Removing a Domain Controller from a Domain with AD-integrated zone for domain

Posted on 2015-02-10
Medium Priority
Last Modified: 2015-02-11
I have 2 domain controllers (Windows 2008 and Windows 2012 R2) running at each site (3 sites total in my network), both running with AD-integrated DNS zone for the domain.  My plan is to decommission the old Windows 2008 DC by uninstall ADDS and then DNS roles from this server.  Based on my understanding, I need to run "dcpromp"  which will remove domain controller and uninstall any AD-integrated zone.

Per technet, "After AD DS is removed, the DNS server role remains installed and running if it was previously installed on the domain controller. But any Active Directory–integrated DNS zones that were installed are removed. By default, the AD DS removal process also attempts to remove the Domain Name System (DNS) delegations for the zones that point to the domain controller."

My concern is that if I have other DNS servers running for the AD-integrated zone (since they are replicated by AD), is there anything I need to worry?  The DNS service will not be affected right (since I have other servers running DNS).  

I am just trying to be a litte bit more caution.  If something goes bad, there is no way to undo it.   Can someone confirm with me please?

Thank you!
Question by:ModCloth_IT
LVL 53

Expert Comment

by:Will Szymkowski
ID: 40602147
If you are demoting a domain controller and there is no issues while doing this process everything should be fine.

You can also check a few other things to ensure that the DC is removed.

netdom query dc

Another thing I would recommend is updating all DHCP scopes which use this DC for DNS and change it to another DC/DNS server that will be online. Also do this for any servers that have static IP's for DNS and also printers etc. This way you mitigate any issues after the demotion is successful.

LVL 40

Expert Comment

ID: 40602636
You are not deleting any zone, you are demoting domain controller

If you are delete any AD integrated zone, zone deletion will get replicated to all domain controllers and that zone got deleted from all DCs

As opposed when you demote DC, AD would just remove all AD integrated zones from that particular server by setting up flag as demoted and zones would get deleted from only that server
LVL 11

Accepted Solution

Venugopal N earned 2000 total points
ID: 40602862
I think you have been confused with the selection on demoting the DC "Delete the DNS delegations pointing to this server "

This option will removes any DNS delegation records for that specific server in DNS.  If that server is no longer going to run DNS, you wouldnt want any delegation records pointing to it.So we can select this, which will remove the delegation record of this server from DNS.Also the process will remove the appropriate SRV records.If the SRV records are not removed when demaoting the server, the client may be looking for this server for authentication.

None of the DNS zone will be deleted as part of the DCPROMO.

Refer the below link for more inforamtion on demoting the DC.


Author Comment

ID: 40604545
However, I got to a different error after trying to "delete the DNS delegations pointing to this server".

"DCPromo was unable to remove DNS delegations from the parent zone: "int".  This could be because of one of the following reasons: you do not have permission to do so, the zone is hosted by a server that does not run Windows, no server hosting this zone can be contacted or the zone does not exist.  

If the zone does exist, you should delete DNS delegations in the parent zone targeting this domain controller.  To do so, contact an administrator who is responsible for the DNS zone: "int".  
The error was:

The RPC server is unavailable."

Any someone advise how to remove the DNS delegations along while trying to use "dcpromo" to remove Domain Controller please?  

Your help and patience are greatly appreciated.  Thanks in advanced.

Author Comment

ID: 40604637
I went ahead to process and seem like no issue even I saw the error in the above.  After uninstall the ADDS from Server Manager and also uninstalled DNS, everythings look good and verify the domain controller is no longer show up in ADUC and the service record of this old server is no longer showing up in other DNS server.  Seem like i should not worry anymore.

Thanks everyone!

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Hallo! I guess almost every Windows Administrator must have got stumped with this question "Where does WINDOWS store a users cached credentials? Every user who had once logged onto a Server/Desktop while it was connected to the domain could sti…
This article covers how to install the Microsoft Windows Operating System (OS). What is covered in this article:  > Different Versions and Editions of the Windows OS  > Upgrading versus Fresh Installation of the OS           - Steps to take pr…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question