Second domain controller crashed today and will not boot back up. How can I clean up active directory 2008r2??

Posted on 2013-09-25
Medium Priority
Last Modified: 2013-10-10
It has been one of those days. Today I noticed a newly created mailbox had vanished and after some research I noticed that only or DC2 had the new active directory account in its ADUC. I tried to force replication but got errors, so I went ahead and rebooted DC2 and it never came back up.  Now I am stuck with a bogus DC listed in my sites and services. I know this is not healthy and want to properly remove DC2, but it looks like it is shot and will never boot again. How can I clean up AD without actually having the server to demote? BTW this is not related to my other DC question I have out there. Like I said, it has been one of those days!!
Question by:Thor2923
LVL 29

Expert Comment

ID: 39522897
You need to seize the FSMO roles from the dead server.
Seize FSMO roles
To seize the FSMO roles by using the Ntdsutil utility, follow these steps:

    Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being seized. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer schema or domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
    Click Start, click Run, type ntdsutil in the Open box, and then click OK.
    Type roles, and then press ENTER.
    Type connections, and then press ENTER.
    Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
    At the server connections prompt, type q, and then press ENTER.
    Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
    At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

For more details see:

Once complete you can remove the  dead DC
To remove dead or orphaned D.C. you can go to Active Directory Users and Computers, then go to Domain Controllers OU, then you will see the list of Domain Controllers you can directly delete it with the following options which tells you what is the right action you will do, and don't forget to go to Active Directory Sites and Services to fully delete also the DC which is no longer use and no longer active to eliminate the error messages like NTDS.

     If you have also a Windows Based DNS Server delete also these entries at Forward Lookup Zones:

     1.)  (same as parent folders)   (Host A)   <IP Address of the dead Domain Controller>
     2.)  <DC Server Name>   (Host A)   <IP Address of the dead Domain Controller>

     At Reverse Lookup Zones:

     1.)  <IP Address of the dead Domain Controller>   Pointer (PTR)   <mydomain.com>
LVL 57

Expert Comment

by:Mike Kline
ID: 39522960
The second part of Craig's answer is known as a "metadata cleanup"  more iformation on that here


How many DCs do you currently have up and running?


Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.


Author Comment

ID: 39523055
I only have one more DC on this subnet, but 4 more DCs are located in 2 other offices and one newly introduced "sickly" DC in another new office. The last DC is another story and I have another thread going to try and clean that up, although my "sickly" DC probably has to be demoted and reinstated, I have no replication working on it. But to answer your question, I now have 5 functioning DCs on my network and only one in my home office
LVL 57

Expert Comment

by:Mike Kline
ID: 39523173
ok good so you have more than 2 so that is why I asked.  


LVL 24

Accepted Solution

Sandeshdubey earned 2000 total points
ID: 39523456
As other suggested to need to perfrom metadata cleanup to remove the instances of faulty DC.If the faulty server is fsmo role holder server you also need to sieze fsmo role.

Complete Step by Step Guideline to Remove an Orphaned Domain controller (including seizing FSMOs, running a metadata cleanup, and more)

I will also recommend to verify the health of other DCs by dcdiag /q and repadmin /replsum and post the og if error is reoprted.You also need to ensure that clients now point to online DC for there preferred dns setting as faulty DC instances will be removed this may be in TCP/IP or dhcp setting.

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

High user turnover can cause old/redundant user data to consume valuable space. UserResourceCleanup was developed to address this by automatically deleting user folders when the user account is deleted.
I’m willing to make a bet that your organization stores sensitive data in your Windows File Servers; files and folders that you really don’t want making it into the wrong hands.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question