Demote non responsive Windows 2K3 DC with NTDSUTIL

Posted on 2008-11-18
Last Modified: 2012-05-05
One of the drives in my second DC failed, unfortunately it takes with it part of the AD. I tried to restore it from backup but I'm missing ntds.dit and don't have the system state on backup. As of right now I have it up in Directory Services Restore mode and have not had much luck getting things back.
Which leaves me with the option to demote it from a domain controller and rejoin and set it back to replicate. DCPROMO obviously is not working on the failed DC so I'm left with NTDSUTIL to demote.

I found this article that seems to be straight forward:

I the article it mentions to try going into the AD of another DC, locate the bad one Right-click on the failed domain controller and select the Delete command. The only selection that will possibly work is the 3rd(see picture). I have not tried it because I wanted to make sure that IF it did work and deleted the server from the AD that I could go back and re-add it.
Any input would be greatly appreciated.


Question by:Floyd_Droid
    LVL 9

    Expert Comment

    you will do no harm with this.  
    it is definatley safer than ntdsutil, as one bad command can cause untold damage.
    try this option first.
    LVL 63

    Expert Comment

    You may also have to delete it from DNS, after doing the metadata cleanup

    If the demotion fails for any reason, you can forcibly demote it using dcpromo /forceremoval, after which you'll need to perform a metadata cleanup from a working DC as described here:

    I hope this helps !

    Author Comment

    Cool! I was able to remove it from the AD DC container. Hopefully, I have not yet been able to reboot the server yet since I have users still working. What other steps to I take promote it back and activate repication?

    Author Comment

    Nope, it still thinks it a domain controller. It came back want me to go back into Directory Services Restore mode. What now?

    Author Comment

    Okay, I went through both steps including the domain controller is no longer there. However, when I reboot I still get the message:

    lsass.exe System Error
    Security Accounts Manager initialization failed because of the following error:
    Directory Service cannot start. Error Status 0xC00002e1. Please click OK to shutdown and reboot into Directory Services Restore mode, check the event viewer for for detailed info.


    Author Comment

    It's like the Active Directory is still on the machine. Is there a way to get it off?

    Accepted Solution

    Okay got it off. Had to take some drastic steps and want to share them for the next poor unfortunate soul:

    (Read my earlier progress posts)

    I followed the below section:

    "The steps of the UNSUPPORTED way of removing AD from a server with W2K and W2K3 are:"


    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
    Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now