We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Remove Stale DC

gws226
gws226 asked
on
Medium Priority
431 Views
Last Modified: 2012-05-07
Hi Experts,

In active directory I have a server listed as a DC that is no longer serving that role.  It appears the server at one point was reloaded, but the admin failed to demote it before proceeding.  In addition, the server was renamed exactly the same and rejoined as the member of the domain.

All roles and services are running properly on their corresponding servers, and their are no roles to seize back.

Since a replacement server has been installed on the network with exact name I am unsure if I can run the standard remove orphaned DC procedure.

Any suggestions on how to move forward?  (besides renaming the server?)

Thanks
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2013
Commented:
Unlock this solution and get a sample of our free trial.
(No credit card required)
UNLOCK SOLUTION
bluntTonyHead of ICT
Top Expert 2009

Commented:
So you have two machine accounts in AD with the same name, one is a DC and one a member? Where are you seeing the DC listed?

If it's in AD Sites and Services or DNS, then you could just delete the relevant objects.
bluntTonyHead of ICT
Top Expert 2009

Commented:
Sorry, to clarify, what I meant to say was -

If it's JUST in AD Sites and Services or DNS, and event logs/DCDIAG etc are not showing errors relating to this DC, then you could just delete the relevant objects.

Author

Commented:
It shows my current DCs correctly.

Author

Commented:
you type faster then I do.  :)

I suspect that was the case.  Its OK to delete from Sites and Services then?  (its actually an exchange box so I'm really looking for some solid confirmation before proceeding.

Thanks.
bluntTonyHead of ICT
Top Expert 2009

Commented:
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.

In fact, every time I've ran a metadata cleanup in ntdsutil, I've had to manually delete the server object from AD Sites and Services.

I know Mike's already posted a link on the procedure, but this one also details some steps you have to carry out after ntdsutil, including deleting the server object from ADSS.

http://www.petri.co.il/delete_failed_dcs_from_ad.htm

Tony


CERTIFIED EXPERT
Top Expert 2013

Commented:
Yes, I second the sites and services answer...it is ok to delete it.
Thanks
Mike

Author

Commented:
[quote]
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
[/quote]

Typo on my part.

It appears in ADUC but not in Sites and Services.

Author

Commented:
The previous administrator also did some permission changes that prevented proper demotion of the DCs.  In addition to Mkline71's steps, I also had to change the security permissions as outlined here.

https://www.experts-exchange.com/Networking/Windows_Networking/Q_21548491.html
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a sample view!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.