[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 687
  • Last Modified:

Only domain controller in child domain crashed

I have a small child domain with one domain controller.  The hard drive has failed with an electrical error and cannot be saved.  The domain is no longer valid and the server is non-existant.  My question is "how do I remove the orphaned domain"?  I have tried using ntdsutil and running metadata cleanup but since a server cannot be contacted it will not select the domain for deletion.  The domain shows up when I "list domains" in the "select operation target" but cannot be selected.  Is there another way?

NFCC
0
NFCC
Asked:
NFCC
  • 5
  • 4
1 Solution
 
Chris DentPowerShell DeveloperCommented:

You need to delete the server from the site first, that should be possible even with an uncontactable domain.

So start with this article (which you may have already done):

http://support.microsoft.com/default.aspx?scid=kb;en-us;216498

Then once you've done that bit the old domain can be deleted using this one:

http://support.microsoft.com/default.aspx?scid=kb;en-us;216498

I've used the combination of those too articles to remove dead domains from a forest here so it should let you select the right parts.

Chris
0
 
Chris DentPowerShell DeveloperCommented:

Sorry, the second link should have been:

http://support.microsoft.com/?kbid=251307

Bit of an odd moment with copy and paste there.

Chris
0
 
bbaoIT ConsultantCommented:
NT4 or W2K's domain?
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
NFCCAuthor Commented:
This is a W2K3 subdomain.
0
 
NFCCAuthor Commented:
Chris

After following article 216498 I try to do the metadata cleanup but with no success.  When I get to the point to "select domain number" I get the following response:  No Current Server and No Current Naming Context.

Jeff
0
 
Chris DentPowerShell DeveloperCommented:

What  are you typing in to do the command? No current server implies you're not connected to anything useful in order to perform the command. Did you go through the Connections bit?

Related... 251307 should really have been this one: http://support.microsoft.com/kb/230306/EN-US/ which is linked from the 251307 article anyway, but saves a click. That one shows you how to remove the domain itself.

Chris
0
 
NFCCAuthor Commented:
These are the steps I'm following.  The problem is at step 9 and here is what I get:

select operation target: select domain 2
No current site
Domain - DC=GreenIndustries,DC=nfcc,DC=cc
No current server
No current Naming Context
select operation target:

1. Click Start, point to Programs, point to Accessories, and then click Command Prompt.
2. At the command prompt, type ntdsutil, and then press ENTER.
3. Type metadata cleanup, and then press ENTER. Based on the options given, the administrator can perform the removal, but additional configuration parameters must be specified before the removal can occur.
4. Type connections and press ENTER. This menu is used to connect to the specific server where the changes occur. If the currently logged on user does not have administrative permissions, different credentials can be supplied by specifying the credentials to use before making the connection. To do this, type set creds DomainNameUserNamePassword, and then press ENTER. For a null password, type null for the password parameter.
5. Type connect to server servername, and then press ENTER. You should receive confirmation that the connection is successfully established. If an error occurs, verify that the domain controller being used in the connection is available and the credentials you supplied have administrative permissions on the server.

Note If you try to connect to the same server that you want to delete, when you try to delete the server that step 15 refers to, you may receive the following error message:
Error 2094. The DSA Object cannot be deleted0x2094  
6. Type quit, and then press ENTER. The Metadata Cleanup menu appears.
7. Type select operation target and press ENTER.
8. Type list domains and press ENTER. A list of domains in the forest is displayed, each with an associated number.
9. Type select domain number and press ENTER, where number is the number associated with the domain the server you are removing is a member of. The domain you select is used to determine whether the server being removed is the last domain controller of that domain.
10. Type list sites and press ENTER. A list of sites, each with an associated number, appears.
11. Type select site number and press ENTER, where number is the number associated with the site the server you are removing is a member of. You should receive a confirmation listing the site and domain you chose.
12. Type list servers in site and press ENTER. A list of servers in the site, each with an associated number, is displayed.  
13. Type select server number, where number is the number associated with the server you want to remove. You receive a confirmation listing the selected server, its Domain Name System (DNS) host name, and the location of the server's computer account you want to remove.
14. Type quit and press ENTER. The Metadata Cleanup menu appears.
15. Type remove selected server and press ENTER. You should receive confirmation that the removal completed successfully. If you receive the following error message, the NTDS Settings object may already be removed from Active Directory as the result of another administrator removing the NTDS Settings object or replication of the successful removal of the object after running the DCPROMO utility.
Error 8419 (0x20E3)
The DSA object could not be found


Note You may also see this error when you try to bind to the domain controller that will be removed. Ntdsutil has to bind to a domain controller other than the one that will be removed with metadata cleanup.
16. Type quit at each menu to quit the Ntdsutil utility. You should receive confirmation that the connection disconnected successfully.
17. Remove the cname record in the _msdcs.root domain of forest zone in DNS. Assuming that DC will be reinstalled and re-promoted, a new NTDS Settings object is created with a new GUID and a matching cname record in DNS. You do not want the DCs that exist to use the old cname record.

As best practice, you should delete the host name and other DNS records. If the lease time that remains on Dynamic Host Configuration Protocol (DHCP) address assigned to offline server is exceeded then another client can obtain the IP address of the problem DC.
18. In the DNS console, use the DNS MMC to delete the A record in DNS. The A record is also known as the Host record. To delete the A record, right-click the A record, and then click Delete. Also, delete the cname record in the _msdcs container. To do this, expand the _msdcs container, right-click cname, and then click Delete.

Important If this is a DNS server, remove the reference to this DC under the Name Servers tab. To do this, in the DNS console, click the domain name under Forward Lookup Zones, and then remove this server from the Name Servers tab.

Note If you have reverse lookup zones, also remove the server from these zones.  
19. If the deleted computer is the last domain controller in a child domain, and the child domain was also deleted, use ADSIEdit to delete the trustDomain object for the child. To do this, follow these steps: a.  Click Start, click Run, type adsiedit.msc, and then click OK
b.  Expand the Domain NC container.  
c.  Expand DC=Your Domain, DC=COM, PRI, LOCAL, NET.  
d.  Expand CN=System.  
e.  Right-click the Trust Domain object, and then click Delete.  
 
20. Use Active Directory Sites and Services to remove the domain controller. To do this, follow these steps: a.  Start Active Directory Sites and Services.
b.  Expand Sites.
c.  Expand the server's site. The default site is Default-First-Site-Name.  
d.  Expand Server.  
e.  Right-click the domain controller, and then click Delete.  
 

Jeff
0
 
Chris DentPowerShell DeveloperCommented:

That's not an error.... it just means you haven't selected anything else yet. It gradually fills those in as you go through the article.

Chris
0
 
NFCCAuthor Commented:
Chris,

It went throug fine and removed the orphaned domain.  Before when I went past this step (this was before I contacted Experts-Exchange) it would not remove the domain.  Thanks for the help.

Jeff
0
 
Chris DentPowerShell DeveloperCommented:

> Before when I went past this step (this was before I contacted Experts-Exchange) it would
> not remove the domain

Typical really... but don't things always happen like that? :)

Anyway, glad I could help.

Chris
0

Featured Post

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

  • 5
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now