Solved

Cannot demote dc - Last DNS server for zone

Posted on 2011-03-22
9
2,007 Views
Last Modified: 2012-05-11
Hi, having trouble demoting a domain controller (2008 integrated DNS)
I get an error complaining about this dc being the last dns for the following ad integrated zone.
This is a primary zone (not the same domain that the dc itself is on), ad integrated, accepting secure and non-secure updates.
thnks.
0
Comment
Question by:Nelesh_N
  • 5
  • 2
  • 2
9 Comments
 
LVL 74

Accepted Solution

by:
Glen Knight earned 334 total points
Comment Utility
If you check the properties of the zone on the Dc you are trying to demote, under Type click Change and uncheck the box for Store in Active Directory.  Then restart the DNS services.
0
 
LVL 1

Author Comment

by:Nelesh_N
Comment Utility
But I do need it to be stored in AD, I dont want anything ito the zone to change.
0
 
LVL 74

Expert Comment

by:Glen Knight
Comment Utility
You cannot have a DNS zone stored in AD if the DNS server is not a domain controller.

This is why you are receiving the error when trying to DCPROMO
0
 
LVL 9

Assisted Solution

by:Chev_PCN
Chev_PCN earned 166 total points
Comment Utility
If the zone is AD-integrated, then it should be replicated to all other DC's.
Verify this on the other DC's and check replication.
One worst case scenario would be to use the DCPROMO / forceremoval & then do a metadata cleanup afterwards. How many DC's do you have in total?
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 74

Expert Comment

by:Glen Knight
Comment Utility
Why would you want to do a forceremoval, it's a failry simply fix!!
0
 
LVL 9

Expert Comment

by:Chev_PCN
Comment Utility
As mentioned - worst case scenario only if the DC will not demote gracefully.
0
 
LVL 74

Expert Comment

by:Glen Knight
Comment Utility
But the reason it will not demote gracefully is because it has a zone on it which is AD integrated, it's a simple fix.
0
 
LVL 1

Author Comment

by:Nelesh_N
Comment Utility
It is AD integrated...
0
 
LVL 74

Assisted Solution

by:Glen Knight
Glen Knight earned 334 total points
Comment Utility
So change it so that it isn't AD Integrated and you will then be able to demote the server.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
Resolve DNS query failed errors for Exchange
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now