Link to home
Start Free TrialLog in
Avatar of erndog5800
erndog5800

asked on

FSMO Question about removing Child Domain in Server 2003 forest

I am planning to demote a child domain - which consists of two DCs - DC1 and DC2.  I've been reading up on how to go about this and I'm a little confused on a couple of things.  First - which order should I demote the DCs?  DC1 is the RID, PDC, and GC.  DC2 is the Infrastructure Master.  Should I transfer ALL roles to DC1 before running DCPROMO?  Or do I just run DCPROMO on the IM first and then run DCPROMO on the last server which is RID, PDC, and GC?  Also, I've read conflicting accounts of who I should be logged in as while demoting the child domain.  Should I be logged in as domain admin for the child or the parent (root)?
Avatar of RightNL
RightNL

if possible do this as an Enterprise admin thus being administrator of both the child and the parent domain.

I would first move all the roles to one box and demote the other.. this makes it much easier to remove the child domain since it's only one box.

than demote it if you want you can do a forrest clean up later.. if needs be.

What do you mean by "demoting" your child domain? Are you going to get rid of it completely? IF you are going to get rid of it then it doesn't matter which order your perform the demote.

You need to logon as the Enterprise Admin to perform to demotion.
if you want to do it clean I would demote the dc to get rid of it.. that's what I mean with demotion.. dcpromo and choose the option demote
Avatar of erndog5800

ASKER

Just to clarify -I want to completely remove the child domain.  So not neccessarily 'demoting' the domain, but 'removing it.  I thought having the GC on the same box as the Infrastructure was bad - does it not matter seeing as it will just be for the purpose of removing the domain? So - if this is kosher, I would transfer Infrastructure from DC2 to DC1, then DCPROMO on DC2.  Then DCPROMO on DC1?  All of this while logged in as the enterprise admin?  Meaning when I login as domain admin the 'log on to' domain will be the parent (root) domain and not the child domain.  Correct?

Sorry for the extra questions, I just want to ensure minimal ambiguity.
Ah, I just re-read ormerodrutter's post.  See what I mean about ambiguity?  Should I just demote away without transfering roles or consolidate on one server first?  
you can do it either way if you do it straight be sure to dcpromo box 2 first..

but to be on the safe side just bring the domain back to one machine.. and than kill that one box to make sure everything is gone and gone propperly..
ASKER CERTIFIED SOLUTION
Avatar of RightNL
RightNL

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
OK, thanks. I did take a look at this earlier on in my research but it was an old article (2004) so I wanted to ensure that the information in it was still valid.  I'll be pulling the trigger on this shortly - will let you know how things go. Do I need to leave some time after I transfer roles? Or is this immediate?
Hi Again - Looks like it went off without a hitch. I'm pleasantly suprised!  I did move the Infrastructure Master from DC2 to DC1, and I did get a warning about how it (IM) shouldn't be on the same machine as a GC, but I clicked OK and the roles transferred without any trouble.  I demoted DC2 without errors, rebooted, and joined it to the root domain.  Then I demoted DC1, rebooted, and rejoined to the root domain.  

The only thing I did differently was to log in using the Domain Admin of the child domain.  Halfway through the demotion process of DC, it asks for the credentials of the forest admin.  

Another cool bonus is that existing shares did not get blown away, and neither did printers, which is something I wasn't sure about and documented just in case.  If you test shares beforehand with root domain permissions, you're pretty much good to go after you blow away your child domain.  

Thanks for the help!  I split the points between you both.
I suggest you take a look in your DNS database and ensure removal of all trace of your child domain.
have a look at this..

if it all fails this shows you how to clean up..

http://support.microsoft.com/kb/216498

most of the steps won't be necessary but be sure to run through it .. it will show what steps are necessary to remove a dc (and the last of a subdomain) if it dies and you don't want to bring it back.. or if demotion failed..

dns is important ..

also the trusts are ..

just read through it. ...