Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Remove Stale DC

Posted on 2009-07-09
9
Medium Priority
?
411 Views
Last Modified: 2012-05-07
Hi Experts,

In active directory I have a server listed as a DC that is no longer serving that role.  It appears the server at one point was reloaded, but the admin failed to demote it before proceeding.  In addition, the server was renamed exactly the same and rejoined as the member of the domain.

All roles and services are running properly on their corresponding servers, and their are no roles to seize back.

Since a replacement server has been installed on the network with exact name I am unsure if I can run the standard remove orphaned DC procedure.

Any suggestions on how to move forward?  (besides renaming the server?)

Thanks
0
Comment
Question by:gws226
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
9 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 2000 total points
ID: 24813238
When you go through the metadata cleanup process do you see the old  and new server listed?
http://msmvps.com/blogs/ad/archive/2008/12/17/how-to-remove-a-failed-or-offline-dc.aspx
Thanks
Mike
 
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813277
So you have two machine accounts in AD with the same name, one is a DC and one a member? Where are you seeing the DC listed?

If it's in AD Sites and Services or DNS, then you could just delete the relevant objects.
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813291
Sorry, to clarify, what I meant to say was -

If it's JUST in AD Sites and Services or DNS, and event logs/DCDIAG etc are not showing errors relating to this DC, then you could just delete the relevant objects.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 

Author Comment

by:gws226
ID: 24813298
It shows my current DCs correctly.
0
 

Author Comment

by:gws226
ID: 24813310
you type faster then I do.  :)

I suspect that was the case.  Its OK to delete from Sites and Services then?  (its actually an exchange box so I'm really looking for some solid confirmation before proceeding.

Thanks.
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813648
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.

In fact, every time I've ran a metadata cleanup in ntdsutil, I've had to manually delete the server object from AD Sites and Services.

I know Mike's already posted a link on the procedure, but this one also details some steps you have to carry out after ntdsutil, including deleting the server object from ADSS.

http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Tony


0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 24814755
Yes, I second the sites and services answer...it is ok to delete it.
Thanks
Mike
0
 

Author Comment

by:gws226
ID: 24815036
[quote]
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
[/quote]

Typo on my part.

It appears in ADUC but not in Sites and Services.
0
 

Author Closing Comment

by:gws226
ID: 31601571
The previous administrator also did some permission changes that prevented proper demotion of the DCs.  In addition to Mkline71's steps, I also had to change the security permissions as outlined here.

http://www.experts-exchange.com/Networking/Windows_Networking/Q_21548491.html
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Always backup Domain, SYSVOL etc.using processes according to Microsoft Best Practices. This is meant as a disaster recovery process for small environments that did not implement backup processes and did not run a secondary domain controller that ne…
Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question