• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1380
  • Last Modified:

Removing a Domain Controller from a Domain with AD-integrated zone for domain

I have 2 domain controllers (Windows 2008 and Windows 2012 R2) running at each site (3 sites total in my network), both running with AD-integrated DNS zone for the domain.  My plan is to decommission the old Windows 2008 DC by uninstall ADDS and then DNS roles from this server.  Based on my understanding, I need to run "dcpromp"  which will remove domain controller and uninstall any AD-integrated zone.

Per technet, "After AD DS is removed, the DNS server role remains installed and running if it was previously installed on the domain controller. But any Active Directory–integrated DNS zones that were installed are removed. By default, the AD DS removal process also attempts to remove the Domain Name System (DNS) delegations for the zones that point to the domain controller."

My concern is that if I have other DNS servers running for the AD-integrated zone (since they are replicated by AD), is there anything I need to worry?  The DNS service will not be affected right (since I have other servers running DNS).  

I am just trying to be a litte bit more caution.  If something goes bad, there is no way to undo it.   Can someone confirm with me please?

Thank you!
0
ModCloth_IT
Asked:
ModCloth_IT
1 Solution
 
Will SzymkowskiSenior Solution ArchitectCommented:
If you are demoting a domain controller and there is no issues while doing this process everything should be fine.

You can also check a few other things to ensure that the DC is removed.

netdom query dc

Another thing I would recommend is updating all DHCP scopes which use this DC for DNS and change it to another DC/DNS server that will be online. Also do this for any servers that have static IP's for DNS and also printers etc. This way you mitigate any issues after the demotion is successful.

Will.
0
 
MaheshArchitectCommented:
You are not deleting any zone, you are demoting domain controller

If you are delete any AD integrated zone, zone deletion will get replicated to all domain controllers and that zone got deleted from all DCs

As opposed when you demote DC, AD would just remove all AD integrated zones from that particular server by setting up flag as demoted and zones would get deleted from only that server
0
 
Venugopal NCommented:
I think you have been confused with the selection on demoting the DC "Delete the DNS delegations pointing to this server "

This option will removes any DNS delegation records for that specific server in DNS.  If that server is no longer going to run DNS, you wouldnt want any delegation records pointing to it.So we can select this, which will remove the delegation record of this server from DNS.Also the process will remove the appropriate SRV records.If the SRV records are not removed when demaoting the server, the client may be looking for this server for authentication.

None of the DNS zone will be deleted as part of the DCPROMO.

Refer the below link for more inforamtion on demoting the DC.

https://technet.microsoft.com/en-us/library/cc771844(WS.10).aspx
https://technet.microsoft.com/en-us/library/cc816644(v=ws.10).aspx
0
 
ModCloth_ITAuthor Commented:
However, I got to a different error after trying to "delete the DNS delegations pointing to this server".

"DCPromo was unable to remove DNS delegations from the parent zone: "int".  This could be because of one of the following reasons: you do not have permission to do so, the zone is hosted by a server that does not run Windows, no server hosting this zone can be contacted or the zone does not exist.  

If the zone does exist, you should delete DNS delegations in the parent zone targeting this domain controller.  To do so, contact an administrator who is responsible for the DNS zone: "int".  
The error was:

The RPC server is unavailable."

Any someone advise how to remove the DNS delegations along while trying to use "dcpromo" to remove Domain Controller please?  

Your help and patience are greatly appreciated.  Thanks in advanced.
0
 
ModCloth_ITAuthor Commented:
I went ahead to process and seem like no issue even I saw the error in the above.  After uninstall the ADDS from Server Manager and also uninstalled DNS, everythings look good and verify the domain controller is no longer show up in ADUC and the service record of this old server is no longer showing up in other DNS server.  Seem like i should not worry anymore.

Thanks everyone!
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now