Solved

Remove Stale DC

Posted on 2009-07-09
9
405 Views
Last Modified: 2012-05-07
Hi Experts,

In active directory I have a server listed as a DC that is no longer serving that role.  It appears the server at one point was reloaded, but the admin failed to demote it before proceeding.  In addition, the server was renamed exactly the same and rejoined as the member of the domain.

All roles and services are running properly on their corresponding servers, and their are no roles to seize back.

Since a replacement server has been installed on the network with exact name I am unsure if I can run the standard remove orphaned DC procedure.

Any suggestions on how to move forward?  (besides renaming the server?)

Thanks
0
Comment
Question by:gws226
  • 4
  • 3
  • 2
9 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 500 total points
ID: 24813238
When you go through the metadata cleanup process do you see the old  and new server listed?
http://msmvps.com/blogs/ad/archive/2008/12/17/how-to-remove-a-failed-or-offline-dc.aspx
Thanks
Mike
 
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813277
So you have two machine accounts in AD with the same name, one is a DC and one a member? Where are you seeing the DC listed?

If it's in AD Sites and Services or DNS, then you could just delete the relevant objects.
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813291
Sorry, to clarify, what I meant to say was -

If it's JUST in AD Sites and Services or DNS, and event logs/DCDIAG etc are not showing errors relating to this DC, then you could just delete the relevant objects.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:gws226
ID: 24813298
It shows my current DCs correctly.
0
 

Author Comment

by:gws226
ID: 24813310
you type faster then I do.  :)

I suspect that was the case.  Its OK to delete from Sites and Services then?  (its actually an exchange box so I'm really looking for some solid confirmation before proceeding.

Thanks.
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24813648
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.

In fact, every time I've ran a metadata cleanup in ntdsutil, I've had to manually delete the server object from AD Sites and Services.

I know Mike's already posted a link on the procedure, but this one also details some steps you have to carry out after ntdsutil, including deleting the server object from ADSS.

http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Tony


0
 
LVL 57

Expert Comment

by:Mike Kline
ID: 24814755
Yes, I second the sites and services answer...it is ok to delete it.
Thanks
Mike
0
 

Author Comment

by:gws226
ID: 24815036
[quote]
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
[/quote]

Typo on my part.

It appears in ADUC but not in Sites and Services.
0
 

Author Closing Comment

by:gws226
ID: 31601571
The previous administrator also did some permission changes that prevented proper demotion of the DCs.  In addition to Mkline71's steps, I also had to change the security permissions as outlined here.

http://www.experts-exchange.com/Networking/Windows_Networking/Q_21548491.html
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question