Ntdsutil.exe utility to manually remove the NTDS Settings object. The following steps list the procedure for removing the NTDS Settings object in the Active Directory for a given domain controller. At each NTDSUTIL menu, the administrator can type help for more information about the available options.

CAUTION : The administrator should also check that replication has occurred since the demotion before manually removing the NTDS Settings object for any server. Using the NTDSUTIL utility improperly can result in partial or complete loss of Active Directory functionality.

Click Start , point to Programs , point to Accessories , and then click Command Prompt .


At the command prompt, type ntdsutil .


Type metadata cleanup , and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters need to be specified before the removal can occur.


Type connections and press ENTER. This menu is used to connect to the specific server on which the changes occur. If the currently logged on user does not have administrative permissions, alternate credentials can be supplied by specifying the credentials to use before making the connection. To do so, type set creds domain name username password and press ENTER. For a null password, type null for the password parameter.


Type connect to server servername , and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server.

NOTE : If you attempt to connect to the same server that you want to delete, when you attempt to delete the server referred to in step 15, you may receive the following error message:


Error 2094. The DSA Object cannot be deleted0x2094
Type quit and press ENTER. The Metadata Cleanup menu is displayed.


Type select operation target and press ENTER.


Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number.


Type select domain number and press ENTER, where number is the number associated with the domain to which the server you are removing is a member. The domain you select is used to determine if the server being removed is the last domain controller of that domain.


Type list sites and press ENTER. A list of sites, each with an associated number, is displayed.


Type select site number and press ENTER, where number is the number associated with the site to which the server you are removing is a member. You should receive a confirmation listing the site and domain you chose.


Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed.


Type select server number , where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name Server (DNS) host name, and the location of the server's computer account you want to remove.


Type quit and press ENTER. The Metadata Cleanup menu is displayed.


Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message:
Error 8419 (0x20E3)
The DSA object could not be found
the NTDS Settings object may already be removed from the Active Directory as the result of another administrator removing the NTDS Settings object, or replication of the successful removal of the object after running the DCPROMO utility.

NOTE : You may also see this error when you attempt to bind to the domain controller that is going to be removed. Ntdsutil needs to bind to a domain controller other than the one that is going to be removed with metadata cleanup.


Type quit at each menu to quit the NTDSUTIL utility. You should receive confirmation that the connection disconnected successfully.


Remove the cname record in the _msdcs. root domain of forest zone in DNS. Assuming that DC is going to be reinstalled and re-promoted, a new NTDS settings object is created with a new globally unique identifier (GUID) and a matching cname record in DNS. You do not want the DC's that exist to use the old cname record.

As best practice you should delete the hostname and other DNS records. If the lease time that remains on Dynamic Host Configuration Protocol (DHCP) address assigned to offline server is exceeded then another client can obtain the IP address of the problem DC.


Now that the NTDS setting object has been deleted we can now delete the following objects:
Use ADSIEdit to delete the computer account in the OU=Domain Controllers,DC=domain...

NOTE : The FRS subscriber object is deleted when the computer object is deleted, since it is a child of the computer account.


Use ADSIEdit to delete the FRS member object in CN=Domain System Volume (SYSVOL share),CN=file replication service,CN=system....


In the DNS console, use the DNS MMC to delete the cname (also known as the Alias) record in the _msdcs container.


In the DNS console, use the DNS MMC to delete the A (also known as the Host) record in DNS.


If the deleted computer was the last domain controller in a child domain and the child domain was also deleted, use ADSIEdit to delete the trustDomain object for the child in CN=System, DC=domain, DC=domain, Domain NC.
Avatar of MrFett
MrFett

ASKER

Hi Sr75,

Thanks for your help with this - the Microsoft articles both suggest that these are incredibly risky procedures and seem to me more aimed at Domain Controllers (rather than Domains).  I was wondering if it might be simpler for me to create a new domain controller for the child domain I am try to delete, then remove the domain from the active directory 'Domains and Trusts' as the reason (I think) I cannot remove the domian at the moment is because it cannot contact ANY domain controller for the child domain.

What do you think?

Thanks for this

Bob
ASKER CERTIFIED SOLUTION
Avatar of sr75
sr75
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of MrFett

ASKER

Hi SR75

Thanks for all your help with this, I've accepted your last suggestion as the answer (as you addressed the only query I had in it).

Wish me luck!

Kind regards

Bob McKay