Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 701
  • Last Modified:

Can't join server back into domain after force demotion

Dear experts,

Have a weird question. I have just force demote a secondary DC using the /forceremoval switch (normal dcpromo didn't work).Things went fine and the server has now become a standalone server (kicked out from the domain). I then logged onto another DC and found that this demoted DC still exists in the Domain Controller container, tried to delete but it says "DSA objects cannot be deleted".

OK no problem so far. I knew I need to do metadata cleanup so I followed the instructions given but when I reached the point where "list servers in site", the demoted DC does not exist. It only lists all the DCs that are still live but this demoted DC wasn't shown. However I still can't remove its entry in the Domain Controller container.

Is there anything I have missed, or need to do to remove the entry? I guess it is of no harm leaving it there but I just want it to be tidy.

Thanks in advance.
0
ormerodrutter
Asked:
ormerodrutter
3 Solutions
 
KCTSCommented:
How long was it since it was removed - it might just be a latency issue. Clear any references to the machine in DNS/WINS and clear the caches.
0
 
ormerodrutterAuthor Commented:
Yep true. Only did it this morning so I shall wait until Monday and check again. Thanks.
0
 
frsupportCommented:
I had this issue a couple of days ago, if you follow this resolution using ADSI Edit it should solve your problem, it solved mine.

Error Message: DSA Object Cannot Be Deleted

http://support.microsoft.com/kb/318698
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
himkalCommented:
hey you have clean the meta of the server from the ntdsutil  t

go to ntdsutil -- meta clean up

use this link to clean up
http://technet2.microsoft.com/windowsserver/en/library/012793ee-5e8c-4a5c-9f66-4a486a7114fd1033.mspx?mfr=true

and then try under domain in ntdsutil clean delete the server name u have forcefully removed.

then try to join it to domain it should work
0
 
himkalCommented:
I am sorry the second last line under adsiedit.msc check  under domain deleted the server name folder

then try to join again.
0
 
ormerodrutterAuthor Commented:
OK will give it a go next week. Thanks in advance.
0
 
ormerodrutterAuthor Commented:
Guys,

It has been 4 days and the record is still in the DC container so its not Latency issue.

ADSIEDIT is not what I wanted. I don't have an orphan NTDS settings. I am not trying to delete anything form AD Site and Services, my problem is that an orphan DC still exists in the DC Container in AD User and Computers. Metadata Cleanup is not clearing it as this "orphan" DC doesn't show in "List servers n site".

Anymore ideas?
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Tackle projects and never again get stuck behind a technical roadblock.
Join Now