gws226
asked on
Remove Stale DC
Hi Experts,
In active directory I have a server listed as a DC that is no longer serving that role. It appears the server at one point was reloaded, but the admin failed to demote it before proceeding. In addition, the server was renamed exactly the same and rejoined as the member of the domain.
All roles and services are running properly on their corresponding servers, and their are no roles to seize back.
Since a replacement server has been installed on the network with exact name I am unsure if I can run the standard remove orphaned DC procedure.
Any suggestions on how to move forward? (besides renaming the server?)
Thanks
In active directory I have a server listed as a DC that is no longer serving that role. It appears the server at one point was reloaded, but the admin failed to demote it before proceeding. In addition, the server was renamed exactly the same and rejoined as the member of the domain.
All roles and services are running properly on their corresponding servers, and their are no roles to seize back.
Since a replacement server has been installed on the network with exact name I am unsure if I can run the standard remove orphaned DC procedure.
Any suggestions on how to move forward? (besides renaming the server?)
Thanks
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Sorry, to clarify, what I meant to say was -
If it's JUST in AD Sites and Services or DNS, and event logs/DCDIAG etc are not showing errors relating to this DC, then you could just delete the relevant objects.
If it's JUST in AD Sites and Services or DNS, and event logs/DCDIAG etc are not showing errors relating to this DC, then you could just delete the relevant objects.
ASKER
It shows my current DCs correctly.
ASKER
you type faster then I do. :)
I suspect that was the case. Its OK to delete from Sites and Services then? (its actually an exchange box so I'm really looking for some solid confirmation before proceeding.
Thanks.
I suspect that was the case. Its OK to delete from Sites and Services then? (its actually an exchange box so I'm really looking for some solid confirmation before proceeding.
Thanks.
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
In fact, every time I've ran a metadata cleanup in ntdsutil, I've had to manually delete the server object from AD Sites and Services.
I know Mike's already posted a link on the procedure, but this one also details some steps you have to carry out after ntdsutil, including deleting the server object from ADSS.
http://www.petri.co.il/delete_failed_dcs_from_ad.htm
Tony
In fact, every time I've ran a metadata cleanup in ntdsutil, I've had to manually delete the server object from AD Sites and Services.
I know Mike's already posted a link on the procedure, but this one also details some steps you have to carry out after ntdsutil, including deleting the server object from ADSS.
http://www.petri.co.il/delete_failed_dcs_from_ad.htm
Tony
Yes, I second the sites and services answer...it is ok to delete it.
Thanks
Mike
Thanks
Mike
ASKER
[quote]
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
[/quote]
Typo on my part.
It appears in ADUC but not in Sites and Services.
If it's only showing in AD Sites and Services, and you have no errors in DCDIAG on other DCs, the machine isn't in 'Domain Controllers' in ADUC, and the other servers in AD Sites and Services do not have connection objects linking to it, then you can just delete the object. It's a leftover from the metadata cleanup.
[/quote]
Typo on my part.
It appears in ADUC but not in Sites and Services.
ASKER
The previous administrator also did some permission changes that prevented proper demotion of the DCs. In addition to Mkline71's steps, I also had to change the security permissions as outlined here.
https://www.experts-exchange.com/questions/21548491/Cannot-delete-AD-account.html
https://www.experts-exchange.com/questions/21548491/Cannot-delete-AD-account.html
If it's in AD Sites and Services or DNS, then you could just delete the relevant objects.