Link to home
Start Free TrialLog in
Avatar of Thor2923
Thor2923Flag for United States of America

asked on

Second domain controller crashed today and will not boot back up. How can I clean up active directory 2008r2??

It has been one of those days. Today I noticed a newly created mailbox had vanished and after some research I noticed that only or DC2 had the new active directory account in its ADUC. I tried to force replication but got errors, so I went ahead and rebooted DC2 and it never came back up.  Now I am stuck with a bogus DC listed in my sites and services. I know this is not healthy and want to properly remove DC2, but it looks like it is shot and will never boot again. How can I clean up AD without actually having the server to demote? BTW this is not related to my other DC question I have out there. Like I said, it has been one of those days!!
Avatar of becraig
becraig
Flag of United States of America image

You need to seize the FSMO roles from the dead server.
Seize FSMO roles
To seize the FSMO roles by using the Ntdsutil utility, follow these steps:

    Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being seized. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer schema or domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.
    Click Start, click Run, type ntdsutil in the Open box, and then click OK.
    Type roles, and then press ENTER.
    Type connections, and then press ENTER.
    Type connect to server servername, and then press ENTER, where servername is the name of the domain controller that you want to assign the FSMO role to.
    At the server connections prompt, type q, and then press ENTER.
    Type seize role, where role is the role that you want to seize. For a list of roles that you can seize, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to seize the RID master role, type seize rid master. The one exception is for the PDC emulator role, whose syntax is seize pdc, not seize pdc emulator.
    At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

For more details see:
http://support.microsoft.com/kb/255504

Once complete you can remove the  dead DC
To remove dead or orphaned D.C. you can go to Active Directory Users and Computers, then go to Domain Controllers OU, then you will see the list of Domain Controllers you can directly delete it with the following options which tells you what is the right action you will do, and don't forget to go to Active Directory Sites and Services to fully delete also the DC which is no longer use and no longer active to eliminate the error messages like NTDS.

     If you have also a Windows Based DNS Server delete also these entries at Forward Lookup Zones:

     1.)  (same as parent folders)   (Host A)   <IP Address of the dead Domain Controller>
     2.)  <DC Server Name>   (Host A)   <IP Address of the dead Domain Controller>

     At Reverse Lookup Zones:

     1.)  <IP Address of the dead Domain Controller>   Pointer (PTR)   <mydomain.com>
The second part of Craig's answer is known as a "metadata cleanup"  more iformation on that here

http://technet.microsoft.com/en-us/library/cc816907(v=ws.10).aspx#bkmk_graphical

How many DCs do you currently have up and running?

Thanks

Mike
Avatar of Thor2923

ASKER

I only have one more DC on this subnet, but 4 more DCs are located in 2 other offices and one newly introduced "sickly" DC in another new office. The last DC is another story and I have another thread going to try and clean that up, although my "sickly" DC probably has to be demoted and reinstated, I have no replication working on it. But to answer your question, I now have 5 functioning DCs on my network and only one in my home office
ok good so you have more than 2 so that is why I asked.  

Thanks

Mike
ASKER CERTIFIED SOLUTION
Avatar of Sandesh Dubey
Sandesh Dubey
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial