AblSysadmin
asked on
Group Policy was applied from deleted domain controller
We have an issue with domain policies not being applied. After running a gpresult we have found that the policy is trying to update from a DC that was deleted about 3 years ago...
How can I find this ghost object and remove it?
How can I find this ghost object and remove it?
This guide would help you: http://www.petri.co.il/delete_failed_dcs_from_ad.htm
ASKER
Server being listed in gpresult not listed. these DC's were removed without any issues a bout 3years ago but still being ref by gpo
A "dcdiag /v /e /f:dcdiag.txt" might tell you why.
ASKER
found this in the result between all the current prod DC's
* SPN found :LDAP/a6a54aea-9b1c-4f94-a c33-8d4f99 e96664._ms dcs.domain .name
* SPN found :E3514235-4B06-11D1-AB04-0 0C04FC2DCD 2/a6a54aea -9b1c-4f94 -ac33-8d4f 99e96664/d omain.name
how can i removed this if i don't find it in DNS?
* SPN found :LDAP/a6a54aea-9b1c-4f94-a
* SPN found :E3514235-4B06-11D1-AB04-0
how can i removed this if i don't find it in DNS?
Where did you find it?
E3514235-4B06-11D1-AB04-00 C04FC2DCD2 is the AD replication SPN
a6a54aea-9b1c-4f94-ac33-8d 4f99e96664 is the DC GUID
This entry should only be registered on the DC with that GUID.
To see spn's:
setspn -l <name of DC>
To remove a spn:
setspn -d <SPN> <name of DC>
E3514235-4B06-11D1-AB04-00
a6a54aea-9b1c-4f94-ac33-8d
This entry should only be registered on the DC with that GUID.
To see spn's:
setspn -l <name of DC>
To remove a spn:
setspn -d <SPN> <name of DC>
Try abandon your domain with one of your domain account and join domain again (I suppose you have a another dc ) and check your dns settings to clients resolve your new dc (on client side, in command prompt write ipconfig /flushdns)
good luck.
good luck.
ASKER
removed pc from domain and readded it. no issues. with the setspn cmd:
FindDomainForAccount: DsGetDcNameWithAccountW failed!
FindDomainForAccount: DsGetDcNameWithAccountW failed!
Try, open OU that your computer belongs to, right click computer name select reset computer account (be careful, all GPOs,certificates are affected at this time).
If it doesn't work try move your client to another OU.
good luck
If it doesn't work try move your client to another OU.
good luck
ASKER
How do i remove the old DC from the domain if the computer account does not exist anymore?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.