Group Policy was applied from deleted domain controller

AblSysadmin
AblSysadmin used Ask the Experts™
on
We have an issue with domain policies not being applied. After running a gpresult we have found that the policy is trying to update from a DC that was deleted about 3 years ago...

How can I find this ghost object and remove it?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
AblSysadminSenior Systems Engineer

Author

Commented:
Server being listed in gpresult not listed. these DC's were removed without any issues a bout 3years ago but still being ref by gpo
A "dcdiag /v /e /f:dcdiag.txt" might tell you why.
Exploring SQL Server 2016: Fundamentals

Learn the fundamentals of Microsoft SQL Server, a relational database management system that stores and retrieves data when requested by other software applications.

AblSysadminSenior Systems Engineer

Author

Commented:
found this in the result between all the current prod DC's

* SPN found :LDAP/a6a54aea-9b1c-4f94-ac33-8d4f99e96664._msdcs.domain.name
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/a6a54aea-9b1c-4f94-ac33-8d4f99e96664/domain.name

how can i removed this if i don't find it in DNS?
Where did you find it?

E3514235-4B06-11D1-AB04-00C04FC2DCD2 is the AD replication SPN
a6a54aea-9b1c-4f94-ac33-8d4f99e96664 is the DC GUID

This entry should only be registered on the DC with that GUID.

To see spn's:

setspn -l <name of DC>

To remove a spn:

setspn -d <SPN> <name of DC>
Try abandon your domain with one of your domain account and join domain again (I suppose you have a another dc ) and check your dns settings to clients resolve your new dc (on client side, in command prompt write ipconfig /flushdns)

good luck.
AblSysadminSenior Systems Engineer

Author

Commented:
removed pc from domain and readded it. no issues. with the setspn cmd:
FindDomainForAccount: DsGetDcNameWithAccountW failed!
Try, open OU that your computer belongs to, right click computer name select reset computer account (be careful, all GPOs,certificates are affected at this time).

If it doesn't work try move your client to another OU.


good luck
AblSysadminSenior Systems Engineer

Author

Commented:
How do i remove the old DC from the domain if the computer account does not exist anymore?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial