[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 412
  • Last Modified:

Main domain controller permanently offline

My client closed a branch office which was running his main DC. Now, some other offices are having issues, specifically a file server that runs out of my home. When new users are created on it, it doesn't replicate the info over to other DCs. He can't find the DC they pulled offline! What to do, what to do!

0
Member_2_4213139
Asked:
Member_2_4213139
  • 8
  • 8
  • 4
7 Solutions
 
nealerocksCommented:
Was that DC hosting any FSMO roles?
if so you need to sieze the roles and place them on another DC. Are you familiar with FSMO roles?
0
 
Member_2_4213139Author Commented:
Yes it was. It's been a long time, can't remember what to do at this point.
0
 
Member_2_4213139Author Commented:
Just noticed this in my event logs too

The attempt to establish a replication link for the following writable directory partition failed.
 
Directory partition:
DC=ForestDnsZones,DC=NETWORK,DC=DOMAINHIDDEN,DC=COM
Source domain controller:
CN=NTDS Settings,CN=ADC1,CN=Servers,CN=DOMAINHIDDEN,CN=Sites,CN=Configuration,DC=NETWORK,DC=DOMAINHIDDEN,DC=COM
Source domain controller address:
6533a677-ebcb-4c85-b696-5d8907dbd319._msdcs.NETWORK.DOMAINHIDDEN.COM
Intersite transport (if any):
 
 
This domain controller will be unable to replicate with the source domain controller until this problem is corrected.  
 
User Action
Verify if the source domain controller is accessible or network connectivity is available.
 
Additional Data
Error value:
1722 The RPC server is unavailable.

For more information, see Help and Support Center at
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
Mike KlineCommented:
A few follow up questions:
When he closed that office what did he do with the "main DC"?   Did they gracefully demote it or did they just shut it down and now it is sitting somewhere collecting dust?
How long ago was it shut off?
For the FSMO roles (discussed above)
Go to another DC and type netdom query fsmo  is it still showing the roles on the old DC.
Thanks
Mike
0
 
nealerocksCommented:
Well the first thing to do is find a suitable domain controller that you can transfer the FSMO roles to. I assume the old DC will never come back online again? Big problems if it does.
you need to use ntdsutil to seize the roles.

To seize the FSMO roles by using the Ntdsutil utility, follow these steps:

   1. Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being seized. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer schema or domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
   2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
   3. Type roles, and then press ENTER.
   4. Type connections, and then press ENTER.
   5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
   6. At the server connections prompt, type q, and then press ENTER.
   7. Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
   8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.
0
 
Member_2_4213139Author Commented:
mkline - 1. He just pulled it offline, CRAZY!
              2. I tried the netdom query fsmo, and it doesn't recognize netdom

nealerocks - I tried your suggestions. I wasn't able to do the ? properly on seize, so just did rid master and pdc. It did say something like seize not necessary, or something like that. I also have one last DC I need to completely pull out of the picture. How do I remove that one?
0
 
nealerocksCommented:
You still need to seize the domain naming master, infrastructure and schema master roles.
On the other DC you need to run dcpromo and removed active directory. I assume that DC does not have the DN, Schema or infrastructure roles?
You also need to make sure you have a global catalogue somewhere. The DC that you are moving the roles to, you can make that a GC.
0
 
Mike KlineCommented:
netdom is part of the support tools http://support.microsoft.com/kb/892777 (also on the server CD)
If it says seize not necessary the roles may have already been transferred
You can also view the roles via the GUI  http://www.petri.co.il/determining_fsmo_role_holders.htm
If you have seized all the roles then don't bring that old DC back online to properly demote it.  You will have issues because of the seizures.
You will have to run a metadata cleanup to get rid of it
http://support.microsoft.com/kb/216498
How is DNS configured on the remaining DC's?  
Thanks
Mike
0
 
Member_2_4213139Author Commented:
Okay, everything is done except for schema now. How do I move that? I went into snapins, but it's showing me that the other server is still the master. It then shows a "change" button, but only displays that same server, I want the new server.
0
 
nealerocksCommented:
Is the server that it is showing the one that is turned off?
if so this website has a step by step for seizing the schema master:

http://www.petri.co.il/transferring_fsmo_roles.htm
0
 
Member_2_4213139Author Commented:
no, it's another one that's on that I need to move off the domain. I've already transferred everything but schema.
0
 
nealerocksCommented:
You need to connect to the domain controller that you want to host the role. I think you can connect from the action menu. Once you have connected to the server that you will move the role to, then go to change and transfer the role.
0
 
Mike KlineCommented:
http://technet.microsoft.com/en-us/library/cc759254.aspx -- to transfer the schema master
So was that DC that was pulled off the network holding any of the roles.
0
 
Member_2_4213139Author Commented:
okay, so I successfully transferred the schema, rid master, pdc and infrasctructure. Anything else?

At this point, do I just remove the computer from the domain?

0
 
nealerocksCommented:
You also need to find the domain naming master and move that if necessary. Then run dcpromo on any DCs that you want to remove from the network. Dcpromo will uninstall active directory. Then you can just turn them off.
0
 
Member_2_4213139Author Commented:
okay, yes I moved the domain naming master as well. Running dcpromo now and obviously didn't check the thing saying it's the last DC
0
 
nealerocksCommented:
yep, i believe that is all you need to do. You can turn it off and delete its computer account in AD.
0
 
Member_2_4213139Author Commented:
YOU GUYS ROCK! Thanks for all the help!
0
 
nealerocksCommented:
You're welcome!
I hope the guy who shut down the server gets a telling off! :)
0
 
Mike KlineCommented:
No problem and good work by you too -- now you can enjoy your weekend :)
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 8
  • 8
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now